Hacken Q3 crypto losses hit $1.18B; Cysic bridge breaks
Hackers took $1.18 billion in the third quarter, Hacken says, and most of it came through systems audits never examined. A bridge exploit at Cysic followed on Saturday.
Hacken Q3 crypto losses came to $1.18 billion across 107 incidents between July and September, up 55% from the second quarter, according to the security firm's latest report. Its central finding is uncomfortable for anyone who trusts an audit badge: most of the money left through parts of a system that nobody had reviewed.
What happened
Of the total, $906.8 million was lost through compromised suppliers or developer tools, published fixes that were never installed, or components left outside the latest security review, CoinDesk reported. Smart contract exploits made up 48% of losses, up from 12% in the second quarter, while access control and operational failures fell to 40% from 88%. Regulators worldwide issued $450,000 in fines to crypto service providers.
The largest incident was the September attack on Bitget, which lost at least $352 million after attackers used a flaw in a third-party security product, a breach we covered in Bitget's zero-day investigation. Liquid Network lost $319 million, Coldcard wallet software about $114 million and Tectonic at least $75 million. A six-hour July exploit drained more than $35 million from three bridges and cross-chain protocols, with AFX Trade accounting for $24 million.
Hacken also reviewed 12 derivatives exchanges and prediction markets and found more than $700 million at two major venues depended on a three-of-four signing setup or on admin keys held by unnamed people. It did not name the venues and said it knew of no live bug.
Why it matters
"The problem is always scope," Hacken co-founder Andrii Matiukhin told CoinDesk. Teams pay to audit the most critical contracts and skip wallets, signers and third-party software, which is exactly where attackers go. "Usually, when a customer sees a new project, they see an audit badge, assume the whole system is covered, and lose money through a key, a supplier, or a setting that was never tested," he said.
Slow patching is the other gap behind the Hacken Q3 crypto losses. Matiukhin said teams sometimes classify a critical vulnerability as low and delay or even decline the fix, a bigger problem when several blockchains share the same software but update it at different times.
The weekend showed the pattern again. Cysic's cross-chain bridge was halted after an attacker minted 10 million CYS on BNB Smart Chain at 12:31:38 UTC on Oct. 17. Early findings, the foundation said, suggest an intruder got into a database used by the bridge's services. Cysic blacklisted the address at 13:47:52 UTC, freezing about 2.8 million CYS that remained there, against roughly 160.8 million tokens in circulation.
By then the attacker had sold 5.65 million CYS for 588,315 USDT and another 1.55 million for about 220 BNB, then moved the proceeds to Ethereum, where the wallet held roughly 306.6 ETH, or about $727,000, Cointicker reported. Cysic said its mainnet was unaffected and existing user balances were not stolen.
What's next
An outside security firm, not yet named, is investigating, and Cysic has promised a follow-up with a verified loss figure. Bridge transfers stay paused until the review ends.
For the wider market, the Hacken report argues responsibility rests with whoever holds customer funds: track vulnerabilities, patch fast and widen audit scope. Hardware is in the frame too, after the Ledger CryptoBilis reseller losses. If fourth-quarter numbers look like Hacken Q3 crypto losses, pressure will grow for audits that cover keys and suppliers, not just contracts.
This article is for information only and is not investment advice.