Hackers stole $1.18 billion across 107 incidents in the third quarter of 2026, 55% more than the previous quarter, according to a report from security firm Hacken as summarized by CoinDesk on Oct. 18. The finding that gives the story its headline: about $906.8 million of that came from compromised suppliers or developer tools, public security fixes that hadn't been applied, or components excluded from the latest security review. In other words, a large share of the losses came from parts of the system an audit may not have covered. PumpReport relied on CoinDesk's summary; we have not independently reviewed Hacken's report.
The incidents named
CoinDesk lists several of the quarter's largest losses. Bitget lost at least $352 million in September via a vulnerability in a third-party security product that gave access to its withdrawal infrastructure. Liquid Network lost $319 million, and Coldcard wallet software about $114 million. Tectonic lost at least $75 million. An incident labeled Ledger / CryptoBilis accounts for about $93 million, stolen through an unauthorized hardware "spy" implant in a device sold by a Southeast Asian reseller. Separately, CoinDesk reports July bridge and cross-chain exploits cost more than $35 million across three protocols in six hours, including $24 million from AFX Trade after attackers gained control of its validator keys.
Why "audited" doesn't mean "safe"
The article's framing is Hacken's: an audit is a snapshot of specific code at a specific time, and the quarter's losses came disproportionately from things outside that snapshot, such as third-party software, signing systems, and fixes not yet installed. Hacken says companies holding customer funds are responsible for tracking vulnerabilities and installing fixes promptly rather than relying on an audit completed months or years earlier. Hacken's Matiukhin said investors shouldn't assume an audit badge covers the whole system, since reviews often omit wallets, signing systems and third-party software, and flagged delayed fixes and under-scoped audits as concerns. It's worth remembering that Hacken is itself a security firm, so these are one industry participant's findings and recommendations; CoinDesk doesn't report an independent check of them.
The derivatives-venue review
Hacken also reviewed 12 derivatives exchanges and prediction markets. It found that more than $700 million in secure assets at two major venues depended on a four-key, three-signature arrangement, or on administrative keys whose holders weren't publicly identified. Hacken said it found no live bug at any venue it reviewed. That's a finding about governance and key management, not about an exploit, and the article doesn't name the two venues. It's relevant to anyone who uses leveraged venues, covered in our Ultimate Guide to Perpetual Futures Markets, because the same venues where liquidations happen hold the collateral behind them (see What Is a Crypto Liquidation?).
What's missing from the summary
CoinDesk's article does not report a breakdown of the quarter's losses by attack type, nor the share of hacked projects that had been audited, two numbers that would test the headline claim directly. The article also cites different incident figures at different levels of precision (some "at least"), and our chart marks those. If you rely on this data, read Hacken's report, which CoinDesk links, rather than our summary of a summary.
Fast answers
How much was stolen in crypto hacks in Q3 2026?
Hackers stole $1.18 billion across 107 incidents in Q3 2026, 55% more than the previous quarter, according to a Hacken report as summarized by CoinDesk.
Why does Hacken say audits give a false sense of security?
Hacken says about $906.8 million of Q3 losses came from compromised suppliers or developer tools, unapplied public security fixes, or components excluded from the latest security review, and that investors shouldn't assume an audit badge covers wallets, signing systems and third-party software.
What were the biggest Q3 2026 hacks named?
CoinDesk named Bitget (at least $352 million), Liquid Network ($319 million), Coldcard wallet software (about $114 million), Ledger and reseller CryptoBilis (about $93 million) and Tectonic (at least $75 million).
What did Hacken find about derivatives exchanges?
Hacken reviewed 12 derivatives exchanges and prediction markets and found over $700 million at two major venues depended on a four-key, three-signature arrangement or on administrative keys whose holders weren't publicly identified. It found no live bug at any reviewed venue.
Sources: CoinDesk (Olivier Acuna, Oct. 18, 2026), summarizing Hacken's Q3 2026 report. PumpReport did not review the report itself.