Hacken Puts Q3 Losses at $1.18B and Points at Audit Scope

A quarterly accounting of crypto theft came with an argument attached. Hacken counted $1.18 billion stolen across 107 incidents in the third quarter, 55% more than in the second, and said most of it did not come from bugs nobody had found. $906.8 million of that total came out of compromised suppliers and developer tools, published fixes that were never installed, or parts of a system left outside the most recent security review. CoinDesk, which carried the report at 13:00 UTC on Sunday, put that share at 77%. The firm's case is about what a security review covers, not about what researchers missed.

Scope, not discovery

Andrii Matiukhin, a Hacken co-founder and board director, said reviews are usually written around specific smart contracts while wallets, signing systems and third-party software stay outside the brief. Customers read the result as a verdict on everything.

"Usually, when a customer sees a new project, they see an audit badge, assume the whole system is covered," Matiukhin told CoinDesk.

He put the cause in four words. "The problem is always scope," he said, adding that reviewing every component touching funds or protocol economics is expensive. He also described severity grades set too low: "Sometimes a critical vulnerability is classified as low by the team, and fix implementation is delayed or even declined." Watching for new vulnerabilities and installing fixes promptly is the job of the company holding customer money, in his account, and an audit dated months earlier does not do it.

Twelve venues, two of them thin

Hacken examined 12 derivatives and prediction-market venues for the report. At two of them, more than $700 million in assets depended either on a four-key signing arrangement that releases funds on three signatures, or on administrative keys whose holders are not publicly identified. Matiukhin declined to name the venues before publication, and he was careful about what the finding is not. "We are not aware of a live bug in the systems of any reviewed venue," he said. What the review turned up instead, in his words, is "setups where key setups are not secure enough considering the scale of the venues reviewed." That is a judgment about proportion, and it rests on Hacken's reading alone.

The totals do not match

CertiK published its own third-quarter count on 2 October and landed somewhere else: $1.26 billion across 247 incidents, up 53.9% from $819.4 million in the second quarter. Direction and rough scale agree with Hacken's. The levels do not. The two counts are $80 million apart and the incident numbers differ by 140, which says more about what each firm treats as a single incident than about the quarter itself. Neither published account mentions the other. A month earlier PeckShield and CertiK closed August $79 million apart in the same way.

Where the single cases land

The gap repeats inside individual incidents. Hacken puts September's Bitget theft at at least $352 million. CertiK's quarter counted $387.5 million for it, about 31% of its total, while the exchange's own postmortem gave $388 million and traced the entry to a flaw in a supplier's security product. Three figures for one event, none reconciled. Tectonic diverges further, at least $75 million in Hacken's account against $120 million in CertiK's. On the Liquid Network exploit of 6 September the two firms agree, at $319 million. Coldcard's wallet software sits at about $114 million in one and $112.7 million in the other, close enough to be one event measured twice.

The quarter also takes in hardware interfered with before it reached buyers. Ledger traced an unauthorised implant in a device sold by a Southeast Asian reseller, with losses it put near $93 million, an account that has so far appeared in one place. If Hacken is right about scope, next quarter's number turns less on what researchers find than on whether companies holding customer funds install what has already been published. The reviewed venues stay unnamed. Until that changes, the $700 million finding cannot be checked by anyone outside the firm.