Two security firms have measured crypto's third quarter of 2026 and published totals that sit within 7% of each other while disagreeing by more than two to one on how many incidents occurred. CertiK reports $1.26 billion lost across 247 incidents, per Cointelegraph. Hacken reports $1.18 billion across 107 incidents, according to a write-up of its report published on 15 October by Gokhshtein, a secondary source we could not check against Hacken's own document. The dollar totals nearly agree and the counts do not. Working out why tells you what a crypto hack total is actually measuring, and it points to something more useful than either number: a handful of incidents account for most of the money, and the biggest cause lay outside the smart contracts that audits examine.
Two totals for one quarter
CertiK's figure of $1.26 billion is up 53.9% from $819.4 million in the second quarter, when it counted 219 incidents, according to Cointelegraph. Its largest incidents were Bitget at about $387.5 million (roughly 31% of the quarter), Liquid Network at $319 million on 6 September, Tectonic at $120 million and a Coldcard theft of $112.7 million. For September alone CertiK reports about $769 million across 99 incidents, of which about $273 million was frozen or returned, leaving an adjusted loss of $495.3 million. Exploits accounted for $734 million of the September total across 58 incidents.
Hacken's headline is $1.18 billion across 107 incidents, which the write-up describes as the most damaging period since the first quarter of 2025. About 77%, or roughly $906 million, came from compromised suppliers, developer tools or infrastructure. Ninety-eight of 107 incidents were under $10 million, and the median loss was $670,000. Hacken's top four incidents are the same four names: Bitget at $387 million, Liquid Network at $320 million, Tectonic at $120 million and a Coldcard firmware vulnerability at $115 million.
Where the two reports actually disagree
Because both firms name the same four incidents with figures that differ by only a few million dollars each, we can isolate the disagreement. CertiK's four add up to about $939 million, or 74.5% of its total. Hacken's four add up to about $942 million, or 79.8% of its total. The big four are effectively agreed. What differs is everything else. CertiK's remaining $321 million is spread across 243 incidents, an average of about $1.3 million each. Hacken's remaining $238 million is spread across 103 incidents, an average of about $2.3 million each.
That is a quantitative comparison neither source makes, and it changes what the headline gap means. Averaged across all incidents, Hacken's implies about $11.0 million per incident and CertiK's about $5.1 million, which looks like a large difference in method. But the difference is almost entirely in the long tail of small incidents. CertiK counted roughly 140 more of them, covering around $83 million more in aggregate. The most probable explanation is a difference in what qualifies as an incident, such as a size threshold, a treatment of phishing and individual wallet drains, or a rule on which scams to include. Neither source we read states its methodology, so this is an inference from the arithmetic, not a finding.
Gross versus net, and the recovery puzzle
Both firms report gross losses, but they handle recoveries differently, and recoveries are large. CertiK's September figure nets out about $273 million frozen or returned, bringing $769 million down to $495.3 million, a reduction of about 35%. Hacken reports that about $387 million, roughly 33% of gross losses, was returned or reversed. The two proportions are similar, though they cover different periods, so they are not directly comparable.
Hacken adds that operators covered about $410 million from their own funds and that about $384 million, or 32%, was neither returned nor covered, which the write-up calls a permanent capital drain. The write-up does not say how these categories overlap. Added together, $387 million, $410 million and $384 million come to about $1,181 million, almost exactly the $1.18 billion total, which suggests the three are meant as non-overlapping slices of the gross loss. That is our reading of the arithmetic; the write-up does not state it. If it is right, the lasting loss to users and exchanges in Q3 was closer to $384 million than to $1.18 billion, and the hack total mostly measures gross exposure at the moment of the incident.
Concentration and the supply-chain pattern
The median loss in Hacken's data is $670,000, yet four incidents account for roughly four-fifths of the dollar value. That is the signature of a heavy-tailed distribution: the typical incident is small, and the total is dominated by a few very large ones. In practice, a quarterly hack total behaves less like a count of events and more like the record of a few large operators. One change in whether a single exchange is included or excluded moves the total by about a third.
The largest of the four illustrates the supply-chain point. Cointelegraph reports that Bitget detected unauthorised transfers from some hot wallets, suspended withdrawals, and said the attackers exploited a vulnerability in a third-party security product to obtain internal credentials and forge withdrawal commands. A related Cointelegraph article, citing SlowMist, links the activity to a zero-day exploit on 31 August. Both accounts are reported claims, not findings from a completed investigation. If the mechanism is accurate, the weakness was in a tool deployed to protect the exchange, outside the exchange's own smart contracts and therefore outside what a code audit of those contracts would test.
Hacken's classification should be read with care. Its 77% supply-chain share includes, per the write-up, publicly disclosed vulnerabilities for which fixes had not yet been deployed. That puts a delay in patching under the same heading as a compromise of a supplier, which are different failures with different remedies. The same report says smart contract incidents were the most frequent vector, 71 events costing $228 million. In other words, by count the old problem remains the most common; by value, the infrastructure around the code dominates.
What this means for anyone citing a hack total
The practical lessons are specific. First, state which firm's figure you are using, whether it is gross or net, and what counts as an incident, because the same quarter can be $1.18 billion or $1.26 billion depending on the source. Second, compare quarters from the same firm only. CertiK's own Q2-to-Q3 rise of 53.9% is meaningful as a like-for-like change; mixing it with Hacken's totals is not. Third, treat a quarterly total as a statement about a few large events. For users, the Bitget case suggests that an exchange's risk includes the security vendors it depends on, and that an audit of its smart contracts does not cover them.
A caution on scale: CertiK's own H1 2026 report, as summarised in a press release, put first-half losses at over $1.31 billion, so Q3 alone came close to matching the whole first half. Whether that reflects a worsening threat or a few large incidents landing in one quarter is not something these reports can answer.
