Blockchain security firm Hacken reported that hackers stole $1.18 billion across 107 incidents during the third quarter, representing a 55% increase from the previous quarter. According to the firm's report, approximately $900 million in losses stemmed from compromised suppliers, uninstalled security fixes, or components excluded from security reviews. The biggest incident was the September attack on crypto exchange Bitget, which lost at least $352 million after hackers exploited a vulnerability in a third-party security product to generate fraudulent withdrawal requests. CoinMarketCap data confirms that losses at Bitget and Blockstream's Liquid Network accounted for the largest share of the quarterly damage, with the headline number aggregating exploits, private-key compromises and wallet drains reported across centralized and decentralized platforms during the quarter. As reported by AMBCrypto, the number of reported breaches grew from 67 in Q2 to 107 in Q3, with 63 breaches associated with losses exceeding $250,000.
As reported by Hacken, the security firm found that 77% of third-quarter losses involved compromised suppliers, delayed fixes, or systems outside the latest security reviews. Andrii Matiukhin, co-founder and board director at Hacken, explained that "the problem is always scope. It's expensive to have enormous scopes of all components that interact with funds or influence economics, and teams cut corners, auditing only critical parts of the service." The firm warned that customers often assume an audit covers an entire platform when it may examine only specific smart contracts, leaving wallets, signing systems and third-party software outside its scope. This pattern is consistent with broader security trends, where the biggest single-event losses now come from custody failures and key management at large platforms rather than routine smart-contract bugs in long-tail protocols. According to AMBCrypto, these broader security gaps become clearer when examining how attackers exploited specific weaknesses, with smart contract defects leading to 79 reported breaches worth approximately $569.5 million, while access control and operational failures resulted in 22 breaches totaling $477.6 million, producing more financial impact per breach.
The risks extended beyond exchanges, as hardware wallet maker Ledger recently found an unauthorized hardware "spy" implant in a device sold by CryptoBilis, resulting in $93 million in losses. According to Hacken, three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July, with AFX Trade accounting for $24 million after attackers gained control of its validator keys. Other significant attacks included $319 million at Liquid Network, at least $75 million at Tectonic, and roughly $114 million at Coldcard wallet software. The Liquid Network result points to a recurring structural weakness, as sidechains and bridges hold large pooled pools of assets locked on one chain and represented on another, making them single points of failure where attackers can move value in one transaction regardless of audit work. As reported by AMBCrypto, the Cosmos EVM chain lost approximately $5.7 million due to its failure to implement a security update within 96 days of its release, creating a window of opportunity for underflow exploits against chains that had not yet implemented the security update.
In examining 12 derivatives exchanges and prediction markets, Hacken found that more than $700 million in secure assets at two major venues depended on a four-key signing arrangement requiring three signatures, or on administrative keys whose holders were not publicly identified. As reported by the firm, Matiukhin declined to identify the venues but stated that "we are not aware of a live bug in the systems of any reviewed venue, instead, what we found is setups where key setups are not secure enough considering the scale of the venues reviewed." For exchanges, an exploit of this scale carries consequences beyond the stolen funds themselves, as platforms typically absorb losses from their own treasuries or insurance reserves to make users whole, a cost that hits the balance sheet directly. According to AMBCrypto, continuous monitoring could help teams track new threats, fix urgent weaknesses, and confirm that updates reach all affected systems, potentially reducing theft, recovery costs, and service disruptions.
According to Hacken's findings, delays in fixing known vulnerabilities were another significant concern, particularly when multiple blockchains relied on the same software but updated it at different times. Matiukhin emphasized that responsibility ultimately rests with companies holding customer funds, which must track vulnerabilities and install fixes promptly rather than rely on audits completed months or years earlier. The firm noted that sometimes critical vulnerabilities are classified as low by teams, leading to delayed or even declined fix implementation. As reported by AMBCrypto, attackers exploited weaknesses even after security fixes became public, suggesting that companies often failed to act quickly enough rather than failing to identify the risks. The Q3 total will pressure platforms to accelerate moves toward proof-of-reserves attestations, hardware-isolated signing and stricter multisig governance, with regulators in major jurisdictions expected to cite the $1.18 billion quarterly figure as they finalize custody standards for the year ahead.
