Crypto hacks reached $1.18 billion in Q3 as code flaws grew

What happened

Security firm Hacken put crypto theft in the third quarter at $1.18 billion across 107 incidents from July through September. The total was 55% above the prior quarter. Its quarterly review draws on incident records and project disclosures. Activity rose even as the average loss per case eased. The picture is one of more frequent attacks rather than one dominant breach.

The mix shifted toward code. Smart-contract flaws made up 48% of stolen value, against 12% in the earlier quarter. Access-control and operation failures stood at 40%, down from 88%. Hacken said the largest single losses still tied to supply-chain intrusions, exposed keys and weak signer and withdrawal systems, while code flaws drove a high count of smaller events.

September examples show process failures without stolen keys. Bitget reported that compromised outside security products allowed entry to its wallet environment, then said intruders gained high-privilege credentials and sent forged withdrawal orders. It said private-key theft was ruled out and cold storage was untouched. Liquid reported that it accepted faulty assets before a legitimate approval step released Bitcoin. Both point to authorization gaps.

Why it matters

The shift matters because audits alone do not stop theft. A review can catch defects in one contract but cannot secure signing steps, deployment tools and outside software around it. Hacken pointed to repeat methods and cases where fixes were public before the exploit. Teams that treat a single check as lasting proof leave surrounding systems exposed.

For users, the lesson is to look past a badge. The scope of a review, its date and whether issues were fixed count as much as completion. Key custody and withdrawal controls remain vital even when code flaws dominate totals. Risk depends on a project's own setup and whether safeguards held under attack.

What the data shows

The prior quarter recorded $763.9 million taken in 67 incidents, with 88.3% tied to keys, signers and infrastructure. Events at Drift Protocol and KelpDAO made up 75.5% of that period's losses. Bugs in contracts showed up in 44 of the 67 cases but made only about 11% of value. Means were roughly $11.4 million then and $11 million now, while access-control implied losses fell about 30%.

Background

Hacken also warned that known issues keep getting exploited. Some attacks used methods seen before, and patches were available before funds moved. That pattern favors ongoing monitoring over one-time testing. It also means past shares explain a period but do not set a fixed order for what a specific team should protect first.

What is still unclear

• It remains unclear how closely second- and third-quarter categories align, as labels differ and inputs are rounded.

Questions readers ask