Hacken puts most Q3 hack losses outside the audit

Crypto hacks cost $1.18 billion across 107 incidents in the third quarter, 55 per cent more than in the second, according to a report the security firm Hacken released on Thursday, as summarised by Cointelegraph that day and by CoinDesk on Sunday. We could not read the report itself, which returned an error when we tried to open it, so the figures below are the two outlets' accounts of it.

Hacken said $906.8 million, about 77 per cent of the total by our arithmetic, came from compromised suppliers or developer tools, publicly available security fixes that had not been installed, or components left out of the most recent security review, CoinDesk reported. By our arithmetic, a 55 per cent rise implies second-quarter losses of about $761 million. Cointelegraph called the third quarter the most damaging since the first quarter of 2025, when the Bybit theft of $1.4 billion lifted the total to $1.6 billion.

The two outlets part on the largest cases. CoinDesk said the biggest incident was September's attack on Bitget, which lost "at least $352 million" after hackers exploited a flaw in a third-party security product to reach its withdrawal infrastructure. Cointelegraph put the Bitget loss at $387 million, the figure Komposite used in our report on Bitget's bitcoin-denominated protection fund. CoinDesk gave Tectonic "at least $75 million"; Cointelegraph gave $120 million. On Liquid Network the two are close, at $319 million and $320 million.

Coldcard accounted for about $114 million in CoinDesk's account and about $115 million in Cointelegraph's, which tied it to a firmware vulnerability. CoinDesk also cited losses of about $93 million linked to the hardware implant Ledger said it found in a device sold by CryptoBilis, a Southeast Asian reseller. When Komposite covered that case, loss figures were unverified, and the $93 million has not been independently confirmed. By our addition of Cointelegraph's four largest figures, they come to $942 million, about 80 per cent of the total, matching that outlet's own description.

Most incidents were small, Cointelegraph reported. Of the 107, 98 cost less than $10 million, and the median loss was $670,000. Smart contract flaws, the part of a system audits most often examine, were the most common vector by count, at $228 million across 71 incidents. The quarter's money sat in a handful of large breaches rather than in routine contract bugs.

Hacken's argument is about scope. "The problem is always scope," Andrii Matiukhin, co-founder and board director at Hacken, told CoinDesk. "It's expensive to have enormous scopes of all components that interact with funds or influence economics, and teams cut corners, auditing only critical parts of the service." He said customers who see an audit badge "assume the whole system is covered", and that "sometimes a critical vulnerability is classified as low by the team, and fix implementation is delayed or even declined".

Hacken also reviewed 12 derivatives exchanges and prediction markets, CoinDesk said, and found that more than $700 million in assets at two major venues depended on a four-key arrangement needing three signatures, or on administrative keys whose holders were not publicly identified. Matiukhin declined to name the venues. "We are not aware of a live bug in the systems of any reviewed venue," he said. That is a finding about key design and disclosure, not a report of a vulnerability.

Cointelegraph also gave Hacken's recovery figures. About $387 million, roughly a third, was returned or reversed, including $272 million handed back by self-described white hats after the Liquid Network exploit and about $111.2 million reversed when Cronos validators rolled back 114 minutes of blockchain history after the Tectonic incident. Operators covered a further $410 million from their own funds, $387 million of it from Bitget's user protection fund. About $384 million, or 32 per cent, was neither returned nor covered. The three parts sum to $1.181 billion, by our addition.

Hacken sells security audits, so its conclusion that audit badges give false comfort is also an argument for buying broader reviews, and the totals are the firm's own; other trackers count incidents differently. The operational point does not depend on the vendor: losses gathered around suppliers, signing keys and fixes not yet installed, the same patching gap Komposite described in our report on a month of 1,400 fixes.