What to Know

  • Hackers stole $1.18 billion from crypto projects in the third quarter, according to blockchain security firm Hacken.
  • The losses came across 107 incidents and were 55% higher than in the previous quarter.
  • Hacken said $906.8 million in losses were tied to compromised suppliers or developer tools, publicly available fixes that were not installed, or components left outside the latest security review.
  • The firm warned that audit badges can create a false sense of security when investors assume an entire platform has been reviewed.
  • Areas often excluded from reviews can include wallets, signing systems and third-party software.
  • The largest incident cited was the September attack on crypto exchange Bitget, which lost at least $352 million after attackers exploited a third-party security product to access withdrawal infrastructure.
  • Ledger said it found an unauthorized hardware spy implant in a device sold by CryptoBilis, with losses of about $93 million.
  • Three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July, with AFX Trade accounting for $24 million after attackers gained control of validator keys.
  • Other incidents cited included $319 million at Liquid Network, at least $75 million at Tectonic and roughly $114 million at Coldcard wallet software.
  • Hacken also found that more than $700 million in secure assets at two major derivatives or prediction-market venues depended on signing or administrative key arrangements it considered inadequate for the scale involved.

Audit Badges Are Facing a Harder Test

Crypto security audits have long been used by projects as a signal of credibility, but the latest findings from Hacken show that a badge on a website may tell investors far less than they think. The firm said attackers stole $1.18 billion from crypto projects in the third quarter, spread across 107 incidents and representing a 55% increase from the previous quarter. The figures underline a difficult reality for digital-asset markets: many of the most damaging breaches are not caused by flaws in the narrow piece of code that was reviewed, but by weaknesses in the wider operational environment surrounding customer funds.

Hacken’s central concern is audit scope. A review may focus on selected smart contracts or a defined technical component while leaving wallets, signing infrastructure, developer tooling, administrative controls, suppliers and third-party software outside the reviewed perimeter. For investors, that distinction is often invisible. A platform may market itself as audited, but the audit may not cover the systems that ultimately control withdrawals, custody processes or emergency administration.

The result is a growing mismatch between market perception and operational risk. Many investors interpret an audit badge as a broad statement that a project is safe. Hacken’s findings suggest that such confidence can be misplaced when attackers are increasingly targeting the parts of the technology stack that remain unaudited, poorly monitored or slow to receive known fixes.

The Biggest Losses Came From the Edges of the Stack

Hacken said about $900 million in third-quarter losses came from compromised suppliers or developer tools, delayed fixes or systems outside recent security reviews. More specifically, the firm identified $906.8 million in losses tied to compromised suppliers or developer tools, publicly available security fixes that had not been installed, or components excluded from the most recent security review. That finding is significant because it points away from the simplified idea that smart-contract audits alone are enough to protect crypto users.

Crypto platforms often rely on a web of external services, internal tools, validators, signing processes, deployment systems and custody arrangements. Each one can become a path to funds if it is connected to critical permissions or operational workflows. Attackers do not need to defeat a fully audited smart contract if they can compromise a supplier, access a development environment, capture a signing key or exploit a product that sits between users and withdrawals.

That is why market participants are paying closer attention to operational security, not just code security. A project may have clean smart contracts but still face severe exposure if privileged keys are poorly protected, patch management is inconsistent or third-party software is trusted without sufficient controls. Hacken’s findings reinforce the view that investors and institutions should ask not only whether a project has been audited, but what was audited, when it was audited and what was explicitly excluded.

Bitget Attack Highlights Third-Party Infrastructure Risk

The largest incident cited in the quarter was the September attack on crypto exchange Bitget. Hacken said Bitget lost at least $352 million after hackers exploited a vulnerability in a third-party security product to gain access to its withdrawal infrastructure. The case illustrates the type of risk that can fall outside the public meaning of an audit badge. Even if a platform’s core code is reviewed, the infrastructure that authorizes, routes or protects withdrawals can remain a high-value target.

Withdrawal infrastructure is among the most sensitive parts of any crypto platform because it is directly connected to the movement of assets. If attackers gain access to that layer, they may not need to manipulate markets or deceive users; they can attempt to move funds through privileged systems. For exchanges, the incident underscores how vendor risk can become custody risk when external products are integrated into critical workflows.

For investors, the lesson is direct. Security assurances must be evaluated across the entire chain of custody and control. A strong exchange security posture depends on more than a single code review. It requires supplier due diligence, layered access controls, key management, incident response planning, rapid patching and clear accountability over every system that can affect withdrawals or balances.

Hardware, Bridges and Cross-Chain Systems Add More Pressure

The risks identified by Hacken were not limited to centralized venues. Ledger said it found an unauthorized hardware spy implant in a device sold by CryptoBilis, a Southeast Asian reseller, resulting in losses of about $93 million. Hardware wallet risks are particularly sensitive because such devices are often marketed as a safer alternative to online custody. The incident shows that supply-chain exposure can extend into the physical distribution of security products, not only software dependencies.

Cross-chain infrastructure also remained a major pressure point. Hacken said three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July. AFX Trade accounted for $24 million of that after attackers gained control of its validator keys. Bridges and cross-chain systems are frequent targets because they sit between networks and often manage complex validation, messaging and asset-locking processes. When validator keys are compromised, attackers may be able to influence the mechanics that determine whether transfers are accepted as legitimate.

