Hacken says crypto hacks cost $1.18 billion in Q3 as audits miss key systems
In brief
- Hacken counted $1.18 billion stolen across 107 incidents in Q3, up 55% quarter over quarter.
- $906.8 million of losses came from compromised suppliers, uninstalled fixes or components outside recent audits.
- Bitget's September breach, at least $352 million, was Q3's largest incident, per Hacken.
- Two unnamed venues hold over $700 million under signing setups Hacken considers inadequate.
Where the money went
By the numbers in Hacken's third-quarter report, more than three-quarters of the quarter's losses fell into that category. Hacken said customers often assume an audit covers a whole platform when it may examine only specific smart contracts (leaving wallets, signing systems and third-party software outside its scope).
The biggest incident was the September attack on Bitget. According to Hacken, the exchange lost at least $352 million after hackers exploited a vulnerability in a third-party security product to reach its withdrawal infrastructure.
Other attacks took $319 million from Liquid Network, at least $75 million from Tectonic and roughly $114 million from Coldcard wallet software, the report said. In July, three bridges and cross-chain protocols lost more than $35 million during a six-hour exploit; AFX Trade accounted for $24 million of that after attackers gained control of its validator keys.
Separately, hardware wallet maker Ledger said it found an unauthorized hardware "spy" implant in a device sold by CryptoBilis, a Southeast Asian reseller. Losses came to about $93 million, according to Ledger's statement as reported by CoinDesk.
The scope problem
Andrii Matiukhin, Hacken's co-founder and board director, said in an interview with CoinDesk that it's expensive to audit every component that interacts with funds. So teams cut corners and audit only the critical parts of a service.
“Usually, when a customer sees a new project, they see an audit badge, assume the whole system is covered, and lose money through a key, a supplier, or a setting that was never tested,” Matiukhin said.
He also flagged delays in fixing known vulnerabilities. That's a bigger worry when multiple blockchains rely on the same software but update it at different times.
Hacken said responsibility ultimately rests with the companies holding customer funds, which must track vulnerabilities and install fixes promptly instead of relying on older audits.
$700 million under thin controls
Hacken also looked at 12 derivatives exchanges and prediction markets. It found that more than $700 million in assets at two major venues relied on a three-of-four signing arrangement or on administrative keys whose holders weren't publicly identified.
Matiukhin wouldn't name the venues or give a detailed assessment before publication. He said Hacken found no evidence of an active vulnerability, but considered some of the arrangements inadequate given the amounts involved.
Frequently asked questions
Why didn't security audits stop the third-quarter crypto hacks?
Hacken said customers often assume an audit covers an entire platform when it may examine only specific smart contracts. Wallets, signing systems and third-party software can fall outside its scope. The firm said $906.8 million of Q3 losses came from compromised suppliers or developer tools, fixes that weren't installed, or components left out of the latest review.
What was the largest crypto hack of the third quarter?
According to Hacken's report, the largest incident was the September attack on exchange Bitget. It lost at least $352 million after hackers exploited a vulnerability in a third-party security product to reach its withdrawal infrastructure.
Who does Hacken say is responsible for preventing these losses?
Hacken said responsibility rests with the companies holding customer funds. Those companies must track vulnerabilities and install fixes promptly instead of relying on older audits.
