Hacken Report: Crypto Incidents in Q3 Caused $1.18 Billion in Losses
A Hacken report records 107 incidents and $1.18 billion in stolen funds in the third quarter of 2026. It attributes the largest share of losses to smart contract exploits and operational failures.
Hacken’s Q3 2026 report states that 107 security incidents were recorded between July and September, with total stolen funds of $1.18 billion. According to the security firm, this represents a 55% quarter-over-quarter increase compared with the second quarter of 2026.
The data is Hacken’s estimate and classification. It is not an independently audited summary of all attacks in the industry, and other firms tracking blockchain crime may classify individual cases or their financial scope differently.
Hacken Report: Smart Contracts and Operational Controls
Hacken attributed 48% of total losses to smart contract exploits. According to the report, another 40% was related to failures involving access rights or operational controls. The remainder falls into other incident categories that the available factual overview does not break down further.
The firm identified supply chain attacks, compromised keys and failures of infrastructure used to sign transactions or process fund withdrawals as sources of the largest individual losses. Such cases may not result directly from an error in a smart contract’s source code.
The report highlights the limitations of a one-time contract audit. An audit may examine specific code and its known risks, but by itself it does not confirm the security of a project’s entire operation, including access management, key management, update deployment or external suppliers.
What This Means for Users and Operators
For users and investors, an audit does not demonstrate the security of the entire operational system. Security also depends on how a project protects administrator and signing keys, who is authorized to perform sensitive operations, and what controls it uses for withdrawals or system changes.
Alongside smart contract audits, protocol and exchange operators may also address continuous monitoring, access management, patch deployment controls and supply chain security. Hacken lists these areas among the factors behind the largest individual losses during the period under review.
The claim that audits alone create a “false sense of security” should be understood as an interpretation based on Hacken’s findings, not as a universal conclusion about all audits or crypto projects. The available text of the primary report also does not independently confirm the secondarily reported figure that approximately 77% of losses were related to vectors outside the usual scope of audits.
What to Watch Next
It will be important to see whether the scale of damage in the third quarter of 2026 is also confirmed by other independent security firms. Any publication of Hacken’s complete methodology and the list of incidents used to calculate the $1.18 billion figure will also be relevant.
Sources
- Hacken Q3 2026 Security and Compliance Report – Primary source for the report’s publication, the 107 incidents, the $1.18 billion figure, the quarter-over-quarter increase and the breakdown of losses by failure type.
- CoinDesk – Secondary coverage attributing the data and the broader conclusion about the limits of audits to Hacken.
Verified and updated: 10/18/2026 15:19
