Hacken flags audit badge risks as Q3 crypto losses reach $1.18 billion

Hacken flags audit badge risks as Q3 crypto losses reach $1.18 billion
Audit badges under fire

Rising crypto theft in the third quarter is sharpening scrutiny of how security reviews are presented to investors. Hacken says many audit claims cover only limited parts of a platform, leaving critical systems such as signing keys, wallets and third-party software outside review.

Highlights

  • Hackers stole $1.18 billion across 107 incidents in Q3, up 55% from the previous quarter, according to Hacken.
  • Hacken reports $906.8 million of Q3 losses stemmed from compromised suppliers, unpatched public security fixes, or unaudited components.
  • Hacken warns that audit badges can be misleading, as many audits cover only selected smart contracts and leave crucial systems unexamined.

Quarterly losses highlight limits of audit scope

As reported by CoinDesk, blockchain security firm Hacken says crypto investors may be placing too much trust in security audits that do not cover the systems attackers most often exploit.

In a report released on Thursday, the company says hackers stole $1.18 billion across 107 incidents in the third quarter, up 55% from the previous quarter. Hacken says $906.8 million of that total came from compromised suppliers or developer tools, publicly available security fixes that were not installed, or components excluded from the latest security review.

Andrii Matiukhin, co-founder and board director at Hacken, says the central issue is audit scope. He says reviewing every component that interacts with funds or affects a platform's economics is costly, and some teams reduce coverage by auditing only what they see as the most critical parts of a service.

Investor expectations and sector implications

The findings add to concerns about how much protection investors can reasonably infer when a crypto project markets itself as audited. Hacken says customers often assume an audit applies to an entire platform, even when the review is limited to specific smart contracts.

That gap can leave important attack surfaces unexamined, including wallets, signing systems and outside software providers. For the broader crypto sector, the report points to operational security and vendor management as continuing weak points, even when projects display audit badges as a sign of credibility.

Our earlier article on Q3 cybersecurity funding showed that investor appetite for the sector stayed strong, with global cybersecurity and privacy startups raising $6.8 billion mainly on the back of larger late-stage rounds despite fewer deals overall. We also noted accelerating consolidation through major acquisitions, underscoring how security risks and new attack pressures are keeping cybersecurity a top spending and investment priority.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.