Hacken: $1.18 billion stolen in Q3 across 107 incidents, up 55%
Smart contract exploits caused 48% of losses, up from 12% in the second quarter, while access control failures fell to 40% from 88%, Hacken said.
- Hacken counted $1.18 billion stolen from July to September 2026 across 107 incidents, up 55% from the second quarter.
- Smart contract exploits caused 48% of losses, up from 12% in the second quarter, according to Hacken's Q3 report.
- PeckShield counted $766.5 million stolen in September alone, a monthly figure equal to 65% of Hacken's quarterly total.
Smart contract exploits as a share of stolen funds, %: 12 in Q2 2026, 48 in Q3 2026. Source: Hacken Q3 2026 report.
Hacken, a blockchain security firm, said in its Q3 2026 Security and Compliance Report, listed on Oct. 15, that $1.18 billion was stolen from digital asset projects across 107 incidents, a 55% rise on the second quarter.
Losses rose 55% to $1.18 billion, about $11 million per incident
Hacken's Q3 2026 report puts theft from July to September at $1.18 billion across 107 incidents. That is about $11.0 million per incident (our calculation: 1,180 / 107).
A 55% rise implies second-quarter losses of about $761 million, a gap of $419 million (our calculation: 1,180 / 1.55). Hacken's report page does not state the second-quarter total.
Altcoin Buzz on OneBullEx reported the same totals on Oct. 16.
Smart contract exploits took 48% of losses, up from 12%
Hacken said smart contract exploits caused 48% of third-quarter losses, up from 12% in the second quarter. Access control and operational failures caused 40%, down from 88%.
The two categories add up to 88% (our calculation: 48 + 40). The report page does not name the remaining 12%.
The report says the largest single-incident losses came from supply chain attacks, key compromises and failures in signer and withdrawal infrastructure. It names no incidents or amounts.
Hacken wrote that "Q3 2026 was one of the costliest quarters on record for digital asset security."
Other trackers show September carried much of the quarter
PeckShield counted 55 major incidents and $766.5 million stolen in September, and CertiK recorded 97 incidents and $768.4 million, Cointelegraph reported on Oct. 1.
September alone equals 65% of Hacken's quarterly total (our calculation: 766.5 / 1,180). Trackers use different definitions, so their totals cannot be added together.
Chainalysis titled an Oct. 1 post on tracing the $387 million North Korea stole from Bitget, and Elliptic's Sept. 25 headline said suspected North Korean heists had passed $1 billion in 2026.
Regulators fined service providers $450,000 and targeted named executives
Hacken's compliance team reported $450,000 in regulatory fines issued to crypto-asset service providers worldwide in the quarter.
The report adds that regulators are increasingly holding specific founders and senior executives personally responsible for failures.
Report in numbers
| Metric | Value | Period | Source |
|---|---|---|---|
| Stolen funds | $1.18 billion | Q3 2026 | Hacken Q3 report |
| Incidents | 107 | Q3 2026 | Hacken Q3 report |
| Change on Q2 | +55% | Q3 vs Q2 | Hacken Q3 report |
| Smart contract exploit share | 48%, from 12% in Q2 | Q3 2026 | Hacken Q3 report |
| Access control and operational share | 40%, from 88% in Q2 | Q3 2026 | Hacken Q3 report |
| Regulatory fines | $450,000 | Q3 2026 | Hacken Q3 report |
| Average per incident | $11.0 million our calculation | Q3 2026 | Hacken data |
As reported by Hacken for July to September 2026. The average is our calculation from the total and the incident count.
The totals rest on one firm's definitions
The report page gives no Q2 total, no incident list and no chain breakdown, so the comparison with other trackers is indicative only.
A secondary report also cited a split by audit status. It does not appear on Hacken's page, and we did not use it.
How we reported this: Figures come from Hacken's Q3 report page, opened Oct. 18, and from Cointelegraph's tracker totals. The per-incident average and Q2 estimate are our calculation (1,180 / 107 and 1,180 / 1.55). The report PDF was not opened.
Source: hacken.io