CryptoSlate
Hacken recorded $1.18 billion in crypto theft across 107 incidents in the third quarter, up 55% from $763.9 million across 67 incidents in Q2. Smart-contract losses accounted for 48% of the Q3 total, compared with about 11% in Hacken's original Q2 summary. At the same time, the losses implied by access-control and operational categories fell about 30%.
Why it matters
The figures challenge a security hierarchy that treats custody operations as the overriding risk. Applying Q2's 88.3% operational-loss share to $763.9 million implies roughly $675 million, while Q3's 40% share applied to $1.18 billion implies about $472 million. The comparison is constrained by rounded figures and category changes, but it points to a heavier contract-loss mix in Q3.
Incident frequency also changed the picture. The average recorded loss fell slightly from roughly $11.4 million in Q2 to about $11 million in Q3, while the number of incidents rose from 67 to 107. A lower average severity can therefore coexist with a much larger aggregate loss.
Market impact
The Bitget and Liquid incidents show why defenses must cover more than private keys. Bitget said compromised third-party security products enabled high-privilege credentials to inject forged withdrawal commands, while its cold wallets and private keys were not compromised. Its estimated affected amount increased from about $351.6 million to approximately $388 million as the accounting expanded.
Liquid's incident involved roughly 4,000 unbacked LBTC passing a validation defect before SideSwap automatically processed the peg-out into BTC. Blockstream recorded 3,400 BTC returned and about 602 BTC outstanding at its report date. The common lesson is operational: independent limits, pauses, wallet-history checks, and manual review can interrupt a transfer after an earlier validation or authorization control fails.
Frequently asked questions
-
How much did crypto theft increase in Hacken's third quarter?
Hacken recorded $1.18 billion across 107 incidents in Q3, a 55% increase from $763.9 million across 67 incidents in Q2.
-
What changed in the mix of crypto losses between Q2 and Q3?
Smart-contract losses represented 48% of Q3 losses, compared with about 11% in Hacken's original Q2 summary. Access-control and operational losses implied by the published shares fell about 30%.
-
How did Bitget's incident happen without a private-key compromise?
Bitget said compromised third-party security products exposed high-privilege credentials that attackers used to inject forged withdrawal commands. The exchange said private keys were not compromised and cold wallets were unaffected.
-
What caused the Liquid and SideSwap loss?
A validation defect allowed roughly 4,000 unbacked LBTC to pass, after which SideSwap automatically processed the peg-out into BTC. The authorization key was not stolen or forged.
-
What security controls could interrupt similar withdrawals?
Independent limits, pauses, wallet-history checks and manual review could add checkpoints after asset validation or authorization. These controls can interrupt a transfer when an earlier safeguard fails.
WuBlockchain
TheBlock
CoinDesk
Lookonchain