Cryptocurrency security breaches cost the industry $1.18 billion in the third quarter of 2026, according to Hacken's Q3 Security and Compliance Report. The firm documented 107 incidents between July and September, marking a significant shift in the types of attacks causing the largest losses.
Smart-contract exploits dominated Q3 losses, accounting for 48% of the total damage, a sharp increase from 12% in Q2. Meanwhile, access-control and operational failures dropped from 88% of Q2 losses to 40% in Q3, even as overall attack damage rose.
The largest individual losses, however, remained tied to supply-chain attacks, compromised cryptographic keys, and weaknesses in signer and withdrawal systems. These infrastructure vulnerabilities continued to pose significant risks despite the rise in smart-contract-focused incidents.
The report underscores a critical distinction for projects seeking to demonstrate security posture. Code audits, while valuable, address only one component of security architecture. A contract review cannot by itself protect the signing processes, deployment infrastructure, and third-party software that surround it.
Hacken's findings also revealed recurring attack techniques and cases where security fixes were publicly disclosed before exploits occurred. This pattern highlights the ongoing importance of continuous security monitoring rather than reliance on single-point audits.
For users and investors evaluating projects, security audits remain relevant but require careful consideration of their scope, recency, and follow-up processes.
