Q3 Crypto Hacks Reached $1.18B as Smart Contract Exploits Surge
Security firm Hacken recorded $1.18 billion in losses across 107 incidents during the third quarter, with smart contract exploits accounting for a larger share of theft than in prior quarters. Three-quarters of losses involved compromised suppliers, delayed security patches, or systems outside the scope of recent audits.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Q3 Losses and Incident Volume
Hacken documented $1.18 billion in cryptocurrency theft across 107 separate incidents between July and September, according to the firm's latest quarterly report. Smart contract exploits accounted for a larger portion of total losses compared to the prior quarter, though Hacken did not disclose the specific breakdown or prior-quarter comparison in the available reporting.
The Audit Gap
Hacken found that 77% of third-quarter losses involved compromised suppliers, delayed security fixes, or systems that operated outside the scope of the latest security reviews. The finding undercuts the common investor assumption that a recent audit credential provides meaningful assurance. Many protocols conduct audits on a fixed schedule rather than continuously, and third-party audit firms typically do not re-review code between formal engagements or cover all external dependencies a protocol relies on.
What the Numbers Signal
The $1.18 billion figure represents a single quarter of losses from a subset of publicly disclosed incidents. The underlying data suggests that audit freshness and supplier risk management are often inadequate relative to the attack surface projects actually expose. Projects that underwent audits months or years prior, or that depend on third-party bridges and integrations not covered by their formal security reviews, remained vulnerable to the incidents Hacken tracked.
Why It Matters
For Traders
Smart contract exploits remain a material source of token volatility; positions in protocols with stale audits or unaudited dependencies carry hidden tail risk.
For Investors
The 77% figure suggests that audit credentials alone are insufficient due diligence; multi-month or multi-year-old reviews provide false confidence when code or dependencies change.
For Builders
Continuous auditing, bug bounties, formal verification, and supplier vetting are cheaper than recovering from a $100M+ exploit or the reputational damage that follows.
This article is for information only and is not financial advice. Read the full disclaimer.
