In its quarterly report, Hacken lists 107 incidents and $1.18 billion stolen in the third quarter of 2026 within the crypto sphere. It attributes 77% of this total to audit blind spots: a com
In its quarterly report, Hacken lists 107 incidents and $1.18 billion stolen in the third quarter of 2026 within the crypto sphere. It attributes 77% of this total to audit blind spots: a compromised crypto provider, an undeployed patch, or a component outside the latest review. Only 14% of the losses fall under the last case, and about $384 million were neither recovered nor covered.
A crypto audit describes a scope at a given date that itself sells audits, Hacken recalls in its Q3 2026 report. However, three attack vectors concentrated $906.8 million. That represents 77% of the losses, in just 11 incidents (see table below).
The heaviest case is that of the crypto exchange Bitget. According to SlowMist and Mandiant, $387.5 million stolen on September 24, 2026 via a vulnerability in a third-party security product.
Attack Vector Loss Incidents Share of losses Compromised provider or development tool $411.5M 2 35% Undeployed public patch $324.8M 4 28% Component outside last review $170.5M 5 14% Source: Hacken, Q3 2026 report, October 2026.Only the last vector targets a component outside review, accounting for $170.5 million. This represents 14% of the losses. In this context, Tectonic accounts for about 70%. According to our calculations, that equals $120 million out of $170.5 million.
Hacken lists four crypto audits there. However, the exploited risk parameters were not within the reviewed scope: $120.4 million were borrowed in a single transaction.
An audit is a piece of evidence, not a legal refuge.
Krish Gosai, Gosai Law, Hacken Q3 2026 report, October 2026
The $1.18 billion figure is a gross amount. It does not measure the final loss of crypto users in any way. According to Hacken:
On the crypto regulation side, ESMA launched on July 8, 2026, a common supervisory action on custody by providers authorized under MiCA. National authorities will verify key management, crypto incident response, and third-party dependencies. Hacken sees a model change: crypto licensing becomes the start of continuous supervision.
National controls will continue until the first half of 2027, then ESMA will consolidate their results in a report to its Supervisory Board in the second half of 2027. Until then, Hacken recommends institutional crypto players retest their systems after each update, parameter change, or security alert.
