Crypto theft reaches $1.18 billion in the third quarter, mostly through suppliers and infrastructure
September, 2026 (Third quarter 2026)
Hacken counts $1.18 billion stolen across 107 incidents in the third quarter, the highest since early 2025. About 77% came from compromised suppliers, developer tools or infrastructure rather than flaws in smart contracts, and the four largest incidents made up about 80% of the value. PeckShield counted 50 incidents worth $136 million in August and 55 worth about $766 million in September, while CertiK counted 97 incidents and about $768 million for September. TRM Labs counted about $972 million across 207 incidents in the first half. Totals differ by tracker and method.
Why it matters
The money is concentrated in a few large thefts, and most of them started with people or third-party systems, not clever code exploits.
What defenders can take from it
- Spend security effort on key management, vendor access and staff verification as well as on code audits.
- Treat any single loss figure as an estimate and check which tracker produced it.