Hackers stole $1.18 billion from cryptocurrency projects during the third quarter, a 55% increase from the previous quarter, according to blockchain security firm Hacken. The firm’s findings suggest that investors may be overestimating the protection offered by audit badges, because many reviews do not cover the suppliers, wallets, signing arrangements and software components that attackers target.
Losses concentrated outside audit scopes
Hacken identified 107 incidents during the three-month period. About $906.8 million of the total losses were linked to compromised suppliers or developer tools, security fixes that had not been installed, or components left out of a project’s latest security review.
The firm said the central issue was the scope of an audit. A review may focus on selected smart contracts or other critical code without examining every system that can control funds or influence a project’s economics. Those omitted systems can include wallets, transaction-signing infrastructure and third-party software.
Andrii Matiukhin, Hacken’s co-founder and board director, told CoinDesk that reviewing every component connected to customer funds or a platform’s economic functions can be expensive. As a result, he said, some teams limit audits to what they consider the most important parts of a service.
An audit is generally an assessment of specified software or systems at a particular point in time. It is not necessarily a guarantee that an entire platform is secure, or that vulnerabilities discovered later have been fixed. Hacken said users can see an audit badge and assume that the complete service has been examined, even when the review covered only a defined portion of it.
Major incidents during the quarter
The largest incident cited in the report involved crypto exchange Bitget. Hacken said the exchange lost at least $352 million in September after attackers exploited a vulnerability in a third-party security product and reached infrastructure used for withdrawals.
The report also highlighted risks affecting hardware wallets, bridges and cross-chain systems:
- Ledger said it discovered an unauthorized hardware “spy” implant in a device sold by CryptoBilis, a Southeast Asian reseller. The resulting losses were estimated at about $93 million.
- Three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July. AFX Trade accounted for $24 million after attackers obtained control of its validator keys.
- Other incidents included losses of $319 million at Liquid Network, at least $75 million at Tectonic and roughly $114 million involving Coldcard wallet software.
These cases show that security exposure can arise beyond the smart contracts or core code that a project chooses to submit for review. Suppliers, administrative systems, key-management processes and hardware distribution channels can all affect access to digital assets.
Concerns over keys and delayed fixes
Hacken separately reviewed 12 derivatives exchanges and prediction markets. It said more than $700 million in assets held at two major venues depended either on a four-key arrangement requiring three signatures or on administrative keys whose owners were not publicly identified.
Matiukhin did not name the venues or release a detailed assessment before the report’s publication. He said Hacken had found no evidence of an active vulnerability in the reviewed systems. The concern, he said, was that some key-management arrangements were not sufficiently secure given the size of the platforms and the assets involved.
The firm also pointed to delays in applying known security fixes. The risk can be greater when several blockchains use the same software but update at different times. Hacken said a critical vulnerability may be rated as low by a project team, causing implementation of a fix to be postponed or rejected.
The firm’s conclusion was that companies holding customer funds remain responsible for monitoring vulnerabilities and applying fixes promptly. An audit completed months or years earlier cannot replace continuing security work, particularly when a platform relies on external suppliers or interconnected software.
Moneyiar market picture
Moneyiar data at 22:08-22:09 on October 19, 2026, showed mixed performance among the listed crypto-related assets:
- Ethereum Name Service (ENS) traded at $5.4819696041, up 2.19% over 24 hours but down 9.55% over seven days.
- Compound (COMP) was at $21.5283802205, gaining 2.71% in 24 hours while falling 8.91% over the week.
- Decimal (DEL) stood at $0.4377168297, down 0.44% in 24 hours and up 5.36% over seven days.
- ECOMI (OMI) was priced at $0.0002776126, up 0.81% over 24 hours and down 0.87% over seven days.
The market figures do not measure the security losses identified by Hacken, but they provide a snapshot of selected assets after the report’s third-quarter period. The report’s broader message is that an audit label should be read as evidence about a defined review, rather than proof that every route to a project’s funds has been tested.
