Crypto Audits Give False Security as Q3 Hacks Cost $1.18 Billion, Hacken Says

Hacken calculated that hackers stole $1.18 billion from crypto projects in 107 incidents during the third quarter, 55% more than in the second. The cause is not only coding mistakes: the audit that projects love to advertise usually covers just part of the system.

What exactly did the Hacken report show?

The report came out on Thursday, and CoinDesk relayed its main numbers. Of the $1.18 billion, about $906.8 million (77%) disappeared because of three things: compromised suppliers or developer tools, public security fixes that nobody installed, and components that fell outside the latest review.

The biggest case of the quarter was the September hack of the Bitget exchange, which lost at least $352 million. Attackers used a flaw in a third-party security product to reach the withdrawal infrastructure. The exchange's own code was not the weak spot.

Why doesn't an audit cover everything?

An audit is an independent review of code, and it looks only at what it was shown. The list of reviewed parts is called the scope. The wider the scope, the pricier the review, so teams often pay for the minimum.

"The problem is always scope. It's expensive to have enormous scopes of all components that interact with funds or influence economics, and teams cut corners, auditing only critical parts of the service."

Andrii Matiukhin, co-founder and board director at Hacken, in an interview with CoinDesk

Hacken says a user sees an audit badge and assumes the whole system is covered. Then money vanishes through a key, a supplier or a setting that nobody tested. Wallets, signing systems and third-party software often sit outside the report.

How do losses happen outside the review?

To grasp the mechanics, it helps to lay out the typical paths Hacken named.

• Supplier: attackers get in not through the project itself but through a service or library it relies on.
• A fix is already out, but the team never installed it because it rated the threat as low. According to Matiukhin, a critical bug is sometimes classified that way, and the fix gets delayed or declined.
• One piece of software runs on several blockchains that update at different times, so a window stays open between updates.
• Signing keys are stored in a way that is easier to break than the code is to bypass.

Separately, Hacken examined 12 derivatives exchanges and prediction markets. At two large venues, more than $700 million depended on a signing setup that needs three signatures out of four keys, or on administrative keys whose holders are not publicly named. Matiukhin did not reveal the names and added that no live bug was found. Still, he considers the setups inadequate for such sums.

In July, three crypto bridges and cross-chain protocols lost more than $35 million within six hours. Of that, $24 million fell on AFX Trade, where attackers took control of validator keys. Among other attacks, the quarter is remembered for $319 million at Liquid Network, at least $75 million at Tectonic and roughly $114 million in Coldcard wallet software, a tool for Bitcoin.

And what about wallets that users keep themselves?

A hardware wallet stores keys offline, and for a long time that was seen as a reliable scheme. This week Ledger said it found a hidden spy implant in a device sold by the Southeast Asian reseller CryptoBilis. Losses reached about $93 million.

The weak spot here is neither code nor an exchange but the route the device took to its owner. No smart contract audit can see that.

What to check instead of an audit badge?

Hacken argues that responsibility lies with companies that hold customer money. They have to track vulnerabilities and install fixes at once, rather than lean on a review done months or years ago.

For a user, that translates into plain questions for any service. What exactly was in the audit scope? When was it done? Is it known who holds the administrative keys? If there is no answer, the badge on the website says little about real risk.