The industry has seen two striking trends operating simultaneously: crypto lost $1.26 billion to hacks, while bitcoin bulls enjoyed a monster quarter. The question on everyone’s mind is how one can keep climbing while the other keeps losing.
The Numbers Behind the Hack Wave
The security firm CertiK, which monitors such incidents, documented 247 security breaches during the third quarter of 2026. Together, those 247 events resulted in losses of $1.26 billion for the sector. The year’s running total now sits at $2.68 billion.
The month of September proved to be the most severe yet, with a total of 99 incidents recorded — the highest number since February 2025. A sum of $768.5 million was taken during that time, marking the largest monthly haul of 2026 ever reported.
CoinDesk reported that Nicolai Sondergaard, a senior research analyst at Nansen, said the optics were poor, and he added that the harm went beyond what the figures show.
“Yes, it is bad optics,” Sondergaard said. “The reputational damage can still be larger than the losses themselves. Repeated exploits reinforce the idea that crypto infrastructure remains operationally fragile, which can slow institutional adoption, increase scrutiny from regulators and custodians, and make allocators demand a higher risk premium.”
The losses hardly show up against the money coming in through ETFs, he said. Most institutions are getting crypto through regulated, familiar wrappers and keeping clear of DeFi protocols entirely.
CertiK said the numbers show how deeply rooted the problem remains.
“September was a stark reminder of how quickly the threat landscape can shift. With both losses and incident count reaching their highest levels of 2026, the month’s data reinforces the need for security across every layer,” the firm said on X.
Insurance Coverage Is Shrinking
The safety net for crypto losses remains small, and it is getting smaller relative to the risks. CoinGecko’s State of Crypto Security Report 2026, released at the end of August, put the on-chain crypto insurance coverage capacity at $130.2 million. That is down 20.2% from $163 million last year.
CoinDesk pointed out early this year that insurers have had trouble matching risks across the board.
“September was a stark reminder of how quickly the threat landscape can shift. With both losses and incident count reaching their highest levels of 2026, the month’s data reinforces the need for security across every layer.”
AI Is Making Things Worse
The mix now carries a new danger from artificial intelligence, according to Oliver Carding, who runs marketing at Tesseract Group. His greater concern, he said, is pace.
“My longer-term concern is speed, now AI tools are automating the hunt for weaknesses in smart contracts, work that used to take a skilled engineer months. That shortens the time anyone has to fix a flaw before it is used,” Carding said in an email.
Blockaid believes several attacks on AI agents will occur, and it says prompt injection is the path most likely to be taken. That method involves secret instructions that deceive an AI agent into working against its user.
The attack vectors Blockaid names include:
- Prompt injection
- Data poisoning
- Model extraction
- Code injection
The Bull Market and Its Weak Spots
The market for bulls has returned, yet the parties who wish to profit from its frailties have followed close behind. This contradiction defines the figures for this period.
Bitcoin ETF inflows are resuming, and Citi expects slow but steady growth. The bank raised its 12-month bitcoin target to $113,000, forecasting $5 billion of inflow over the next 12 months. Advisers and brokerages favor gradual increases in bitcoin allocations, according to Citi.
The hack numbers tell a different story. The $1.26 billion lost in the third quarter is a significant amount of money, even if it pales next to the billions flowing into ETFs. But the damage to crypto’s reputation is harder to wave away.
Sondergaard’s point is that reputational harm can exceed financial losses, and it bears repeating.
What Happens Next
Matching risks has proven difficult for insurers, a challenge made worse by a widening coverage gap and incidents that continue at an increasing rate.
Sondergaard says the underlying framework is still operationally weak. The data supports that claim: there were 247 separate cases, losses of $1.26 billion, and September alone set new highs for both.
Fast-improving AI tools are spotting flaws sooner than ever, and the window for correcting them before they get exploited keeps narrowing.
For a long time, the industry has talked about security. That conversation has not turned into action at the pace required. The systems remain operationally fragile, and the harm to reputation can still exceed the losses themselves.
Stay alert.
Source material: “Crypto lost $1.26 billion in hacks while bitcoin bulls enjoyed a monster quarter,” CoinDesk.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.