Crypto audits give investors false sense of security as Q3 hacks cost $1.18 billion, Hacken says — SkimNews
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- Hacken reported hackers stole $1.18 billion from crypto projects in Q3 across 107 incidents, a 55% increase from Q2, with $906.8 million (roughly 77%) stemming from compromised suppliers or developer tools, uninstalled security fixes, or components excluded from the most recent audit.
- Hacken co-founder Andrii Matiukhin warned that audit badges create a false sense of security because reviews typically cover only specific smart contracts while leaving wallets, signing systems, and third-party software — the components attackers actually exploit — outside scope.
- Crypto exchange Bitget lost at least $352 million in September, the single largest incident of the quarter, after attackers exploited a vulnerability in a third-party security product to access its withdrawal infrastructure.
- Hardware wallet maker Ledger discovered an unauthorized hardware "spy" implant in a device sold by Southeast Asian reseller CryptoBilis, resulting in roughly $93 million in losses.
- Three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July, with AFX Trade accounting for $24 million of that after attackers seized control of its validator keys; other major incidents included $319 million at Liquid Network, at least $75 million at Tectonic, and roughly $114 million at Coldcard wallet software.
- Hacken reviewed 12 derivatives exchanges and prediction markets and found more than $700 million in assets at two venues depended on a four-key signing arrangement requiring three signatures or on administrative keys whose holders were not publicly identified — setups Hacken called inadequate given the amounts at stake.
- Matiukhin said responsibility falls on the companies holding customer funds to track vulnerabilities and install fixes promptly rather than rely on an audit completed months or years earlier, noting that delayed patches were a recurring driver of losses.
Why it matters: Roughly 77% of Q3's $1.18 billion in crypto losses landed through supply-chain compromises, unpatched fixes, and third-party software — exactly the surfaces that audit badges don't cover and most investors don't know to ask about. For users treating an audit as a safety seal, the report documents a structural mismatch between what gets reviewed and where attacks land.
Ask SkimNews
