Bitcoin just posted a 40% quarter. Over the same three months, attackers walked off with $1.26 billion in crypto.
Those two numbers tell you most of what you need to know about the industry heading into the fourth quarter. The money is coming in. So are the thieves.
September was the worst month of 2026
Crypto security firm CertiK tracked 247 security incidents in the third quarter, with losses totaling $1.26 billion. That brings losses for the year so far to $2.68 billion.
September did most of the damage. CertiK counted 99 incidents that month, the most since February 2025, and $768.5 million stolen. That’s the largest monthly haul of 2026.
The firm didn’t soften it. “September was a stark reminder of how quickly the threat landscape can shift. With both losses and incident count reaching their highest levels of 2026, the month’s data reinforces the need for security across every layer,” CertiK said on X.
CertiK said the numbers show how deeply rooted the problem remains. Looking at a single month that accounted for more than half the quarter’s losses, it’s hard to disagree.
The rally drowned out the alarm bells
None of this slowed bitcoin down. BTC, recently priced at $86,405.47, closed the third quarter up 40% and outran every major asset, even as Treasury yields climbed to their highest in more than two decades.
Investors poured billions of dollars into exchange-traded funds tied to BTC and other tokens. Several altcoins rallied even harder. Analysts are now convinced a new bull run has arrived.
Next to those ETF billions, $1.26 billion in hack losses looks small. Sondergaard said that for now the losses barely register against the capital arriving through ETFs, and that most institutions are buying crypto through regulated, familiar wrappers while staying away from DeFi protocols altogether.
That’s the comforting read. The uncomfortable one is that the damage to crypto’s reputation doesn’t net out against inflows, and it’s a lot harder to wave away than a line item.
Insurance is shrinking while the risk grows
If you’re hoping insurance picks up the slack, don’t. CoinGecko’s State of Crypto Security Report 2026, released at the end of August, put on-chain crypto insurance coverage capacity at $130.2 million. That’s down 20.2% from $163 million last year.
Set that against the source numbers and the gap is stark: $130.2 million in coverage versus $768.5 million stolen in September alone. The safety net remains relatively small and is shrinking relative to the risks, and the insurance sector overall has struggled to keep pace.
AI agents are the next attack surface
A new problem is stacking on top of the old ones. Security firm Blockaid expects multiple incidents involving AI agents, with prompt injection the most likely route.
If the term is new to you, prompt injection is when hidden instructions trick an AI agent into acting against its user. Anyone letting software act on their behalf with crypto should treat that as a live risk.
Ether’s run against bitcoin has stalled
The charts have their own warning. The Binance-listed ether-bitcoin (ETH/BTC) ratio climbed steeply through July and August, and now that uptrend has stalled.
Repeated failures to sustain momentum above 0.033, followed by sideways churn, have broken the bullish trendline.
That shift puts the Ichimoku cloud in focus. A decisive break below the cloud would confirm a bearish trend reversal, pointing to a renewed downtrend for ether against bitcoin.
Where your money sits matters
The bull market may be back. But so are the people trying to cash in on its weak spots.
If you own crypto through a regulated ETF, you’re doing what Sondergaard said most institutions do, and these exploits mostly hit someone else. If you’re out in DeFi, keep this in mind: the whole on-chain insurance market covers $130.2 million, and September’s thieves took almost six times that.
