Q3 hack data shows crypto attackers have moved from code to infrastructure
CertiK counted $1.26 billion in Q3 losses. The biggest thefts hit vendor appliances, node releases and wallet firmware, not smart contracts.
SECURITY & HACKSEXCHANGESANALYSIS
Lukas Brenner
10/28/20263 min read
The third quarter of 2026 was the costliest stretch for crypto security this year, and the shape of the losses matters more than the total. CertiK counted $1.26 billion stolen across 247 incidents between July and September, up roughly 54% from $819.4 million in the second quarter. Yet three of the four largest incidents had little in common with the classic DeFi exploit, in which an attacker finds a flaw in a smart contract and drains a pool. They went through a security vendor's appliances, a gap in a sidechain's software releases and a flaw in hardware wallet firmware.
September did most of the damage. CertiK put the month at about $769 million across 99 incidents, the worst month of 2026 so far, and PeckShield's separate tally landed in the same range. Some of that money came back. CertiK estimates that about $273 million was frozen or returned, which cuts September's net losses to roughly $495 million. The gap between gross and net figures is a trend in its own right, because it reflects how quickly stablecoin issuers, exchanges and investigators can now act once funds start moving.
The exchange breach that started at a vendor
Bitget's $387.5 million loss alone made up about 31% of the quarter's total. According to the exchange's disclosures and the investigations by SlowMist and Mandiant, the attackers did not break any wallet cryptography. They used a zero-day vulnerability in third-party security appliances, read a database password from an environment variable, moved laterally to the server that runs wallet jobs and then issued withdrawal commands with high-level internal credentials. SlowMist traced the earliest malicious activity to August 31, more than three weeks before funds left the hot and warm wallets.
The lesson is uncomfortable for every centralized platform. Tools bought to protect a network sit at privileged points inside it, and a flaw in one of them can hand an intruder a path to the most sensitive systems. Bitget said the loss fell within its User Protection Fund, which held more than $464 million, and it pointed to North Korean actors, citing IP patterns and wallet overlaps identified by Elliptic and TRM Labs. That fits a broader pattern. Blockaid's mid-year report linked the two largest first-half incidents, KelpDAO at $292 million and Drift at $285 million, to DPRK-linked groups and described social engineering on LinkedIn that ended with compromised multisig signers.
When the patch exists but nobody runs it
The Liquid Network incident in early September exposed a different weakness. The attacker abused a bug in range-proof verification in Elements, the software behind Blockstream's Bitcoin sidechain, minted about 4,000 L-BTC with no bitcoin behind it and redeemed the tokens through the regular peg-out process. Halborn's analysis notes that the flaw had already been fixed in the Elements codebase, but the fix had not shipped in a tagged release, so nodes on the official version stayed exposed. A self-described white hat later returned 3,400 of the coins, which accounts for a large share of September's recoveries.
The Coldcard thefts belong to the same family. According to TRM Labs, a build error in firmware released in March 2021 caused some devices to generate seeds from a weak software random number generator, cutting effective key strength far below the intended 128 bits. Attackers began sweeping wallets on July 30 and, by Galaxy Research's count, emptied more than 5,200 addresses. No smart contract was involved, and no device had to be touched.
What the numbers say about where risk sits
Taken together, the quarter points to a shift in where value is most exposed. Immunefi data cited by The Block shows DeFi exploit losses this year are down about 74% from their 2022 peak, a sign that audits, bug bounties and battle-tested contract templates are paying off. Blockaid nonetheless recorded more exploit incidents in the first half of 2026 than in all of 2025. The resulting picture is one of many small contract bugs and a handful of very large failures in operations, key management and software supply chains. October so far fits that split: Initia halted its layer-1 and rollups on October 23 after an attacker used a flaw in a Move function to mint unbacked AUSD and bridge value to Ethereum, an incident worth a few million dollars rather than hundreds of millions.
For the fourth quarter, three markers are worth watching. The first is whether exchanges start disclosing which vendors and internal systems sit in the withdrawal path, now that Bitget has shown how a security appliance can become an entry point. The second is release discipline for node and wallet software: how fast security fixes reach tagged versions and how firmly operators are pushed to upgrade. The third is the recovery rate. If freezes and negotiated returns keep cutting gross losses by a third, as they did in September, the industry's real security bill will look different from the headline numbers, even as attackers keep looking for the weakest link outside the code.