Crypto Audits: $1.18 Billion Lost in Q3 as Audit Badges Mislead Investors

According to cybersecurity firm Hacken, hackers defrauded crypto projects of $1.18 billion in Q3 2026, marking a 55% increase compared to the previous quarter. Out of 107 recorded incidents, 77% of losses were linked to compromised providers or development tools, or publicly available but uninstalled security patches. The report warns against audit badges, which Hacken claims give investors a false sense of security.

Hackers Plunder Crypto Sector for $1.18 Billion in Q3, Up 55% from Previous Quarter

The $1.18 billion figure represents the total amount stolen across 107 distinct attacks between July and September 2026, according to Hacken's report published on October 18. This loss surpasses the $760 million recorded in Q2, marking a significant increase of 55%. The rise is partly attributed to intensified attacks targeting third parties and supporting infrastructure, which are not always covered by traditional audits. The report highlights that most victims were projects displaying audit badges, creating a false sense of security among investors.

The same report indicates that losses related to providers and development tools totaled $906.8 million, representing over 77% of the quarter's total losses. These figures stem from vulnerabilities in components not included in recent security reviews, such as wallets, signing systems, or third-party libraries. Hacken estimates that the limited scope of audits leaves projects vulnerable to attacks exploiting entry points outside the review's focus. (Source: CoinDesk)

Audits Only Cover Smart Contracts, Leaving Wallets and Providers Exposed

"The problem is always scope," said Andrii Matiukhin, co-founder and partner at Hacken, in an interview with CoinDesk. In French, he clarified that "Le problème réside toujours dans la portée." This remark underscores that audits often focus solely on smart contracts while neglecting the underlying infrastructure handling funds. According to Hacken, project teams consciously limit audit scopes to reduce costs, creating exploitable blind spots for hackers.

"Usually, when a customer sees a new project, they see an audit badge, assume the whole system is covered, and lose money through a key, a supplier, or a setting that was never tested," Hacken explained. This quote illustrates how misplaced trust in audit badges can be, especially when audits exclude critical components outside smart contract code.

Compromised Providers Account for 77% of Losses, Totalling $906.8 Million

Haken's report details that 77% of Q3 losses were attributed to compromised providers or vulnerable development tools. Of the $1.18 billion lost, $906.8 million came from these attack vectors, while the remainder resulted from direct platform exploits. This trend highlights that securing software supply chains is now the most critical link for crypto projects.

Haken emphasizes that many developers fail to implement publicly available security patches, even when widely distributed. Audits, which often focus on static code reviews, miss misconfigurations or outdated dependencies. The key issue is that most incidents occur after known vulnerabilities remain unpatched, turning them into entry points for cybercriminals.

Biggest Heist: Bitget Attack, $352 Million via a Third-Party Vulnerability

The largest incident of the quarter was the attack on exchange platform Bitget, resulting in losses exceeding $352 million. Hackers exploited a vulnerability in a third-party security product to gain access to Bitget's withdrawal infrastructure. This incident exemplifies the risks associated with dependencies on external security providers, which are not always covered by internal audits.

According to the report, the exploited vulnerability was a software component not reviewed in Bitget's latest audit, reiterating the importance of audit scope. The attack caused immediate price drops for several tokens linked to Bitget and increased withdrawal volumes on other platforms as investors sought to secure their funds.

Other Major Incidents: Ledger, Cross-Chain Bridges, and AFX Trade

In addition to Bitget, the report highlights three distinct categories of incidents. First, hardware wallet maker Ledger discovered an unauthorized physical implant in a device sold by reseller CryptoBilis in Southeast Asia, causing estimated losses of $93 million. Second, three cross-chain bridges and protocols lost over $35 million during a six-hour exploit in July. Third, trading platform AFX Trade suffered a $24 million theft, with attackers exploiting a weakness in its withdrawal gateway configuration.

These incidents demonstrate that vulnerabilities are not limited to exchanges but extend to storage infrastructure, cross-chain solutions, and trading services. Each case involves elements often excluded from traditional audits, such as hardware components, third-party software, or network configurations. Haken concludes that the diversification of attack vectors makes comprehensive crypto sector protection particularly challenging.

Recommendations for Market Players and Regulators

In light of these findings, Haken recommends crypto projects to expand audit scopes to include wallets, signing systems, and third-party dependencies. The firm also suggests implementing continuous bug-bounty programs and establishing automated security patch update processes. These measures aim to reduce losses attributed to compromised providers, which currently account for over three-quarters of Q3's total.

Regulators, particularly in the U.S. and Europe, could enhance transparency requirements around audits by mandating projects to disclose the exact scope of each review. Such a mandate would enable investors to better assess real protection levels, avoiding blind trust in mere audit badges. (Source: CoinDesk)