1. Crypto Hacks Cost $1.18 Billion in the Third Quarter
Crypto hacks drained $1.18 billion from projects in the third quarter of 2026, a 55% increase over the previous quarter, according to a report that blockchain security firm Hacken published on Thursday, October 15. Hacken counted 107 incidents and found that about $906.8 million, or roughly 77% of the losses, involved compromised suppliers or developer tools, security fixes that were available but never installed, or components excluded from the most recent security review.
The central warning of the report is that an audit badge can give users more comfort than it deserves. Reviews frequently leave out the wallets, signing systems and third-party software that attackers actually target, so a project can carry a clean audit and still be exposed through a part of its operation that nobody examined.
Hacken's findings arrive after a run of high-profile thefts and supply-chain problems in the industry, and they shift attention from flaws in smart contract code, the traditional focus of audits, toward the surrounding infrastructure that holds and moves funds.
2. How Did Attackers Get In?
The report groups the biggest losses into three patterns. The first is the compromise of a supplier or developer tool, in which an attacker reaches a project through software or a service it depends on rather than through its own code. The second is the unpatched flaw: a fix had been published but was never installed, leaving the door open. The third is scope, where the exploited component sat outside the most recent security review.
Together these categories accounted for $906.8 million of the $1.18 billion stolen. The remaining losses, roughly a fifth of the total, came from incidents that did not fit those patterns. The concentration matters because it shows that most of the money was lost not through novel techniques but through gaps in how projects manage dependencies, updates and the boundaries of their own reviews.
Andrii Matiukhin, co-founder and board director of Hacken, summarized the issue in a single sentence: "the problem is always scope." He explained that checking every component that touches user funds is expensive, so teams often cut corners and commission audits only for the pieces they consider critical.
3. Why Do Audits Create a False Sense of Security?
An audit is a point-in-time examination of a defined set of components, and it says nothing about what falls outside that definition. Hacken notes that customers often assume the badge covers the entire platform when, in practice, the work may have looked only at specific smart contracts. Wallets, key-management and signing systems, and third-party software can all sit beyond the boundary.
Matiukhin described the typical sequence. A customer sees an audit badge, assumes full coverage and deposits funds. Then the money is lost through a key, a supplier or a configuration setting that was never tested. The audit was not necessarily wrong; it simply did not apply to the component that failed.
The finding raises a practical question about how much protection audited projects really provide. For users, the answer depends on reading what an audit covers and when it was completed, since a review carried out months or years earlier may predate the code, vendors and settings in use today.
4. Which Incidents Defined the Quarter?
The largest single event was the September attack on the exchange Bitget, which lost at least $352 million. According to the report, attackers exploited a vulnerability in a third-party security product to reach the exchange's withdrawal infrastructure. The case fits the supplier pattern closely: the weakness lay in a tool the exchange relied on, not in an obvious flaw in its own contracts.
Another example came earlier in the same week as the report. The hardware wallet maker Ledger said it had found an unauthorized hardware implant, described as a spy device, in units sold by CryptoBilis, a reseller in Southeast Asia. The tampering led to losses of about $93 million. Again, the failure occurred in the chain of custody around a product, not in the product's published design.
Bridges and cross-chain protocols also suffered. In July, three of them lost more than $35 million in a six-hour exploit, and AFX Trade accounted for $24 million of that after attackers took control of its validator keys. Validators are the participants who approve transactions on a network or bridge, so control of their keys can let an attacker authorize transfers that should never happen.
The report points to other large losses as well: $319 million at Liquid Network, at least $75 million at the lending app Tectonic, after which the Cronos blockchain was halted, and roughly $114 million tied to Coldcard wallet software. In the Coldcard case, the company shipped new firmware and said artificial intelligence had helped it find additional bugs.
5. What Did Hacken Find at Derivatives Venues?
Hacken also reviewed 12 derivatives exchanges and prediction markets. It found that more than $700 million in secure assets at two major venues depended on either a four-key signing arrangement that needs three signatures, or on administrative keys whose holders were not publicly identified.
Matiukhin declined to name the venues or to share a detailed assessment before publication. He said Hacken found no active vulnerability and that the concern was proportionality: some arrangements were, in the firm's view, inadequate for the amounts they protect. "We are not aware of a live bug in the systems of any reviewed venue," he said.
A signing setup that needs three of four keys can be safe when the keyholders are independent and well protected. The risk grows when the holders are anonymous, when several keys are stored in related places, or when administrative powers allow changes to the system without public scrutiny. Matiukhin's point was that the key setups are not secure enough for the scale of the venues.
6. Why Do Delayed Fixes Matter?
Hacken's second concern is how slowly known problems get repaired. Matiukhin raised the issue of delayed fixes, particularly when several blockchains run the same software but update it on different schedules. An attacker who learns of a flaw in one network can look for others that have not yet applied the patch.
He added that teams sometimes label critical vulnerabilities as low severity. Once a flaw is classified that way, the fix may be postponed or rejected altogether, leaving a known weakness open longer than it should be.
Shared software makes the timing problem worse. When many networks inherit the same code, a single disclosed flaw becomes a checklist for attackers, who can test each network in turn and strike wherever the update lags. Projects that coordinate releases and treat every critical report with urgency narrow that window, while those that rank issues by convenience leave it open.
The pattern helps explain why so much of the quarter's loss involved fixes that were published but never installed. The information needed to prevent those attacks existed; what was missing was the discipline to act on it quickly.
7. What Is a Supply-Chain Attack in Crypto?
A supply-chain attack targets the tools and services a project depends on instead of the project itself. Crypto firms rely on many outside components: developer libraries, security products, hosting services, wallet software and hardware sold through resellers. If any of these is compromised, the attacker inherits a trusted position inside the victim's systems, often bypassing the controls the victim built for itself.
The Bitget case illustrates the mechanism. A flaw in a third-party security product gave attackers a route to the exchange's withdrawal infrastructure, the systems that approve and send customer funds. The Ledger and CryptoBilis incident shows the hardware version of the same idea, in which a device is altered somewhere between manufacture and the customer, so that the buyer trusts something that has already been tampered with.
These attacks are difficult to defend against with a traditional contract audit, which reads code and tests logic. An auditor reviewing a set of smart contracts will not normally examine the signing workstation, the vendor that supplies monitoring software, or the reseller that ships a hardware wallet. Hacken's data suggest that these unexamined areas are where most of the money was lost during the quarter.
The quarter-over-quarter rise of 55% adds urgency. Whatever the reasons behind the increase, the report indicates that the share of losses linked to dependencies, unapplied fixes and out-of-scope components was large enough to dominate the total, with $906.8 million attributed to them.
8. What Should Projects and Users Do Next?
Hacken places responsibility on the companies that hold customer funds. In its view they should track known vulnerabilities and install fixes promptly, instead of relying on an audit completed months or years earlier. That implies continuous monitoring of dependencies, regular reviews of key-management arrangements, and audits whose scope includes wallets, signing systems and third-party software.
For users, the report suggests asking what a given audit covered, how recent it is, and whether the platform's key setup and suppliers have been examined. An audit badge remains useful evidence that part of a system was checked, but Hacken's data indicate it should not be treated as proof that the whole platform is safe.
For the industry, the lesson is also one of expectations. A security review is one input into a project's risk, alongside how its keys are held, who can change its settings and how fast it responds to warnings. Treating it as the only input is the habit Hacken wants to break.
With $1.18 billion lost across 107 incidents in a single quarter, the report argues that the industry's security attention needs to move beyond smart contract code toward the full set of components, vendors and processes that sit between a user's deposit and the blockchain.