Other incidents cited by Hacken included $319 million at Liquid Network, at least $75 million at Tectonic and roughly $114 million at Coldcard wallet software. The range of affected entities highlights how crypto security risk is distributed across exchanges, wallets, cross-chain protocols and software systems. It also shows that the industry’s threat model must account for operational dependencies as much as on-chain code.

Signing Keys Remain a Central Weakness

Hacken also examined 12 derivatives exchanges and prediction markets and found that more than $700 million in secure assets at two major venues depended on either a four-key signing arrangement requiring three signatures or administrative keys whose holders were not publicly identified. The firm said it had not found evidence of an active vulnerability, but viewed some of the arrangements as inadequate given the amounts involved.

Signing arrangements are critical because they determine who can authorize transactions, upgrades or administrative actions. A multisignature structure can improve security when keys are independently controlled, properly protected and transparently governed. But the mere existence of multiple keys does not guarantee resilience. If keyholders are not clearly identified, if keys are stored in related environments, or if procedures are weak, attackers may still find a practical route to control.

Administrative keys can also create concentrated risk. In many crypto systems, admin permissions may allow upgrades, pauses, configuration changes or other actions that influence user funds and market behavior. When the holders of those keys are not publicly identified, investors may struggle to assess governance risk. Hacken’s findings suggest that transparency around who controls critical permissions remains an important part of security evaluation.

Delayed Fixes Can Turn Known Bugs Into Major Incidents

Another concern highlighted by Hacken is the delay in fixing known vulnerabilities. The firm pointed to situations where multiple blockchains rely on the same software but update at different times. In that environment, a known issue may be patched in one place while remaining exploitable elsewhere. Once a fix becomes public, attackers may be able to study the weakness and target systems that have not yet applied the update.

Patch management is often less visible than an audit badge, but it can be just as important. A review completed months or years earlier cannot protect users if new vulnerabilities emerge and teams fail to install fixes promptly. Hacken said responsibility ultimately rests with companies holding customer funds. Those companies must track vulnerabilities, prioritize critical updates and avoid relying on old audits as a substitute for continuous security operations.

For crypto projects, the message is that security is a process, not a one-time certificate. Continuous monitoring, updated threat modeling, supplier checks and transparent disclosure practices are increasingly necessary for platforms that handle meaningful asset flows. For investors, the takeaway is to treat audit claims as a starting point rather than a final verdict.

Investor Due Diligence Is Becoming More Demanding

The latest quarter’s losses may sharpen investor scrutiny of crypto security claims. An audit badge can still be useful, but only if investors understand its limits. Market participants are likely to ask more detailed questions about audit scope, excluded components, key management, supplier exposure, incident history and patching discipline. Projects that provide clearer answers may gain an advantage as users become more cautious about where they deposit or transact.

Security firms, exchanges and protocol teams are also under pressure to communicate more precisely. If an audit covers only selected smart contracts, that should be clear. If wallets, signing systems or third-party tools are excluded, that limitation should be visible to users. Greater transparency would not eliminate hacks, but it could reduce the false confidence that Hacken warned about and encourage more realistic risk assessment.

For the broader crypto market, the third-quarter figures are another reminder that technical sophistication cuts both ways. Digital-asset infrastructure can move value quickly and globally, but the same speed can magnify damage when privileged systems are compromised. As hackers focus on suppliers, keys and operational gaps, security standards will need to move beyond narrow code reviews toward full-system resilience.

Frequently Asked Questions (FAQs)

How much did crypto hackers steal in the third quarter?

Hacken said hackers stole $1.18 billion from crypto projects in the third quarter across 107 incidents.

How much did crypto hacking losses increase from the previous quarter?

The third-quarter total was 55% higher than in the previous quarter, according to Hacken.

Why does Hacken say audit badges can be misleading?

Hacken warned that audit badges can create a false sense of security because users may assume an entire platform was reviewed when the audit may cover only selected components.

What systems are often left outside crypto security reviews?

Hacken said reviews can exclude wallets, signing systems and third-party software, even though attackers often target those areas.

What caused most of the losses identified by Hacken?

Hacken tied $906.8 million in losses to compromised suppliers or developer tools, publicly available fixes that were not installed, or components excluded from the latest security review.

What was the largest incident cited for the quarter?

The largest incident cited was the September attack on Bitget, which lost at least $352 million after hackers exploited a vulnerability in a third-party security product to access withdrawal infrastructure.

Why are signing keys important in crypto security?

Signing keys can authorize transactions, withdrawals, upgrades or administrative actions, making them high-value targets when they are poorly protected or insufficiently transparent.

Did Hacken find an active vulnerability at the reviewed derivatives or prediction-market venues?

Hacken said it had found no evidence of an active vulnerability, but considered some key arrangements inadequate given the amount of assets involved.

What should investors ask when a crypto project says it is audited?

Investors should ask what was included in the audit, what was excluded, when the review was completed, how keys are managed, whether suppliers are assessed and how quickly the project installs security fixes.