Hacken’s third-quarter report found that $1.18 billion was stolen in crypto attacks, while warning that the security audits investors rely on may not cover every system on a platform.
According to the report published Thursday by the blockchain security company, losses from 107 attack incidents between July and September were up 55% from the previous quarter. A total of $906.8 million was linked to compromised vendor or developer tools, security patches that had not been applied, and components excluded from the most recent review.
What’s Behind the Audit Badge?
Hacken co-founder Andrii Matiukhin said the core issue is the scope of an audit. Because having every component that interacts with funds reviewed is costly, some teams audit only the parts they consider critical.
Even when specific smart contracts in a project have been reviewed, wallets, transaction-signing systems, and third-party software may fall outside the scope of that work. This creates a significant gap between the audit badge investors see and the areas they think have been checked; attackers can then access funds through a key, vendor, or configuration that has never been tested.
Withdrawal Infrastructure Was Targeted in the Bitget Attack
The report identified the Bitget attack in September as the largest incident of the period. According to Hacken’s findings, attackers exploited a vulnerability in a third-party security product to gain access to the exchange’s withdrawal infrastructure and stole at least $352 million.
In July, three crypto bridges and cross-chain protocols lost more than $35 million in total during a six-hour attack. Of that amount, $24 million was lost at AFX Trade, where attackers compromised validator keys.
Key Management Warning for Assets Worth $700 Million
Hacken also reviewed 12 derivatives trading platforms and prediction markets. It reported that more than $700 million in assets at two major platforms depended on a setup requiring signatures from three of four keys, or on administrator keys whose owners had not been publicly disclosed.
Matiukhin did not name the platforms, but emphasized that they found no evidence of an active vulnerability in the systems they reviewed. The criticism is that the key management setups in use are inadequate given the value of the assets they protect.
Another issue highlighted by the company is the failure to patch known vulnerabilities promptly. Blockchains using the same software may apply updates at different times; some teams may delay a fix by considering a critical vulnerability low risk. Hacken says companies holding customer funds should continuously monitor security vulnerabilities and apply patches promptly, rather than relying on an audit completed months or years ago.
Not investment advice.