Hacken Counts $1.18 Billion in Third-Quarter Crypto Losses, With Most Coming From Systems Outside Audit Scope

Security firm Hacken counted 107 hacking incidents with $1.18 billion in losses in the third quarter of 2026. CryptoSlate reports that losses rose 55% while private-key theft fell 30%. Hacken attributes about $906 million, or 77% of the total, to compromised vendor and developer tools, fixes that had been disclosed but not deployed, and infrastructure outside the scope of audits. Smart-contract bugs caused the most incidents, 71, but only $228 million in losses. About a third of the gross losses was later returned or reversed.

Bitget, about $352 million to $387.5 million. Attackers used a zero-day flaw in a third-party security product to obtain internal credentials, then pushed forged withdrawals through the exchange's normal approval process, which signed them automatically. Chief executive Gracy Chen said the losses came from spoofed transfers, not stolen private keys. The attackers drained hot and warm wallets, while cold storage was untouched. Halborn attributes the theft to North Korea's Lazarus Group based on laundering patterns and wallet links. Estimates of the loss vary by source. CoinDesk cites $352 million and BlockSec cites $387.5 million.

SingularityNET, about $16.77 million. On September 19 and 20, an attacker stole the bridge's offline conversion-authorizer key and used it to sign valid messages. The attacker drained 8.7 million FET and minted AGIX, NTX and WMTx tokens across the Ethereum-Cardano bridge. Fetch.ai paused conversions, and PeckShield estimated the attacker's holdings at $16.77 million.

Duelbits, about $7 million. Hot wallets at the crypto casino sent funds on Ethereum, BNB Chain, Tron and Bitcoin to new addresses within minutes. Scam Sniffer suspects a private-key compromise. Nearly a month later, the funds remain missing, and no suspect has been named. Duelbits lost $4.6 million to a hot-wallet drain in February 2024.

NEAR Intents, $3.8 million. A deposit bug in how the Omni deposit and withdrawal system interacted with the swap-layer contract let an attacker withdraw funds on October 1. The protocol paused 11 networks. The exploiter returned all funds within about 36 hours.

Papertrade, $1.28 million. The perpetual futures exchange on HyperEVM offers up to 1,000x leverage and takes prices from external sources. On launch day, attackers manipulated the reference price on one venue and collected profits on another, at the expense of its passive liquidity pools. The team now says it will keep its PAPER token non-transferable, citing the risk of further attacks on its perpetual markets.