Two security firms measured the same three months of crypto theft and landed $80 million apart on the dollar total, but 140 incidents apart on the count. That second gap is the detail most coverage skipped, and it changes how a risk officer, an exchange or a regulator should read the headline numbers ahead of Web3 Week Asia, the crypto and blockchain event in Jakarta on 11-12 November 2026.

Hacken put Q3 2026 losses at $1.18 billion across 107 incidents. CertiK put them at $1.26 billion across 247. Both agree on the direction: losses were roughly 54-55% above Q2. They disagree on how many separate events made up the quarter, and therefore on whether the problem is a few giant failures or a constant drizzle of small ones.

Hacken, Q3 2026. $1.18 billion across 107 incidents, up 55% from Q2, as reported by CoinDesk on 18 October 2026.

CertiK, Q3 2026. $1.26 billion across 247 incidents, up from $819.4 million in Q2, as reported by Cointelegraph on 1 October 2026.

Largest case. Bitget, reported at $351.6 million on 24 September 2026 and updated by Bitget to $387.5 million the next day.

Hacken's cause finding. $906.8 million, about 77% of its total, came from compromised suppliers or developer tools, fixes that were available but not installed, or components outside the latest security review.

Countdown. Web3 Week Asia is 21 days away as of 21 October 2026.

Same quarter, three trackers, three answers

The dollar totals sit close together: $1.18 billion against $1.26 billion is a gap of about $80 million, or roughly 7% of Hacken's figure. The incident counts do not. CertiK's 247 is about 2.3 times Hacken's 107, which makes the average incident about $11 million in Hacken's data and about $5 million in CertiK's.

A third tracker widens the picture. According to a ChangeNOW compilation, CD Security counted about $1.24 billion across 146 incidents, and CertiK's own figures through 13 October 2026 stood at about $1.28 billion across 260 incidents. Both come from a single compilation, so treat them as indicative; they do show that even one firm's count moves as data is added.

Why it matters: an incident count depends on inclusion rules, such as minimum size, whether a protocol exploit and an exchange breach count equally, and when a loss is dated. Without published criteria, a rise or fall in "number of hacks" says little. The dollar total is the more stable measure, and even it is a range.

The Bitget lesson: the headline number moved

Bitget is the clearest example. CoinDesk reported $351.6 million exposed on 24 September 2026, and Hacken's report uses "at least $352 million". On 25 September, Bitget updated the figure to about $387.5 million, which it attributed to more complete transaction classification rather than a new attack. That is a $35.9 million increase, about 10% on the first estimate.

CertiK's Q3 data uses the higher figure and says Bitget alone was about 31% of the quarter's losses. On Hacken's lower figure the share would be about 30% of its total, which is my own arithmetic.

Concentration and the audit gap

CertiK's four largest Q3 incidents were Bitget ($387.5 million), Liquid Network ($319 million on 6 September 2026), Tectonic ($120 million) and a Coldcard theft ($112.7 million). Together they add up to $939.2 million, about 75% of CertiK's $1.26 billion. A quarter that looks busy by incident count is, in dollars, dominated by four events.

Trackers also diverge on single items. Liquid Network is $319 million in both lists and Coldcard is roughly $114 million versus $112.7 million, but Tectonic is "at least $75 million" at Hacken and $120 million at CertiK, a 60% difference on one case.

Hacken's central argument is about scope. Its co-founder Andrii Matiukhin told CoinDesk that customers see an audit badge and assume the whole system is covered, when an audit may cover only specific smart contracts while wallets, signing systems and third-party software sit outside it.

The honest counterweight: what the data does not show

Not a verdict on any one firm. Hacken's 77% figure is Hacken's own grouping of causes. CertiK's published Q3 coverage breaks down only September by attack type, so the two cause analyses cannot be compared directly.

Not a count of customer losses. These totals measure funds moved by attackers. They are not net losses to users. CertiK reported about $273 million frozen or returned in September 2026, about 36% of its September gross loss of roughly $769 million. Bitget stated that its user protection fund, reported at more than $464 million, would cover its loss.

Not proof that Indonesian users were hit. None of the sources reviewed for this article reports Indonesian users or an Indonesian regulator action in connection with these incidents. Hacken and CertiK are global datasets, and no study establishes how much of the Q3 total touched Southeast Asian customers.

Indonesia crypto: why the counting problem matters locally

Indonesia is a large retail market. OJK data reported by Antara on 5 October 2026 showed 23.21 million consumer accounts at licensed digital-asset traders in August 2026 and Rp23.16 trillion in crypto transaction value for that month. Separately, Kontan reported on 5 October 2026 that OJK counted 28 licensed digital financial asset traders through September 2026.

