Third Quarter Losses Topped the First Half
Crypto hacks pulled $2.68 billion from exchanges and protocols in the first nine months of 2026, according to CertiK's October tally. Third-quarter crypto hacks alone accounted for $1.365 billion of that total, outpacing the $1.315 billion lost across January through June. September closed as the year's costliest month at $768 million, driven by two attacks that together drained over $700 million.
The acceleration contradicts early-year reporting that framed 2026 as a decline. CertiK's mid-year report had noted a 46.8% drop compared to the first half of 2025, but that figure included the $1.45 billion Bybit theft from February 2025. Adjusted for that outlier, the January-June 2026 figure ran 28% higher than the same period in 2025. By September, the year-over-year comparison flipped entirely.
September Surge Led by Bitget and Liquid
Bitget's September 24 breach extracted $387.5 million, the largest single incident of 2026. The Ledger wallet implant that drained $102 million in October followed a pattern seen across multiple Q3 attacks: compromised admin credentials combined with governance gaps. Liquid Network's September 6 loss of $318.7 million brought the two-platform total to $706 million, accounting for 92% of September's $768 million in total hacks.
CertiK counted 97 incidents in September alone, up from 50 in August. The month's losses exceeded August by 462%, based on PeckShield's tally. Year-to-date incidents reached 656 by the end of September, with more than half occurring in the third quarter.
Tracker Confusion Masks the Real Pattern
Multiple trackers reported different totals for the same periods. TRM Labs placed 2026 crypto hacks "just below $1 billion" in an August report, while CertiK's H1 figure stood at $1.315 billion. The discrepancy stems from varying inclusion criteria: some trackers exclude returned funds, others omit centralized exchange breaches or off-chain compromises that lead to on-chain transfers.
After recoveries, CertiK adjusted the $2.68 billion gross total down to $2.26 billion. Liquid Network returned $285 million of the stolen bitcoin, and other smaller incidents saw partial recoveries. The KelpDAO lawsuit over its $291.3 million April loss highlighted governance disputes around cross-chain bridge security standards, a recurring theme in Q3 exploits.
Known Vulnerabilities Continue to Work
Single-verifier bridge setups, flagged as a systemic risk in LayerZero's documentation, were exploited in multiple Q3 crypto hacks. An April 2026 bug report on Cosmos EVM modules went unpatched until three separate chains were drained in August. Drift Protocol lost $285.3 million in April through an oracle manipulation gap that a 2024 Neodyme audit had classified as informational, not critical.
The pattern shows a widening gap between disclosed vulnerabilities and deployed fixes. Governance timelock mechanisms, recommended across DeFi protocols since 2024, remain absent from multiple platforms that suffered governance-driven exploits in Q3. North Korean groups accounted for an estimated $1 billion of the year's losses, per Elliptic, targeting platforms with weak admin key management and minimal multisig requirements.