Crypto theft in 2026 is less about cracking blockchains and more about getting around the people and software that surround them. Security company Hacken counts $1.18 billion lost across 107 incidents in the third quarter alone, Cointelegraph reported, with 77% linked to compromised suppliers or developer tools, publicly disclosed fixes that had not been deployed, and components outside security reviews.

The pattern shows up across TSN’s coverage. Ledger confirmed that one affected user’s device bought through the reseller CryptoBilis “contained an unauthorized hardware implant”, and Bitquery has put losses among CryptoBilis buyers at $92.9 million, a figure that is not Ledger’s. Trezor has since cut its reseller network. Attackers also abuse trusted channels: a fake security alert sent through NGRAVE’s LIQUID app led owners to a phishing page, and Coldcard says a phishing link was posted from its official X account.

Protocols are still being hit directly. Qubic stopped its network after an attacker drained 1,404 wallets whose seeds were generated with insufficient randomness, and Cysic shut its cross-chain bridge after an unauthorised mint of 10 million CYS tokens. Sometimes the bug is caught first: the XRP Ledger disclosed a flaw that could have created XRP from nothing, fixed on 25 September, with no evidence it was exploited.

That matters for anyone holding crypto, because recovery is rare. Blockaid says only 0.8% of the $1.18 billion stolen across 60 major exploits from January to August had been returned to victims by early September, and that $287.1 million sits in wallets that can be watched but not frozen. The Drift case shows why: a wallet linked to the $295 million April hack sent about $61 million of Ether to the Tornado Cash mixer, Cointelegraph reported. Drift says Mandiant attributed the attack to a North Korean threat group.

Where things stand: several incidents are still under investigation, and many loss figures are estimates from blockchain analytics firms rather than the projects themselves. TSN attributes each figure to whoever gives it and updates this page as cases develop.

Timeline