Crypto ETFs drew billions in Q3 while hacks took $1.26 billion

Bitcoin closed the third quarter up 40%, ahead of every major asset even as Treasury yields climbed to their highest in more than two decades, while exchange-traded funds holding BTC and other tokens pulled in billions of dollars and several altcoins rallied harder still. The same three months cost the industry $1.26 billion across 247 security incidents, according to CertiK figures cited by CoinDesk's Daybook newsletter.

September carried most of that: 99 incidents, the most in any month since February 2025, and $768.5 million lost, the largest monthly haul of 2026. CertiK said the month's figures reached the highest levels of the year on both counts and called for security at every layer, while losses so far in 2026 stand at $2.68 billion.

The insurance behind it keeps shrinking relative to the risk. CoinGecko's State of Crypto Security Report 2026, published at the end of August, put on-chain crypto insurance capacity at $130.2 million, down 20.2% from $163 million a year earlier and less than a fifth of what September alone cost. The newsletter notes the insurance sector has struggled to match the risks since early this year.

None of that has landed on the wrappers. An analyst named Sondergaard, whose firm the newsletter does not name, makes the case that the losses barely register against the capital arriving through ETFs, because most institutions buy crypto through regulated, familiar vehicles and stay clear of DeFi protocols altogether.

The listed shelf sells exactly that separation: exposure to the asset without holding the smart-contract layer underneath, which is why a quarter of record-setting fund flows and a quarter of record-setting exploits can describe the same three months. CoinDesk frames the dollar amounts as minor next to the ETF money while the reputational damage is harder to dismiss, and that tension sits with issuers whose fee revenue tracks prices and flows rather than the industry's security record.

A new surface is opening: security firm Blockaid expects multiple incidents involving AI agents, with prompt injection — hidden instructions that turn an agent against its user — the likeliest route in.

Flows through the funds have not run one way, either. In September this publication reported spot bitcoin ETFs' largest daily inflow in eleven months, after a Senate cloture loss and a Fed rate rise, with BlackRock, Ark and Fidelity taking nine-tenths of it; earlier that month three sessions of ether ETF redemptions pulled $400 million out while ether rose.

That shrinking coverage capacity and whether AI-agent exploits begin appearing in CertiK's incident count are the fourth quarter's open questions.