Crypto Audits Create False Sense of Security as Q3 Hacks Hit $1.18 Billion

Hackers stole $1.18 billion from crypto projects across 107 incidents in the third quarter, a 55% jump from the previous quarter, according to Hacken. Of that total, $906.8 million was lost through compromised suppliers or developer tools, security fixes that were available but never installed, or components left out of the latest security review. Hacken says investors may be putting too much faith in audits that miss the systems attackers actually go after.

Why Crypto Security Audits Fall Short

Andrii Matiukhin, co-founder and board director at Hacken, said the problem is always scope. Full audits are expensive, so teams often check only the critical parts of a service. Customers see an audit badge, assume the whole platform is covered, and lose money through a key, a supplier or a setting that was never tested. Wallets, signing systems and third-party software often sit outside the audit.

Biggest Hacks and Risky Key Setups

The largest incident was the September attack on Bitget, which lost at least $352 million after hackers exploited a flaw in a third-party security product. Other losses included $319 million at Liquid Network, about $114 million at Coldcard wallet software and at least $75 million at Tectonic.

Three bridges and cross-chain protocols lost over $35 million in a six-hour exploit in July, including $24 million at AFX Trade. This week, Ledger found a hardware spy implant in a device sold by a Southeast Asian reseller, with losses of about $93 million. Hacken also reviewed 12 derivatives exchanges and prediction markets and found more than $700 million at two major venues relied on weak key arrangements. It found no live bug, only setups that are not secure enough for the amounts involved.