Crypto security losses reached $1.18 billion across 107 incidents in the third quarter of 2026, according to blockchain security firm Hacken, as vulnerabilities in third-party tools, vendors and incomplete audit coverage accounted for most of the damage.
Hacken said losses climbed 55% from the previous quarter. About $906.8 million—roughly 77% of the total—was linked to compromised vendors or development tools, known vulnerabilities that had not been patched, and software components left outside the scope of the latest security audit.
The figures shift attention away from individual smart-contract errors and toward the technology supply chain supporting crypto platforms. A protocol can commission an audit and still face substantial exposure if it relies on an external security product, an unpatched dependency or operational systems that auditors did not examine.
The quarter’s largest incident involved an attack on Bitget that Hacken estimated at at least $352 million. The attacker allegedly exploited a weakness in a third-party security product, gaining access to withdrawal infrastructure. The case illustrates how access-control systems and service providers can create a single point of failure even where the underlying blockchain remains operational.
Audit boundaries come under scrutiny
Hacken’s estimate that 77% of quarterly losses were connected to limited audit coverage, external suppliers or known technical issues puts pressure on the common practice of treating an audit as a broad security guarantee.
An audit typically examines a defined set of code, often at a specific point in a project’s development. It may not cover cloud infrastructure, staff access controls, wallet-management systems, future software upgrades, third-party integrations or changes made after the review. In practical terms, projects handling user funds need to treat security as an ongoing operational process rather than a one-time technical milestone.
The findings also arrive while leveraged trading remains active despite a broader retreat in lower-capitalization tokens. Hyperbot data showed that a trader known as “Machi Big Brother” reopened a 25-times leveraged Ether long position after being fully liquidated about four hours earlier. The new position held 1,745 ETH, valued at roughly $4.2 million in the supplied data, with a listed liquidation price of $2,364.
Such positions can amplify short-term market moves, but the security losses documented by Hacken reflect a separate category of risk. Traders using leverage can be forced out by price volatility; users of compromised platforms or protocols can lose assets through failures in infrastructure and access management.
Market breadth weakens despite modest large-cap gains
The security report coincided with a week of broad selling pressure among smaller digital assets. Research firm 10x Research said 141 tracked tokens fell by an average of 14% over the past week, while Bitcoin declined 3%. The firm also reported lower trading volume, a contracting stablecoin supply and ETF flows turning into net outflows.
Over the past 24 hours, several large cryptocurrencies posted modest gains in the supplied market data. Bitcoin rose 0.91%, Ether added 0.24%, Solana gained 0.72%, XRP advanced 0.61% and BNB rose 0.82%. NEAR and SUI were among the stronger large-cap movers, up 2.67% and 2.12%, respectively.
Those daily increases offer limited evidence of a broad recovery after the reported weekly decline in alternative tokens. Narrow market participation can leave less-liquid assets more vulnerable to sharp reversals, especially when trading activity is falling. Small gains in major coins also do not remove the operational risks identified in Hacken’s review.
France advances stablecoin tax change
In France, the National Assembly approved a budget amendment that would alter the tax treatment of crypto-to-stablecoin conversions from Jan. 1, 2027. The amendment passed by 38 votes to 37, with 25 abstentions.
Under the proposal, swapping a crypto asset for a single-currency stablecoin pegged to a fiat currency, such as the euro or US dollar, could trigger capital gains tax even if the user does not withdraw into conventional currency. The applicable flat rate was described in the supplied material as about 31.4%.
The measure would place stablecoin conversions closer to taxable disposal events rather than allowing traders to treat them as a neutral move inside the digital-asset market. Its final effect depends on the legislative process and implementation details, but the narrow vote indicates that the policy remains politically contested.
Prediction-market operators challenge Missouri
Regulatory pressure is also moving through U.S. courts. Crypto.com’s prediction-market platform and Novig filed a federal lawsuit against Missouri officials seeking to block enforcement of the state’s restrictions on sports event contracts.
Missouri Attorney General Catherine Hanaway sent cease-and-desist letters in September to six platforms, ordering them either to stop offering such contracts to Missouri residents within 30 days or obtain a state licence and pay a 10% tax, according to the companies’ court challenge.
The plaintiffs argued that the letter was addressed to Foris DAX Inc. rather than the trading platform itself. They also pointed to Missouri’s constitutional limit of two mobile sports prediction licences, saying both licences had already been issued. The dispute could test whether event-contract platforms can operate under federal market rules when states classify their products as regulated sports wagering.
Across security, taxation and market regulation, the quarter’s record loss total offers the clearest immediate warning: crypto users and platforms face risks that extend well beyond token prices. External software providers, infrastructure controls and the precise legal classification of a product can determine outcomes as decisively as market direction.
Worried about rising crypto hacks? Strengthen your defenses with crypto safety standards every trader should know today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
