Crypto Audits May Offer False Confidence as Q3 Hacks Reach $1.18 Billion

Preface

Security audits are often presented as evidence that a crypto project has taken steps to protect its users and assets. But an audit’s value depends on what it examines, how recently it was completed, and whether identified weaknesses are addressed. A report from blockchain security firm Hacken warns that investors may mistake a limited review for a guarantee that an entire platform is safe. Hacken recorded $1.18 billion in crypto losses across 107 incidents during the third quarter, 55% more than in the previous quarter. Much of the damage involved compromised suppliers and development tools, security fixes that were not installed, or components left outside an audit’s scope. The findings highlight a central concern: an audit badge cannot, on its own, demonstrate that every system handling funds has been tested or remains secure.

Lazy bag

Hacken’s report counted $1.18 billion in losses across 107 third-quarter incidents, an increase of 55% from the previous quarter. About $906.8 million was linked to compromised suppliers or developer tools, uninstalled security fixes, or components excluded from the latest review. The company argues that audits can leave important areas—such as wallets, signing systems, and third-party software—unchecked. Major cases included Bitget’s loss of at least $352 million and an exploit affecting three bridges and cross-chain protocols that caused more than $35 million in losses over six hours. Investors and users should treat audit results as limited evidence, not as a blanket security guarantee.

Main Body

Crypto security audits are intended to identify vulnerabilities in code and systems before attackers can exploit them. However, an audit is not necessarily a full review of every service, dependency, operational process, or access-control mechanism connected to a project. Hacken’s latest findings draw attention to the difference between a project having an audit and the project’s entire security environment having been examined.

In a report released on Thursday, Hacken said hackers stole $1.18 billion across 107 incidents during the third quarter. The amount was 55% higher than in the previous quarter. Of the total, $906.8 million was attributed to compromised suppliers or developer tools, publicly available security fixes that had not been installed, or components omitted from the most recent security review. The figures suggest that losses can arise not only from flaws in a project’s own code, but also from weaknesses in the wider systems and services it depends on.

Hacken co-founder and board director Andrii Matiukhin described audit scope as a recurring challenge in an interview with CoinDesk. He said that reviewing every component that interacts with funds or affects a project’s economics can be expensive. As a result, teams may reduce the scope and focus on selected critical parts of a service. That decision may be understandable from a cost and time perspective, but it can leave other important components without the same level of scrutiny.

The issue becomes especially significant when users interpret an audit badge as proof that a complete platform has been checked. In practice, an audit may cover only specified smart contracts or a defined portion of an application. Wallets, signing systems, third-party products, infrastructure, and operational settings may be outside the review. If attackers target one of those omitted elements, the presence of an audit badge may provide little protection against that particular route of attack.

Matiukhin said customers may see a newly launched project’s audit badge and assume its entire system has been reviewed, only to lose money through a key, supplier, or setting that was never tested. The distinction is important for investors assessing claims about security. A review describes the work performed within its stated scope and at a particular point in time; it does not automatically establish that every connected component is secure or that the project has remained secure after changes were made.

The largest incident highlighted for the period was an attack on crypto exchange Bitget in September. According to Hacken’s report, the exchange lost at least $352 million after attackers exploited a vulnerability in a third-party security product to gain access to its withdrawal infrastructure. The case illustrates how a service provider or security tool can become a path into systems that control the movement of funds. It also underscores why reviewing only an exchange’s own application code may not reveal risks introduced by external products.

Other examples extended the concern beyond exchanges. Hardware wallet maker Ledger said that it had found an unauthorized hardware “spy” implant in a device sold by CryptoBilis, a Southeast Asian reseller. The resulting losses were about $93 million. This incident points to risks that can arise in hardware supply and distribution, areas that may not be covered by an audit focused on software code alone.

Hacken also reported that three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July. AFX Trade accounted for $24 million of the losses after attackers gained control of its validator keys. The report additionally identified losses of $319 million at Liquid Network, at least $75 million at Tectonic, and roughly $114 million at Coldcard wallet software. These incidents differ in their reported circumstances, but together they demonstrate how weaknesses involving keys, infrastructure, and connected systems can have substantial consequences.

The report also considered the security arrangements of 12 derivatives exchanges and prediction markets. Hacken found that more than $700 million in secure assets at two major venues depended either on a four-key signing arrangement that required three signatures or on administrative keys whose holders were not publicly identified. The company did not name the venues or provide a detailed assessment before the report’s publication. Matiukhin said Hacken had found no evidence of an active vulnerability, but considered some arrangements inadequate in light of the amounts involved.

He emphasized that the concern was not a known live bug in the reviewed venues’ systems. Rather, Hacken identified key-management setups that it considered insufficiently secure for the scale of the platforms. This distinction matters: a security concern does not necessarily mean that an exploit has occurred, but it can indicate that safeguards may not match the value or operational importance of the assets being protected.

Hacken also pointed to delays in addressing known vulnerabilities. Such delays can be particularly consequential when several blockchains rely on the same software but apply updates at different times. Matiukhin said a critical vulnerability may sometimes be classified as low priority by a team, causing implementation of a fix to be delayed or even declined. In a fast-changing technical environment, a disclosed fix does not eliminate risk if affected systems do not install it promptly.

The report places responsibility on the companies that hold customer funds. Those companies need to track vulnerabilities, understand which systems and suppliers are affected, and apply security fixes in a timely manner. An audit completed months or years earlier cannot replace ongoing security maintenance, especially when software, dependencies, personnel, and operational procedures change over time.

For users and investors, the practical lesson is to look beyond the presence of an audit badge. Relevant questions include which components were examined, when the review took place, what was excluded, whether third-party dependencies were considered, and how the project handles vulnerabilities identified after an audit. The answers do not guarantee that an incident will not occur, but they help clarify what an audit does—and does not—show. Security is a continuing process, not a one-time certification.

Key Insights Table