CoinDesk
Hackers stole $1.18 billion from crypto projects across 107 incidents in the third quarter, a 55% increase from the previous quarter, according to blockchain security firm Hacken. About $906.8 million of the losses involved compromised suppliers or developer tools, uninstalled security fixes, or components excluded from the latest security reviews. Hacken said 77% of Q3 losses fell into those categories.
Why it matters
The findings challenge the protection investors associate with an audit badge. Reviews often cover selected smart contracts while leaving wallets, signing systems and third-party software outside the scope. Hacken co-founder Andrii Matiukhin said teams often limit audits because reviewing every component that interacts with funds or affects protocol economics is expensive.
That creates a dangerous gap between technical certification and operational security. A project can pass an audit while attackers exploit a supplier, an administrative key or a known vulnerability that was not patched. Hacken said responsibility remains with companies holding customer funds, which must track vulnerabilities and apply fixes rather than rely on an audit completed months or years earlier.
Market impact
The quarter's largest incident was a September attack on Bitget, where hackers exploited a vulnerability in a third-party security product and stole at least $352 million through the exchange's withdrawal infrastructure. Ledger also reported an unauthorized hardware spy implant in a device sold by a Southeast Asian reseller, causing about $93 million in losses.
Hacken found that three bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July. It also said more than $700 million in assets at two derivatives exchanges and prediction markets depended on concentrated signing or unidentified administrative keys. No active vulnerability was identified at those venues, but Hacken called the arrangements inadequate for the value secured.
Frequently asked questions
-
How much did crypto hacks cost in the third quarter?
Hackers stole $1.18 billion across 107 incidents in Q3, 55% more than in the previous quarter, according to Hacken.
-
Why did Hacken criticize crypto audit badges?
Hacken said audits often examine selected smart contracts but exclude wallets, signing systems and third-party software that attackers can target.
-
What share of Q3 losses involved systems outside audit coverage?
Hacken said 77% of Q3 losses involved compromised suppliers or developer tools, delayed security fixes, or components excluded from recent reviews.
-
How much did Bitget lose in the reported attack?
Bitget lost at least $352 million after hackers exploited a vulnerability in a third-party security product to access its withdrawal infrastructure.
-
What security concerns did Hacken find at derivatives venues?
More than $700 million in assets at two derivatives exchanges and prediction markets depended on concentrated signing arrangements or unidentified administrative keys. Hacken found no active vulnerability but called the setups inadequate for the amounts involved.
CryptoSlate
WuBlockchain