Crypto Thefts Top $1.18 Billion in Q3, With Third Party Weak Spots to Blame

Hackers took more money from crypto projects this past quarter than at any point in over a year, and security firm Hacken says the biggest losses came from places most audits never look.

Where the Stolen Money Came From

Across 107 incidents, roughly $906 million, or 77% of the total, traced back to compromised vendors, developer tools, known fixes that were never installed, and other parts of the system outside formal reviews. Four attacks made up about 80% of the damage, Bitget at $387 million, Liquid Network at $320 million, Tectonic at $120 million and a Coldcard firmware flaw at around $115 million. Most cases were small, with 98 under $10 million and a median loss of $670,000. Smart contract bugs were the most common method, hitting 71 projects for $228 million.

How Much Was Recovered

About $387 million, roughly a third, was returned or reversed. White hat actors handed back $272 million from the Liquid breach, and Cronos validators rolled back 114 minutes of history to undo $111.2 million of the Tectonic loss. Circle and Tether froze about $340,000 tied to Bitget. Platforms also paid $410 million to users from their own reserves, while around $384 million was never recovered.

The firm wants projects to secure outside suppliers and extend audits to oracles, bridges, custody systems and signing authorities.