Community Trust ScoreVerified
Hackers took $1.18 billion across 107 incidents in the third quarter. That’s a 55% jump from the prior quarter, and the bulk of it — $906.8 million — came from corners of crypto infrastructure that audits typically don’t touch.
Why It Matters
Why it matters: The report underscores a growing gap between perceived and actual security in crypto, where an audit can create a false sense of coverage even as major exposure remains in unreviewed infrastructure. For investors, users, and counterparties, that means due diligence needs to go beyond a single certification and focus on how broadly a platform’s security controls are tested and maintained.
Hacken, the blockchain security firm behind the report, said the number isn’t just big. It’s a signal that the industry’s audit culture has a serious blind spot. Platforms get reviewed, earn a badge, and customers assume the whole operation got checked. But audits usually cover selected smart contracts. Wallets, signing systems, administrative keys, third-party software — often none of that makes it into scope. And that’s exactly where attackers keep finding their way in. Hacken’s $906.8 million figure tied directly to those gaps: compromised suppliers or developer tools, security fixes that existed but weren’t installed, and components that the most recent review simply didn’t include.
The scope problem isn’t new. It just keeps getting more expensive.
“The problem is always scope,” said Andrii Matiukhin, Hacken’s co-founder and board director. He said comprehensive reviews covering every component connected to funds or project economics can be expensive, so teams tend to limit audits to what they consider the critical parts of a service. That logic is understandable. But it leaves real money exposed.
Bitget, Ledger Reseller Among Biggest Hits
The single largest incident Hacken tracked was the September attack on crypto exchange Bitget. Hackers exploited a vulnerability in a third-party security product and got into the withdrawal infrastructure. Bitget lost at least $352 million. No smart contract flaw. The damage came from the systems wrapped around the contracts — the external tools and infrastructure that audits rarely examine.
A separate case drove home the supplier risk angle. Ledger said it found an unauthorized hardware “spy” implant in a device sold by CryptoBilis, a Southeast Asian reseller. Losses from that incident came to roughly $93 million. The implant wasn’t in Ledger’s own hardware. It was in the supply chain — which is pretty much the definition of a scope problem.
Bridges and cross-chain protocols took hits too. Three of them lost more than $35 million during a six-hour exploit in July. AFX Trade dropped $24 million after attackers seized control of its validator keys. Liquid Network saw $319 million in losses. Tectonic lost at least $75 million. Coldcard wallet software took roughly $114 million. Different systems, different attack surfaces — but a common thread runs through them: access controls and supporting infrastructure, not the specific contract code that auditors reviewed.
$700 Million Sitting on Questionable Key Setups
Hacken also looked at 12 derivatives exchanges and prediction markets. What it found at two of them wasn’t a live exploit. It was a design problem. More than $700 million in customer assets at those two venues relied either on a four-key arrangement needing three signatures, or on administrative keys held by people whose identities weren’t publicly disclosed.
Matiukhin was careful about the distinction. “We are not aware of a live bug in the systems of any reviewed venue,” he said. The concern wasn’t that someone had already broken in. It was that the key arrangements weren’t secure enough given the scale of assets involved. Big difference — but not necessarily a comforting one.
Hacken didn’t name the two venues. Matiukhin said he didn’t provide a detailed assessment to them before the report went out.
Unpatched Fixes and the Ongoing Tracking Problem
Beyond scope gaps, Hacken flagged patch delays as a separate risk category. It’s one thing to know a vulnerability exists. It’s another to actually fix it — especially when multiple blockchains share the same software but update on different schedules. Some chains get the patch fast. Others sit exposed for weeks or months longer.
Matiukhin said teams sometimes classify a critical vulnerability as low priority and slow-walk the fix, or skip it entirely. An audit done a year ago can’t account for what’s been discovered since. Hacken’s position is that ongoing vulnerability tracking and timely patching aren’t optional extras — they’re basic obligations for any business holding customer funds.
For investors, the audit label probably tells less than it seems to. It might cover three smart contracts and nothing else. Wallets, signing infrastructure, admin keys, supplier software — all of that can sit outside the review and outside the badge.
Matiukhin declined to name the two venues holding more than $700 million under the arrangements Hacken flagged.
Frequently Asked Questions
How much did hackers steal in Q3 according to Hacken’s report?
Hacken counted $1.18 billion in losses across 107 incidents, up 55% from the previous quarter.
What does the $906.8 million figure specifically represent?
Hacken attributed $906.8 million to losses tied to compromised suppliers or developer tools, uninstalled security fixes, or components that fell outside the scope of the most recent security review.
Which single incident caused the largest loss in Q3?
The September attack on Bitget was the largest, with the exchange losing at least $352 million after hackers exploited a vulnerability in a third-party security product to access its withdrawal infrastructure.
