Crypto projects lost $1.18 billion to hacks and other security incidents in the third quarter of 2026, according to Hacken’s latest Security and Compliance Report. The firm counted 107 incidents between July and September, putting quarterly losses 55% above the level seen in Q2.

Hacken said the quarter was notable not only for the size of the losses, but for a clear change in how the damage was distributed. Smart-contract exploits represented a much larger share of losses than they had three months earlier, while access-control and operational failures accounted for a smaller portion of the total.

Attack mix shifted sharply from Q2

Hacken’s report says smart-contract exploits accounted for 48% of losses in Q3 2026. In the previous quarter, that category had represented 12% of losses, marking a sharp increase in its relative share.

At the same time, access-control and operational failures fell to 40% of losses from 88% in Q2. The figures show that even as total losses increased, the pattern of attacks changed materially from one quarter to the next.

Biggest losses still tied to key and infrastructure weaknesses

The report does not suggest that older risk areas have disappeared. Hacken said the largest individual losses in Q3 were still linked to supply-chain attacks, compromised keys, and weaknesses in signer and withdrawal systems.

That distinction matters because a category can represent a smaller share of total losses while still producing some of the most damaging single incidents. Hacken also said smart-contract and protocol-code vulnerabilities continued to account for a large number of incidents during the quarter.

Why audits alone may not be enough

Hacken’s findings challenge a common assumption that a completed code audit is enough to demonstrate that user funds are secure. A review of a contract can identify defects in one part of a system, but it does not automatically protect the signing setup, deployment pipeline, or external software used around it.

In that sense, the report points to security gaps that sit outside the audited code itself. Weaknesses in infrastructure, vendor dependencies, and operational processes can still lead to major losses even when a project highlights a past audit as a sign of safety.

Recurring techniques and the case for continuous checks

The report also flags repeated attack methods and cases in which fixes were already publicly known before an exploit took place. That suggests some teams were hit by issues that had already been identified, rather than entirely new or unforeseeable flaws.

As presented by Hacken, the next practical step is not simply more one-time reviews, but ongoing security checks and follow-through after audits are completed. The firm’s Q3 data indicates that scope, timing, and operational discipline matter alongside any audit label when assessing crypto project security.

Source: bitcoinist.com