Crypto audits might give investors a false sense of security as Q3 hacks led to $1.18 billion in losses, according to Hacken

The security firm found that 77% of third-quarter losses involved compromised suppliers, delayed fixes or systems outside the latest security reviews. According to Hacken, the cryptocurrency industry lost about $1.18 billion across 107 security incidents in Q3 2026, a 55% increase from the previous quarter. The findings challenge the assumption that an audited project is necessarily a safe investment. The report also challenges the widespread assumption that projects with completed security audits are necessarily safer investments. Although audits remain an important part of blockchain security, their effectiveness depends on the scope of the review and whether projects continue to maintain their systems after deployment.

Crypto Security Losses Highlight the Limits of Audits

Smart contract audits are designed to identify weaknesses in blockchain applications before attackers can exploit them. Independent security researchers examine code for vulnerabilities involving access controls, transaction logic, unauthorized transfers, and other potential attack vectors.

However, an audit generally covers a specific version of a project’s code and a defined set of components. Changes introduced after the review may create new vulnerabilities, while external services and operational infrastructure may remain outside the original audit’s scope.

This creates a gap between what an audit verifies and what investors may assume it guarantees.

A protocol could pass a smart contract audit while remaining vulnerable to compromised administrative keys, insecure third-party software, manipulated price oracles, or weaknesses in its withdrawal infrastructure. In these circumstances, the underlying contracts may operate as designed while the broader system remains exposed.

The distinction is important because blockchain platforms often depend on several interconnected components. Reviewing individual contracts does not necessarily establish that the entire system can withstand an attack.

Third-Party Vulnerabilities and Operational Failures Drive Losses

One of the most significant findings in Hacken’s report is that approximately $906.8 million of the reported Q3 losses involved compromised suppliers or developer tools, publicly available security fixes that had not been installed, or components excluded from the latest security review.

That figure represents roughly 77% of the quarter’s total reported losses. The findings point to several weaknesses that extend beyond conventional smart contract vulnerabilities.

Third-party dependencies can introduce risks when protocols rely on external software, infrastructure providers, or security products. If an attacker compromises one of these services, the resulting breach may affect a platform even when its own contracts have been reviewed.

Delayed patching presents another challenge. Security researchers may identify a vulnerability and publish a fix, but the risk remains if a project fails to implement the update promptly. The longer a known vulnerability remains unaddressed, the greater the opportunity for attackers to exploit it.

Incomplete security reviews can also leave critical components unchecked. A protocol may commission an audit of its smart contracts without conducting an equally thorough assessment of its administrative controls, signing infrastructure, and external integrations.

Together, these issues demonstrate why security requires continuous maintenance rather than a one-time review.

Major Incidents Demonstrate the Risks of Incomplete Security

The incidents highlighted in the reporting illustrate how different weaknesses can result in substantial financial losses.

Bitget reportedly suffered losses of at least $352 million in an incident linked to a vulnerability in a third-party security product that affected withdrawal infrastructure. The case underscores the risks associated with external dependencies and systems responsible for authorizing asset transfers.

Liquid Network also experienced a reported incident involving approximately $319 million. The event highlights the importance of examining the mechanisms governing asset issuance, validation, and withdrawals, rather than focusing exclusively on application-level smart contracts.

Meanwhile, AFX Trade reportedly lost approximately $24 million after attackers gained control of validator keys. The incident illustrates how compromised signing authority can undermine a system’s security even when its underlying blockchain continues to operate.

These cases represent different attack surfaces, but they share an important characteristic: protecting cryptocurrency assets requires more than identifying vulnerabilities in application code.

For exchanges, bridges, and DeFi protocols, security depends on the combined effectiveness of software, access permissions, key management, and operational procedures.

Smart Contract Exploits Remain a Significant Threat to DeFi

Hacken’s report reveals that smart contract exploits accounted for 48% of losses in Q3, which is a big jump from 12% in Q2. On the other hand, access-control and operational failures represented 40% of losses, down quite a bit from 88% in the previous quarter.

These figures suggest a changing distribution of attack methods rather than the disappearance of operational risks.

Smart contract vulnerabilities can allow attackers to manipulate balances, exploit flawed transaction logic, or withdraw assets without authorization. In DeFi, the consequences can spread rapidly because protocols often connect lending markets, decentralized exchanges, liquidity pools, and other financial applications.

