Crypto hacks cost $1.18 billion in Q3 2026, according to Hacken

Losses related to hacks of cryptocurrency projects and platforms reached $1.18 billion in the third quarter of 2026, according to a report from the cybersecurity firm Hacken. This 55% increase compared to the previous quarter highlights the growing vulnerability of decentralized solutions, particularly in decentralized finance (DeFi), and could weigh on investor confidence. Context The crypto-asset market is undergoing a phase of accelerated maturation, marked by the increasing adoption of decentralized finance (DeFi) protocols and cross-chain infrastructures. However, this expansion is accompanied by a resurgence of cyberattacks exploiting technical flaws in smart contracts or governance mechanisms. According to CryptoScore Pro data as of October 28, 2026, Ethereum (ETH) and Avalanche (AVAX) – two major ecosystems for DeFi – show valuations of $284.83 billion and $3.92 billion respectively, with significant daily trading volumes. Security audits, although systematic for serious projects, are struggling to stem these risks. The Hacken report highlights the failure of "tier-1" audits to prevent incidents, emphasizing a gap between current standards and the sophistication of attacks. Furthermore, the European MiCA directive, which came into force in 2024, could soon impose reinforced compliance requirements, particularly for DeFi platforms. The Facts According to the quarterly report from Hacken published on October 28, 2026, financial losses related to crypto-asset hacks totaled $1.18 billion between July and September 2026, compared to $760 million in the second quarter (+55%). This figure, based on public data and voluntary feedback from victims, represents a minimum estimate, as some losses may not have been reported. The main takeaways from the report include: A 55% increase in the number of reported incidents compared to the previous quarter, with more than 200 targets identified, including wallets, cross-chain bridges, and decentralized exchange platforms (DEX). Five major recurring flaws, responsible for the majority of losses : Reentrancy attacks, exploiting vulnerabilities in the execution of smart contracts. Poor management of private keys, often linked to human error or data leaks. Contract configuration errors, notably excessive permissions. Oracle vulnerabilities, allowing for price manipulations. Flash-loan attacks, using instantaneous loans to drain liquidity pools. No details are provided on the specific protocols affected, nor on the exact distribution of losses by ecosystem. However, Hacken emphasizes that the attacks primarily targeted DeFi projects on Ethereum and Avalanche , where total values locked (TVL) average over 5 million dollars, according to CryptoScore Pro data as of October 28, 2026. Market data from CryptoScore Pro on the same date indicates a contrasting reaction from the assets concerned: ETH shows a decrease of 5.78% over seven days, while AVAX declines by 8.58%. Hacken's HAI token, on the other hand, progresses slightly (+0.83% over seven days), possibly due to a renewed interest in security solutions. Understanding Key Concepts Decentralized Finance (DeFi) and Smart Contracts Decentralized Finance (DeFi) refers to a set of financial services – loans, exchanges, insurance – operating without a central intermediary, via smart contracts . These smart contracts are self-executing computer programs deployed on a blockchain such as Ethereum. For example, a DeFi lending protocol allows a user to borrow stablecoins against crypto-asset collateral, all managed by transparent and immutable code. However, these contracts are vulnerable to bugs or attacks if their logic is not perfectly secured. Total Value Locked (TVL) The Total Value Locked (TVL) measures the sum of assets deposited in a DeFi protocol, expressed in dollars. It reflects user confidence and available liquidity. For example, a protocol with a TVL of 100 million dollars means that its users have locked this amount to participate in activities such as staking or lending. A high TVL attracts hackers, as it represents a lucrative target. According to CryptoScore Pro, protocols targeted in the third quarter of 2026 displayed average TVLs exceeding 5 million dollars. Flash-loan and market manipulation A flash-loan is an instantaneous, collateral-free loan that must be repaid within the same blockchain transaction. This feature, unique to DeFi, allows for rapid arbitrage or refinancing. However, hackers use it to manipulate prices: by borrowing an asset massively, they can artificially inflate its price on one platform, then sell it for profit on another. These attacks, although complex, caused significant losses in 2026, as highlighted in the Hacken report. Oracle and manipulation risk An oracle is a service that provides external data (such as an asset price) to a smart contract. For example, a DeFi protocol may use an oracle to know the real-time price of ETH and adjust its lending rates. If the oracle is compromised – through an attack or an error – the contracts that depend on it become vulnerable. Hackers often exploit this flaw to trigger forced liquidations or massive sell-offs, as observed in several incidents in the third quarter of 2026. Analysis: what is at stake The losses of 1.18 billion dollars in the third quarter of 2026 reveal underlying economic and financial mechanisms that go beyond a simple accumulation of incidents. First, the 55% increase in attacks reflects a supply and demand dynamic in the cybersecurity market: the more DeFi protocols accumulate value (with average TVLs exceeding 5 million dollars on Ethereum and Avalanche, according to CryptoScore Pro), the more attractive targets they become for hackers. This concentration of risk creates a vicious circle: losses fuel mistrust, reducing the liquidity of the tokens concerned and amplifying their volatility. Furthermore, the exploited vulnerabilities – reentrancy, manipulated oracles, or flash-loans – illustrate a structural…