Crypto projects suffered 135 hacks in the third quarter of 2026, with attackers stealing $1.14 billion, according to reports from analytics platform PeckShield.
September saw 55 major hacks, with total losses of $766.49 million. The largest attacks targeted Bitget and Liquid Network, resulting in losses of $387 million and $320 million, respectively. In the Liquid Network incident, $285 million was recovered.
These two incidents were the largest cryptocurrency thefts of the year so far. Losses from each exceeded those from the April attacks on Drift ($280 million) and KelpDAO (more than $290 million).
Other incidents among September’s ten largest hacks included attacks on:
- MEV bot yoink — $7.81 million; funds recovered;
- Duelbits — $7 million;
- DCENT Wallet — $6.57 million;
- Astroport — $4.9 million;
- Drop — $4.4 million;
- Nostra Finance — $3.5 million;
- Nomic bridge — $3.15 million.
August recorded 50 attacks in which $136.3 million was stolen. Decentralized service TectonicFi suffered the largest loss, with $74 million drained.
In July, crypto services suffered 30 attacks, with total losses of $210 million. Of that amount, $70 million came from a hack involving ColdCard cold wallets. The attack continued into August, bringing cumulative losses to $115 million.
In August and September, two data breaches involving hardware wallet manufacturer Trezor came to light. The first involved a breach of the systems of ShipMonk, the delivery service used by the company. The second affected its email provider.
After obtaining Trezor customers’ data, attackers began sending them phishing emails. The losses resulting from these emails remain unknown.
Every channel in the catalogue is checked by the editors against one method: it is how we work out the rating, place a channel at a risk level and decide whether it belongs in Market Scam.