Crypto audits give investors false sense of security as Q3 hacks cost $1.18 billion, Hacken says

Crypto investors may be putting too much faith in security audits that fail to cover the systems hackers actually target, according to blockchain security firm Hacken.

In a report released on Thursday, Hacken found that hackers stole $1.18 billion across 107 incidents during the third quarter, 55% more than in the previous quarter. Of that amount, $906.8 million was lost due to compromised suppliers or developer tools, publicly available security fixes that were not installed or components excluded from the most recent security review.

"The problem is always scope." Andrii Matiukhin, co-founder and board director at the company, said in an interview with CoinDesk. "It's expensive to have enormous scopes of all components that interact with funds or influence economics, and teams cut corners, auditing only critical parts of the service.”

The findings raise questions about how much protection investors can expect from crypto projects advertising themselves as audited. Hacken said customers often assume an audit covers an entire platform when it may examine only specific smart contracts, leaving wallets, signing systems and third-party software outside its scope.

“Usually, when a customer sees a new project, they see an audit badge, assume the whole system is covered, and lose money through a key, a supplier, or a setting that was never tested,” Matiukhin said.

The biggest incident in the period was the September attack on crypto exchange Bitget, which lost at least $352 million after hackers exploited a vulnerability in a third-party security product to gain access to its withdrawal infrastructure, according to the report.

The risks extend beyond exchanges. Just this week, hardware wallet maker Ledger said it found an unauthorized hardware “spy” implant in a device sold by CryptoBilis, a Southeast Asian reseller, resulting in losses of about $93 million.

Three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July, Hacken said. AFX Trade accounted for $24 million of that after attackers gained control of its validator keys. Other attacks walked off with $319 million at Liquid Network, at least $75 million at Tectonic, and roughly $114 million at Coldcard wallet software.

Hacken also examined 12 derivatives exchanges and prediction markets and found that more than $700 million in secure assets at two major venues depended on a four-key signing arrangement requiring three signatures, or on administrative keys whose holders were not publicly identified.

Matiukhin declined to identify the venues or provide a detailed assessment before publication of the report. He said it had found no evidence of an active vulnerability, but considered some of the arrangements inadequate given the amounts involved.

“We are not aware of a live bug in the systems of any reviewed venue,” Matiukhin said. “Instead, what we found is setups where key setups are not secure enough considering the scale of the venues reviewed.”

Matiukhin said delays in fixing known vulnerabilities were another concern, particularly when multiple blockchains relied on the same software but updated it at different times.

“Sometimes a critical vulnerability is classified as low by the team, and fix implementation is delayed or even declined,” Matiukhin said.

Responsibility ultimately rests with the companies holding customer funds, which must track vulnerabilities and install fixes promptly rather than rely on an audit completed months or years earlier, Hacken said.