Oracle manipulation provides one example. A lending protocol may have audited borrowing and repayment contracts, but an attacker who manipulates the price feed could distort collateral valuations and extract funds. The contracts may execute according to their programmed rules while the information guiding those rules is compromised.

Cross-chain bridges face similar challenges. Their security can depend on validator arrangements, message verification, and private-key management. A vulnerability in these mechanisms may expose substantial assets even when other parts of the system have been reviewed.

For protocols holding large amounts of user capital, continuous monitoring and clearly defined emergency procedures are therefore essential.

What Crypto Investors Should Check Beyond an Audit

Investors evaluating a cryptocurrency project should treat an audit as one component of due diligence rather than definitive proof of security.

The first step is to examine the audit’s scope and date. Investors should determine which contracts and code versions were reviewed and whether subsequent upgrades have undergone additional assessments.

Unresolved vulnerabilities also deserve attention. A published audit does not necessarily mean every identified issue has been corrected. Investors should look for evidence that significant findings were addressed and that the fixes were independently verified.

Administrative permissions are another important consideration. Understanding who controls upgrade keys, validator keys, and emergency functions can help investors assess whether a small number of individuals or compromised accounts could put user funds at risk.

Third-party dependencies should also be evaluated. Protocols relying on external oracles, bridges, infrastructure providers, or developer tools inherit risks from those systems.

Finally, investors should examine whether the project has active security monitoring, a credible incident-response process, and mechanisms to limit damage when an exploit occurs. Emergency pauses and withdrawal restrictions may reduce losses in some circumstances, although they introduce their own governance and centralization trade-offs.

No assessment can eliminate investment risk, but examining these factors provides a more complete picture than relying on an audit badge alone.

The Case for Continuous Crypto Security Monitoring

Hacken’s findings could reinforce calls for stronger security requirements across cryptocurrency businesses and blockchain applications. Regulators and institutional investors increasingly have reasons to examine whether security controls remain effective after deployment, rather than simply confirming that a review occurred at one point in time.

For centralized exchanges and custodial platforms, this may involve closer scrutiny of withdrawal authorization, private-key protection, supplier security, and incident reporting. For decentralized protocols, responsibility can be more difficult to establish because developers, foundations, administrators, and governance participants may control different parts of the system.

Comprehensive reviews and continuous monitoring also create costs, particularly for smaller projects. Nevertheless, reducing security coverage to save money can leave vulnerabilities in critical components undiscovered or unresolved.

A more effective approach combines independent audits with regular code reviews, timely security patches, access-control safeguards, dependency assessments, and tested incident-response plans. The report challenges the widespread assumption that projects with completed security audits are necessarily safer investments. Although audits remain an important part of blockchain security, their effectiveness depends on the scope of the review and whether projects continue to maintain their systems after deployment.

Crypto Security Losses Highlight the Limits of Audits

Smart contract audits are designed to identify weaknesses in blockchain applications before attackers can exploit them. Independent security researchers examine code for vulnerabilities involving access controls, transaction logic, unauthorized transfers, and other potential attack vectors.

However, an audit generally covers a specific version of a project’s code and a defined set of components. Changes introduced after the review may create new vulnerabilities, while external services and operational infrastructure may remain outside the original audit’s scope.

This creates a gap between what an audit verifies and what investors may assume it guarantees.

A protocol could pass a smart contract audit while remaining vulnerable to compromised administrative keys, insecure third-party software, manipulated price oracles, or weaknesses in its withdrawal infrastructure. In these circumstances, the underlying contracts may operate as designed while the broader system remains exposed.

The distinction is important because blockchain platforms often depend on several interconnected components. Reviewing individual contracts does not necessarily establish that the entire system can withstand an attack.

Third-Party Vulnerabilities and Operational Failures Drive Losses

One of the most significant findings in Hacken’s report is that approximately $906.8 million of the reported Q3 losses involved compromised suppliers or developer tools, publicly available security fixes that had not been installed, or components excluded from the latest security review.

That figure represents roughly 77% of the quarter’s total reported losses. The findings point to several weaknesses that extend beyond conventional smart contract vulnerabilities.

Third-party dependencies can introduce risks when protocols rely on external software, infrastructure providers, or security products. If an attacker compromises one of these services, the resulting breach may affect a platform even when its own contracts have been reviewed.

Delayed patching presents another challenge. Security researchers may identify a vulnerability and publish a fix, but the risk remains if a project fails to implement the update promptly. The longer a known vulnerability remains unaddressed, the greater the opportunity for attackers to exploit it.

