Crypto asset thefts jumped 55% between July and September 2026 compared to the second quarter. Security research firm Hacken reported that cybercriminals drained $1.18 billion across 107 incidents during the three-month period. However, the sheer amount stolen was not the central issue.
A total of 77% of third-quarter losses, or around $906.8 million, stemmed from elements outside the scope of project audits. The hundreds of millions of dollars in losses originated from compromised developer tools, external vendors, components deliberately omitted from testing, and delayed software patches.
Why So Many Vulnerabilities Slip Past Audits
Many investors assume an audit stamp guarantees a platform’s complete security. That assumption is flawed. Auditors often review only specific smart contract code provided by developers. Crucial components such as transaction signing systems, storage wallets, and third-party software frequently escape testing altogether.
Cost is the primary driver behind cutting the scope of testing. Hacken co-founder Andrii Matiukhin explained that the expense of comprehensive audits strains developer treasuries. “The problem is always about scope. It is expensive to audit all components that interact with funds, so teams cut costs by only auditing critical parts,” Matiukhin said. As a result, the main vault door receives double locks, but side windows are left open and unguarded.
Entry Points From External Vendors and Resellers
The two largest breaches in the third quarter highlighted the fragility of technology supply chains. Bitget suffered losses of at least $352 million in September 2026. Attackers breached the exchange by exploiting a vulnerability in a third-party security product installed on its network. The flaw resided in partner software, not in the exchange’s main contract.
Physical distribution channels were also not spared from tampering. Hardware wallet manufacturer Ledger detected unauthorized spyware implants in units distributed by reseller partner CryptoBilis in Southeast Asia. Unauthorized modifications to the physical devices led to roughly $93 million in losses for buyers. The breaches occurred even before owners had the chance to use their wallets to transact.
Anonymous Admin Keys and Neglected Patches
Hacken uncovered similar vulnerabilities when examining a dozen derivatives exchanges and prediction markets. Across two major trading venues, customer deposits worth more than $700 million were protected only by a three-of-four multisig scheme. On those platforms, admin key holders were not even publicly disclosed, leaving control of funds centralized among anonymous parties without public accountability.
The situation is further worsened by teams routinely delaying security fixes. Matiukhin pointed to deferred vulnerability patches as another major threat. Many blockchains share similar software codebases, yet update their systems on differing schedules. This creates an easy target for hackers to focus on the networks slowest to deploy fixes.
Hacken stressed that entities managing customer funds should actively monitor threats and promptly deploy security patches, rather than hiding behind outdated audit reports. For investors, an audit logo on a project’s homepage is no longer definitive proof that their assets are protected. An audit report completed months ago is of little use when developers neglect the entry points to their ecosystem.
Reported by CoinDesk.
Also read: Google Cuts Quantum Error Rate 40-Fold - Bitcoin Encryption Now Requires Fewer Than 500,000 Qubits
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
