Q3 2026 was one of the costliest quarters on record for digital asset security. Between July and September, $1.18B was stolen across 107 incidents, up 55% from Q2. Most incidents hit smart contracts and protocol code. The largest single-incident losses came from supply chain attacks, key compromises, and failures in signer and withdrawal infrastructure.
What’s inside
The Hacken research team tracked the quarter’s losses: how much was lost, how the losses broke down, and how they changed over time. They also mapped the attack paths and exploit mechanisms behind the major incidents. Hacken’s GRC team covered the quarter’s main regulatory actions worldwide, across supervision and enforcement.
The report ends with a trends outlook, our conclusions, and an exclusive security and compliance data pack.
Key figures
- $1.18B lost across 107 incidents, up 55% from Q2
- Smart contract exploits: 48% of losses, up from 12% in Q2
- Access control and operational failures: 40% of losses, down from 88% in Q2
- $450K in fines issued to CASPs worldwide
Key trends
- Losses are split almost evenly between smart contract exploits and access control failures.
- Public security fixes once again came before several high-profile exploits.
- The same exploit classes keep appearing across different codebases and programming languages.
- Regulators are starting to test whether controls hold up in continuous operation, not just at a single point in time.
- Regulators are increasingly holding specific founders and senior executives personally responsible for exploits and incidents.
We thank Bluechip, Gosai Law, Stellar Development Foundation, Chainlink Labs, and Europeum-EDIC for their contributions.
Go deeper than the report
Get the Q3 Venue Risk Pack. Discover how 12 prediction markets and derivatives exchanges expose institutional users to control, governance and infrastructure risk. Fill in the form and we'll send it to you.
Reserve early access
