Crypto hacks climb to $1.18 billion in Q3 as Bitget, Liquid incidents drive losses

Traders Union
All News
Crypto
Crypto hacks climb in Q3

Highlights

Q3 crypto hacks total $1.18 billion, with 77% ($906 million) linked to supplier or developer tool compromises and major infrastructure breaches.
The four largest incidents—$387 million Bitget hack, $320 million Liquid Network exploit, $120 million Tectonic exploit, and Coldcard's $115 million vulnerability—account for 80% of total quarterly losses.
Of the $1.18 billion lost, $387 million is returned or reversed and operators cover $410 million, leaving $384 million unrecovered for users.

Q3 losses concentrate in major infrastructure breaches

As reported by Cointelegraph, citing Hacken, about 77% of third-quarter losses, or roughly $906 million, stems from compromised suppliers or developer tools, publicly disclosed fixes that had not been deployed, and other components outside security reviews.

The four largest incidents are the $387 million Bitget hack, the $320 million Liquid Network exploit, the $120 million Tectonic exploit, and the Coldcard firmware vulnerability, which is associated with an estimated $115 million in losses. About 80% of the quarter's losses are concentrated in those four events, while 98 of the 107 recorded incidents remain below $10 million. The median loss across all incidents stands at $670,000.

Although supplier compromises and infrastructure failures account for most of the stolen value, smart contract incidents remain the most frequent attack vector. Hacken says they represent 71 incidents and $228 million in losses during the quarter.

Recoveries and operator support limit net user damage

Of the $1.18 billion lost in the quarter, around $387 million is returned or reversed, equal to roughly 33% of gross losses. Following the Liquid Network attack, self-described white hat actors return $272 million, or about 85% of the stolen value.

In the Tectonic incident, Cronos validators roll back 114 minutes of settled blockchain history, reversing about $111.2 million of the $120.4 million in affected borrowing. Circle and Tether also freeze about $340,000 linked to the Bitget theft.

Operators cover another $410 million of user losses from their own funds. Bitget's user protection fund accounts for $387 million of that total, while Triple-A, Coinsbuy and TAC repay about $22 million, leaving around $384 million, or 32% of gross losses, neither returned nor covered.

Hacken urges the industry to strengthen cybersecurity controls around third-party suppliers, developer tools and external infrastructure. The company also recommends broader audits covering oracles, bridgers, custody systems, signing authorities and other privileged components.

In our earlier report on Cohere’s planned acquisition of AI cybersecurity startup AISLE, we covered how the deal would add AI-driven software vulnerability detection to the group Cohere is building through its merger with Germany’s Aleph Alpha. We noted that AISLE’s research-focused approach had already uncovered hundreds of new bugs, including multiple OpenSSL vulnerabilities that were subsequently fixed—highlighting how proactive security testing is becoming a strategic priority as threats evolve.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.