DefiLlama's exploit tracker recorded 277 hacking incidents in 2026 through late September, with cumulative losses of roughly $1.84 billion — nearly double the 148 incidents logged across all of 2025, according to the analytics platform's on-chain data.

The figures mark a sharp shift in the shape of crypto security failures. Attack frequency has climbed steeply even as the total dollar damage trails 2025's record haul of approximately $2.715 billion. An early-September snapshot showed 250 incidents and about $1.4 billion drained; by the end of the month, both numbers had risen again.

The third quarter did most of the damage. Q3 2026 became the worst quarter of the year so far, with more than $1.25 billion lost across 116 separate incidents. More than 100 incidents were logged in the first half of 2026 alone.

Two events dominate Q3

Two September breaches account for a large share of the quarter's losses. On September 6, Liquid Network lost $320 million due to a flaw in how the protocol verified its peg — the mechanism that confirms assets are properly backed failed to function as designed.

On September 24, centralized exchange Bitget took a $387 million hit, the largest single incident of 2026. Bitget is not a DeFi protocol, which underscores that DefiLlama's tracker now spans custodial platforms as well as smart contract ecosystems.

Earlier in the year, major exploits hit Kelp DAO and Drift Protocol, setting the tone well before the Q3 spike arrived.

More attacks, smaller bites

The distribution of losses appears to be fragmenting. Median loss sizes seem to be shrinking even as the incident count climbs, suggesting attackers are hitting a broader set of targets with lower individual payouts.

The composition of attacks is also changing. Traditional smart contract bugs persist, but a growing share of recent incidents stem from operational mistakes, social engineering, and failure points in the interactions between different protocol components.

DefiLlama's historical records put cumulative losses at more than $21 billion across over 1,200 incidents since around 2020.

Operational consequences

For protocols, the data carries a clear operational message: security is becoming a competitive differentiator, and the shift toward operational and social engineering attacks means audits alone no longer suffice. Key management, employee training, internal access controls, and monitoring of cross-chain components now demand equal attention.

The immediate variables to watch are whether Q4 sustains Q3's pace and whether 2026's total losses approach or surpass 2025's figure. The incident count has already blown past last year's with a quarter of the calendar remaining.

How the affected platforms respond matters as much as the breaches themselves. Recovery efforts, reimbursement plans, and post-mortem disclosures from Bitget and Liquid Network will signal how seriously the industry treats accountability.