Hacken says crypto audits leave suppliers and patches untested as Q3 thefts hit 1.18 billion

Audit badges are a common shorthand for safety in crypto, but a new Hacken report says they often cover far less than investors assume. For BlockWest readers weighing exchange, bridge and wallet exposure, the findings show where third-quarter losses actually originated.

• Hackers stole $1.18 billion across 107 incidents in the third quarter, up 55% from the prior quarter.
• Compromised suppliers, developer tools, uninstalled fixes and unreviewed components accounted for $906.8 million of the losses.
• Hacken says firms holding customer funds must track and install fixes promptly instead of relying on an old audit.

• $1.18B stolen across 107 incidents in Q3, 55% above previous quarter
• $906.8M lost to supplier, patch or scope failures, about 77% of the total
• $352M minimum Bitget loss in September, the quarter’s largest single incident
• $700M+ secured assets at two of 12 venues Hacken reviewed

Hackers stole $1.18 billion from crypto projects in the third quarter, 55% more than in the previous quarter, according to blockchain security firm Hacken, as CoinDesk reported. The losses spread across 107 incidents, according to the report released Thursday (October 15). Of the total, $906.8 million came from compromised suppliers or developer tools, publicly available security fixes that were never installed, or components left out of the most recent security review.

Hacken says audit badges leave wallets, signing systems and suppliers untested

Hacken said customers often assume an audit covers an entire platform when it may examine only specific smart contracts. Wallets, signing systems and third-party software can sit outside that scope.

Andrii Matiukhin, co-founder and board director at Hacken, told CoinDesk that “The problem is always scope.” He added: “It’s expensive to have enormous scopes of all components that interact with funds or influence economics, and teams cut corners, auditing only critical parts of the service.”

Usually, when a customer sees a new project, they see an audit badge, assume the whole system is covered, and lose money through a key, a supplier, or a setting that was never tested.

Andrii Matiukhin, co-founder and board director, Hacken

Matiukhin said delays in fixing known vulnerabilities were another concern, particularly when multiple blockchains relied on the same software but updated it at different times. “Sometimes a critical vulnerability is classified as low by the team, and fix implementation is delayed or even declined,” he said.

Bitget lost at least $352 million after a third-party security product was exploited

The biggest incident of the quarter was the September attack on crypto exchange Bitget, according to the report. Hackers exploited a vulnerability in a third-party security product to reach the exchange’s withdrawal infrastructure, and Bitget lost at least $352 million. That single event equals about 30% of the quarter’s total, and the CoinDesk reporting includes no response from Bitget.

Other large losses followed. Liquid Network lost $319 million, second only to Bitget among the named incidents, while Coldcard wallet software lost roughly $114 million and Tectonic at least $75 million.

Three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July, Hacken said. AFX Trade accounted for $24 million of that, more than half, after attackers gained control of its validator keys.

Just this week, Ledger said it found an unauthorized hardware “spy” implant in a device sold by CryptoBilis, a Southeast Asian reseller, with losses of about $93 million, and CryptoBilis’s position is not in the reporting.

Which two venues hold $700 million on contested key setups remains unanswered

Hacken also examined 12 derivatives exchanges and prediction markets. At two major venues, more than $700 million in secure assets depended on a four-key signing arrangement requiring three signatures, or on administrative keys whose holders were not publicly identified.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.