Yep that's Hacken's Q3 2026 report published Oct 15.
*Confirmed:*$AGT $SIREN $TIA
- *$1.18B across 107 incidents* in Q3 2026 - worst quarter since *Q1 2025 ($1.6B, driven by $1.4B Bybit hack by North Korea)*
*Big 4 made up ∼80% of losses:*
- *Bitget: $387M* - supplier compromise
- *Liquid Network: $320M* exploit
- *Tectonic: $120M* exploit on Cronos
- *Coldcard firmware vuln: ∼$115M* estimated losses
*Root cause is the newsworthy part:*
- *77% = ∼$906M* attributed to *compromised suppliers / dev tools / public fixes not deployed / components outside security reviews* - not classic smart contract bugs
- Smart contracts still most _frequent_: *71 incidents, $228M* - but less $ impact
- Median loss *$670k*, 98 incidents <$10M
*Recoveries - better than it sounds:*
- *$387M (33%) returned or reversed:*
- Liquid: self-proclaimed white hats returned *$272M (85%)*
- Tectonic: Cronos validators *rolled back 114 minutes of chain history*, reversing *$111.2M of $120.4M*
- Circle/Tether froze *$340k* from Bitget theft
- *$410M covered by operators from own funds:*
- Bitget protection fund *$387M*
- Triple-A, Coinsbuy, TAC repaid *∼$22M*
- *$384M (32%) still not returned nor covered* - remains with attackers
*Confirmed:*$AGT $SIREN $TIA
- *$1.18B across 107 incidents* in Q3 2026 - worst quarter since *Q1 2025 ($1.6B, driven by $1.4B Bybit hack by North Korea)*
*Big 4 made up ∼80% of losses:*
- *Bitget: $387M* - supplier compromise
- *Liquid Network: $320M* exploit
- *Tectonic: $120M* exploit on Cronos
- *Coldcard firmware vuln: ∼$115M* estimated losses
*Root cause is the newsworthy part:*
- *77% = ∼$906M* attributed to *compromised suppliers / dev tools / public fixes not deployed / components outside security reviews* - not classic smart contract bugs
- Smart contracts still most _frequent_: *71 incidents, $228M* - but less $ impact
- Median loss *$670k*, 98 incidents <$10M
*Recoveries - better than it sounds:*
- *$387M (33%) returned or reversed:*
- Liquid: self-proclaimed white hats returned *$272M (85%)*
- Tectonic: Cronos validators *rolled back 114 minutes of chain history*, reversing *$111.2M of $120.4M*
- Circle/Tether froze *$340k* from Bitget theft
- *$410M covered by operators from own funds:*
- Bitget protection fund *$387M*
- Triple-A, Coinsbuy, TAC repaid *∼$22M*
- *$384M (32%) still not returned nor covered* - remains with attackers