The relevance is custody and vendor risk. According to Antara's report of the same briefing, OJK expects its rules on digital asset custody, rupiah stablecoins, tokenised real assets and crypto fund management to be completed this year or early next year. If Hacken's finding holds that most Q3 losses came through suppliers, tools and unpatched fixes, then a custody rule that only checks the exchange's own code would miss the dominant path. Whether the rules will address third-party dependencies is not stated in the sources reviewed.

Web3 Week Asia 2026: blockchain event in Jakarta, 11-12 November

Web3 Week Asia takes place on 11-12 November 2026 in Jakarta, Indonesia. According to the official site as of 2 October 2026, the programme is organised into four tracks: Investor Meetups, Alpha Callers, Web3 Entrepreneur and Indonesia Crypto Outlook 2026. The 2026 speaker line-up was described as "to be announced soon" at that date.

For this topic, the useful question for any session on infrastructure or custody is concrete: which components touch customer funds, who audits them, and how quickly are third-party fixes applied. The Q3 tallies suggest those questions matter more than an audit badge or a single headline number.

The 2025 edition drew more than 5,000 participants, over 100 speakers and more than 200 companies from more than 10 countries, according to the organisers.

Frequently asked questions

When and where is Web3 Week Asia 2026?

Web3 Week Asia 2026 takes place on 11-12 November 2026 in Jakarta, Indonesia. It is a two-day crypto and blockchain event covering markets, regulation, infrastructure and venture investment across Southeast Asia.

How much did crypto hacks cost in Q3 2026?

It depends on the tracker. Hacken reported $1.18 billion across 107 incidents, and CertiK reported $1.26 billion across 247 incidents. The two totals are about $80 million apart, and both show losses up roughly 54-55% from Q2 2026.

Why do Hacken and CertiK report different incident counts?

The sources reviewed do not publish full counting criteria. Differences in minimum loss size, how protocol exploits and exchange breaches are classified, and how losses are dated can all change a count, but which of these explains the 107 versus 247 gap is not established.

How much was lost in the Bitget breach?

Bitget first reported about $351.6 million on 24 September 2026 and updated the figure to about $387.5 million on 25 September 2026, citing more complete transaction classification. Hacken's report uses at least $352 million.

Does a security audit mean a crypto platform is safe?

No. Hacken says an audit may cover only specific smart contracts, while wallets, signing systems and third-party software are often outside scope. An audit badge shows what was reviewed at a point in time, not that the whole system is covered.

Sources

CoinDesk, Hacken Q3 2026 report coverage: https://www.coindesk.com/tech/2026/10/18/crypto-audits-give-investors-false-sense-of-security-as-q3-hacks-cost-usd1-18-billion-hacken-says

Cointelegraph, CertiK Q3 2026 losses: https://cointelegraph.com/news/bitget-hack-q3-industry-losses-1-26-billion

Hacken totals ($1.18 billion, 107 incidents, +55%) are from CoinDesk (18 October 2026) and a republished Altcoin Buzz report (16 October 2026). CertiK totals ($1.26 billion, 247 incidents, Q2 $819.4 million) and the top-four incident list are from Cointelegraph (1 October 2026). The CD Security figures and CertiK's later $1.28 billion are from a ChangeNOW compilation with data to 13 October 2026. Bitget's $351.6 million is from CoinDesk (24 September 2026) and the $387.5 million update from Blockchainmedia (26 September 2026) and Cointelegraph. OJK account and transaction figures are from Antara (5 October 2026); the licensed-trader count is from Kontan (5 October 2026). Event details are from the organisers as of 2 October 2026.

Methodology: Percentage gaps, averages and shares were computed from the published figures: $80 million divided by $1.18 billion is about 6.8%; 247 divided by 107 is about 2.3; $1.18 billion divided by 107 is about $11.0 million and $1.26 billion divided by 247 is about $5.1 million; $387.5 million minus $351.6 million is $35.9 million, about 10.2%; the four largest CertiK incidents sum to $939.2 million, 74.5% of $1.26 billion; $906.8 million divided by $1.18 billion is 76.8%. Totals from different trackers were never added together. Hacken's coverage also lists one further incident reported in October; because its quarter window and inclusion in the total are not stated, it is excluded from every comparison here. Figures from a single compilation are attributed in the text, and CertiK's $1.26 billion and $1.28 billion are shown separately because they reflect different data dates.

This article is for information only and is not investment advice