Crypto security firm Hacken released its third-quarter report on October 15, documenting $1.18 billion in total theft across the crypto sector for July through September, representing a 55% increase from the second quarter's $763.9 million.
The composition of losses shifted significantly between quarters. While overall theft rose, losses attributed to compromised keys, signers, and infrastructure fell approximately 30%, dropping from 88.3% of Q2 losses to 40% of Q3 losses. Smart contract vulnerabilities accounted for 48% of Q3 losses compared with 11% in Q2.
The number of reported incidents increased from 67 in Q2 to 107 in Q3. The arithmetic mean loss per incident remained relatively flat at roughly $11.4 million in Q2 and $11 million in Q3, indicating that higher aggregate losses stemmed partly from increased incident frequency rather than larger individual attacks.
Bitget and Liquid authorization failures
Two major exchanges experienced September incidents rooted in authorization and validation failures rather than direct key theft.
Bitget's September 24 incident involved compromised third-party security products that granted attackers high-privilege internal credentials. Attackers used these credentials to inject forged withdrawal commands. Bitget's investigation confirmed that private keys were not compromised and cold wallets remained unaffected. The exchange initially reported approximately $351.6 million affected, later revised to $388 million following fuller accounting of unauthorized transfers. Bitget stated user balances were protected through its Protection Fund, and phased withdrawals reopened on October 2.
Liquid's September incident involved a validation defect in Elements, a cache bug that allowed approximately 4,000 unbacked liquid staking tokens to pass validation checks. SideSwap, which processed the conversion of these tokens to Bitcoin, acknowledged handling the order automatically without size, velocity, or wallet-history checks. Blockstream confirmed the authorization key was not stolen or forged. By September 7, 3,400 BTC had been returned, with approximately 602 BTC outstanding at the report date.
Shifting risk landscape
Both incidents underscored that security depends on multiple independent checkpoints across validation, authorization, and operational processes. Neither incident involved direct key compromise, reflecting a broader shift in Q3 where smart contract vulnerabilities and operational failures represented a larger share of total losses than in previous quarters.
