Crypto hacks surge 55% to $1.2B, but key theft drops by 30%

Hacken's third-quarter crypto hack total rose to $1.18 billion while the losses implied by its access-control and operational figures fell about 30%.

The crypto security firm's Oct. 15 disclosure reports a 55% increase in total theft for July-September compared with the second quarter.

The change included 48% more losses from smart contracts in the third quarter, up from about 11% in Hacken's original second-quarter summary. More incidents, alongside a slightly smaller mean recorded loss per incident, also distinguish the two quarters. The figures challenge a fixed security hierarchy that makes custody operations the overriding priority.

Bitget's September report showed forged withdrawal instructions without private-key compromise, while Liquid's report from the same month accepted invalid assets before a genuine authorization process released Bitcoin against them.

What changed across Hacken's quarters

Hacken's second-quarter summary recorded $763.9 million extracted across 67 incidents, attributing 88.3% of losses to compromised keys, signers, and infrastructure.

Multiplying those figures gives approximately $675 million, while applying the 40% share for the third quarter to $1.18 billion gives approximately $472 million, about 30% less.

The third-quarter report calls its category access-control and operational failures, while the second-quarter report describes operational failures.

The third-quarter 48% share implies about $566 million, compared with roughly $84 million using the second-quarter original 11% share.

That discrepancy, rounded inputs, and uncertain detailed category comparability rule out a precise growth multiple, but the published mix points to much heavier contract losses.

The overall increase also looks different when separated into incident frequency and average severity. Recorded incidents rose from 67 to 107, so dividing the published totals by those counts gives an arithmetic mean of roughly $11.4 million in the second quarter and $11 million in the third quarter. More incidents can lift an aggregate even when the arithmetic mean falls.

Hacken attributed 75.5% of the second-quarter losses to just two incidents, at Drift Protocol and KelpDAO. Smart contract bugs appeared in 44 of that quarter's 67 incidents while accounting for only about 11% of lost value.

A falling category total can coexist with frequent failures and continued potential for severe losses. Establishing improved controls would require comparable exposure and evidence of which safeguards held or failed.

A category's share of past damage helps explain a period, while its importance to a particular institution depends on that institution's exposure and control processes.

How Bitget and Liquid lost control of crypto withdrawals

Bitget's Sept. 30 investigation update said compromised third-party security products enabled unauthorized access to its exchange wallet environment in the Sept. 24 incident.

Its account update on Oct. 14 describes attackers obtaining high-privilege internal credentials and injecting forged withdrawal commands.

Bitget says private-key compromise was ruled out and cold wallets were unaffected. The exchange says compromised privileged credentials nevertheless enabled forged withdrawal instructions. That finding distinguishes the signing key from the processes allowed to request its use.

This is an operational authorization problem, and the question is how a withdrawal request earns permission to move funds, including what the system accepts as trusted internal activity. A custody design can protect the key while still allowing a compromised upstream process to ask for the wrong transfer.

Bitget's initial notice estimated approximately $351.6 million affected, and its Sept. 25 update raised that to about $387.5 million after including additional assets. The October account puts the final verified affected amount at approximately $388 million.

Bitget attributes those revisions to fuller accounting of the original unauthorized transfers. The revisions describe the original Sept. 24 transfers more completely, and illustrate how an initial crypto theft estimate and an eventual net loss can answer different questions.

In its Sept. 23 assessment, Blockstream said an Elements range-proof cache defect allowed approximately 4,000 unbacked liquid staking token LBTC to pass validation.

In effect, nodes reused a record of a successful check for a transaction that should have failed. Blockstream traced the defect to a cache-bug fix that added missing fields without unambiguous length framing.

Different arrangements of the fields could produce the same input bytes, allowing an invalid proof to reuse a cached valid result.

SideSwap, which processed the peg-out converting LBTC into BTC, acknowledged that it handled the roughly 4,000-LBTC order automatically without size, velocity, or wallet-history checks. It said online keys and automatic forwarding removed a manual opportunity to hold the released Bitcoin.

Blockstream said the peg-out authorization key was not stolen or forged, and the authorization operated on assets the network had already incorrectly accepted. SideSwap likewise said no key, wallet or system of its own was compromised.

Bitget and Liquid suffered September crypto-related losses through separate failures in authorization, validation and operational controls.

The sequence crossed two security boundaries: whether the assets were valid and whether they could be released. A pause, limit or review in the withdrawal process could have provided another opportunity to interrupt the transfer after validation failed.

Liquid's outcome depended on both the validation defect that created the assets and the operational process that let Bitcoin leave.

Recovered funds and protected balances answer different questions

Blockstream's September assessment recorded 3,400 BTC returned on Sept. 7 and approximately 602 BTC outstanding at the report date.

Bitget says user balances were unaffected, its Protection Fund covers the incident's financial impact, and phased withdrawals reopened on Oct. 2. Those statements, in its Oct. 14 account update, address customer balances, financial coverage, and service access.

Bitget makes the integrity of withdrawal instructions central. Liquid makes asset validation central, while SideSwap's role shows why operational checkpoints still matter after validation fails. Together, they support testing the full path from an asset's validity to permission to release it.

New quarterly mix adds another constraint: an institution cannot choose its most important safeguard from the previous quarter's largest loss category alone. The practical question is which independent checkpoints can interrupt the release path when an earlier safeguard fails.