Incomplete security reviews can also leave critical components unchecked. A protocol may commission an audit of its smart contracts without conducting an equally thorough assessment of its administrative controls, signing infrastructure, and external integrations.

Together, these issues demonstrate why security requires continuous maintenance rather than a one-time review.

Major Incidents Demonstrate the Risks of Incomplete Security

The incidents highlighted in the reporting illustrate how different weaknesses can result in substantial financial losses.

Bitget reportedly suffered losses of at least $352 million in an incident linked to a vulnerability in a third-party security product that affected withdrawal infrastructure. The case underscores the risks associated with external dependencies and systems responsible for authorizing asset transfers.

Liquid Network also experienced a reported incident involving approximately $319 million. The event highlights the importance of examining the mechanisms governing asset issuance, validation, and withdrawals, rather than focusing exclusively on application-level smart contracts.

Meanwhile, AFX Trade reportedly lost approximately $24 million after attackers gained control of validator keys. The incident illustrates how compromised signing authority can undermine a system’s security even when its underlying blockchain continues to operate.

These cases represent different attack surfaces, but they share an important characteristic: protecting cryptocurrency assets requires more than identifying vulnerabilities in application code.

For exchanges, bridges, and DeFi protocols, security depends on the combined effectiveness of software, access permissions, key management, and operational procedures.

Smart Contract Exploits Remain a Significant Threat to DeFi

Hacken’s report also indicates that smart contract exploits accounted for 48% of losses in Q3, compared with 12% in Q2. Access-control and operational failures represented 40%, down from 88% in the previous quarter.

These figures suggest a changing distribution of attack methods rather than the disappearance of operational risks.

Smart contract vulnerabilities can allow attackers to manipulate balances, exploit flawed transaction logic, or withdraw assets without authorization. In DeFi, the consequences can spread rapidly because protocols often connect lending markets, decentralized exchanges, liquidity pools, and other financial applications.

Oracle manipulation provides one example. A lending protocol may have audited borrowing and repayment contracts, but an attacker who manipulates the price feed could distort collateral valuations and extract funds. The contracts may execute according to their programmed rules while the information guiding those rules is compromised.

Cross-chain bridges face similar challenges. Their security can depend on validator arrangements, message verification, and private-key management. A vulnerability in these mechanisms may expose substantial assets even when other parts of the system have been reviewed.

For protocols holding large amounts of user capital, continuous monitoring and clearly defined emergency procedures are therefore essential.

What Crypto Investors Should Check Beyond an Audit

Investors evaluating a cryptocurrency project should treat an audit as one component of due diligence rather than definitive proof of security.

The first step is to examine the audit’s scope and date. Investors should determine which contracts and code versions were reviewed and whether subsequent upgrades have undergone additional assessments.

Unresolved vulnerabilities also deserve attention. A published audit does not necessarily mean every identified issue has been corrected. Investors should look for evidence that significant findings were addressed and that the fixes were independently verified.

Administrative permissions are another important consideration. Understanding who controls upgrade keys, validator keys, and emergency functions can help investors assess whether a small number of individuals or compromised accounts could put user funds at risk.

Third-party dependencies should also be evaluated. Protocols relying on external oracles, bridges, infrastructure providers, or developer tools inherit risks from those systems.

Finally, investors should examine whether the project has active security monitoring, a credible incident-response process, and mechanisms to limit damage when an exploit occurs. Emergency pauses and withdrawal restrictions may reduce losses in some circumstances, although they introduce their own governance and centralization trade-offs.

No assessment can eliminate investment risk, but examining these factors provides a more complete picture than relying on an audit badge alone.

The Case for Continuous Crypto Security Monitoring

Hacken’s findings could reinforce calls for stronger security requirements across cryptocurrency businesses and blockchain applications. Regulators and institutional investors increasingly have reasons to examine whether security controls remain effective after deployment, rather than simply confirming that a review occurred at one point in time.

For centralized exchanges and custodial platforms, this may involve closer scrutiny of withdrawal authorization, private-key protection, supplier security, and incident reporting. For decentralized protocols, responsibility can be more difficult to establish because developers, foundations, administrators, and governance participants may control different parts of the system.

Comprehensive reviews and continuous monitoring also create costs, particularly for smaller projects. Nevertheless, reducing security coverage to save money can leave vulnerabilities in critical components undiscovered or unresolved.

A more effective approach combines independent audits with regular code reviews, timely security patches, access-control safeguards, dependency assessments, and tested incident-response procedures.