# Hacken Counts $1.18 Billion in Third-Quarter Crypto Losses, With Most Coming From Systems Outside Audit Scope

Four incidents led by the Bitget breach caused about 80% of the losses, and new post-mortems on SingularityNET, Duelbits, NEAR Intents and Papertrade show the same pattern.

- Published: 2026-10-20T05:39:30.204Z
- Canonical: https://polylog.news/crypto/2026-10-20/hacken-counts-1-18-billion-in-third-quarter-crypto-losses-wi
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/crypto-hacks-surge-55-to-1-2b-but-key-theft-drops-by-30/), [Rekt News (Bitget)](https://www.rekt.news/), [Polylog editors](https://polylog.news)

Security firm Hacken counted [107 hacking incidents with $1.18 billion in losses](https://www.gncrypto.news/news/bitget-liquid-hacks-drive-crypto-losses-to-1-18b-in-q3/) in the third quarter of 2026. CryptoSlate reports that losses [rose 55% while private-key theft fell 30%](https://cryptoslate.com/crypto-hacks-surge-55-to-1-2b-but-key-theft-drops-by-30/). Hacken attributes about $906 million, or 77% of the total, to compromised vendor and developer tools, fixes that had been disclosed but not deployed, and infrastructure outside the scope of audits. Smart-contract bugs caused the most incidents, 71, but only $228 million in losses. About a third of the gross losses was later returned or reversed.

**Bitget, about $352 million to $387.5 million.** Attackers used a zero-day flaw in a [third-party security product](https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/) to obtain internal credentials, then pushed forged withdrawals through the exchange's normal approval process, which signed them automatically. Chief executive Gracy Chen said the losses came from [spoofed transfers, not stolen private keys](https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says). The attackers drained hot and warm wallets, while cold storage was untouched. Halborn [attributes the theft to North Korea's Lazarus Group](https://www.halborn.com/blog/post/explained-the-bitget-hack-september-2026) based on laundering patterns and wallet links. Estimates of the loss vary by source. CoinDesk cites $352 million and BlockSec cites $387.5 million.

**SingularityNET, about $16.77 million.** On September 19 and 20, an attacker [stole the bridge's offline conversion-authorizer key](https://www.kucoin.com/news/flash/hackers-exploit-singularitynet-vulnerability-mint-over-313m-tokens-worth-16-77m) and used it to sign valid messages. The attacker drained 8.7 million FET and minted AGIX, NTX and WMTx tokens across the Ethereum-Cardano bridge. Fetch.ai paused conversions, and PeckShield estimated the attacker's holdings at $16.77 million.

**Duelbits, about $7 million.** Hot wallets at the crypto casino sent funds on Ethereum, BNB Chain, Tron and Bitcoin to new addresses within minutes. Scam Sniffer [suspects a private-key compromise](https://www.coindesk.com/business/2026/09/24/crypto-casino-duelbits-goes-offline-after-usd7m-hot-wallet-hack). Nearly a month later, the funds [remain missing](https://www.iredellfreenews.com/gaming/2026/duelbits-confirms-7million-dollars-still-missing-nearly-a-month-later), and no suspect has been named. Duelbits lost $4.6 million to a hot-wallet drain in February 2024.

**NEAR Intents, $3.8 million.** A [deposit bug](https://www.cryptotimes.io/2026/10/17/near-intents-traces-3-8m-exploit-to-smart-contract-deposit-bug/) in how the Omni deposit and withdrawal system interacted with the swap-layer contract let an attacker withdraw funds on October 1. The protocol paused 11 networks. The exploiter [returned all funds](https://www.coindesk.com/tech/2026/10/01/near-intents-hit-by-usd3-8-million-exploit-as-crypto-s-rough-year-of-hacks-continues) within about 36 hours.

**Papertrade, $1.28 million.** The perpetual futures exchange on HyperEVM offers up to 1,000x leverage and takes prices from external sources. On launch day, attackers [manipulated the reference price on one venue and collected profits on another](https://www.kucoin.com/news/flash/papertrade-suffers-1-28m-loss-on-launch-day-due-to-exploitation), at the expense of its passive liquidity pools. The team now says it will [keep its PAPER token non-transferable](https://t.me/BWEnews/16551), citing the risk of further attacks on its perpetual markets.

## What this means

The losses are no longer concentrated in the places audits examine. Exchanges, bridges and casinos lost money through signing systems, approval pipelines and vendor software, each of which functioned exactly as designed. The precedent is Bybit in February 2025, when Lazarus compromised a wallet interface rather than the smart contracts and took about $1.4 billion. The more likely outcome over the next quarter is that exchanges and bridge operators add independent verification of transactions before signing and cut the balances held in hot wallets. Insurers and counterparties will start asking about vendor software, not only about contract audits. Large centralized venues that cannot show independent signing checks carry higher counterparty risk for depositors. This read is wrong if fourth-quarter losses shift back toward contract-code bugs.

## What to watch

- Whether Bitget or the vendor names the third-party product involved. Other exchanges running the same software would face the same exposure.
- How much of the SingularityNET minted supply gets frozen or invalidated, because unbacked AGIX and NTX tokens dilute what backs the rest of the supply.
- Whether Papertrade changes how it sources prices before enabling PAPER transfers, since keeping the token non-transferable only limits the damage of the attack it already suffered.