Crypto hacks surge 55% to $1.2B, but key theft drops by 30% - CryptoSlate
Crypto hacks surged 55% to $1.18 billion in the third quarter, while losses from key theft dropped approximately 30%, according to Hacken's latest security report.
Crypto hacks surged 55% to $1.18 billion in the third quarter, while losses from key theft dropped approximately 30%, according to Hacken's latest security report. The security firm's Oct. 15 disclosure reveals a significant shift in attack methods, with smart contract-related losses increasing dramatically from 11% in Q2 to 48% in Q3.
The total number of recorded incidents rose from 67 in Q2 to 107 in Q3, though the average loss per incident remained relatively stable at approximately $11 million. This surge in activity challenges traditional security hierarchies that prioritize custody operations above all else.
Changing attack patterns
Hacken's analysis shows that while total hack value increased, the composition of losses shifted significantly. In Q2, 88.3% of losses were attributed to compromised keys, signers, and infrastructure. In Q3, this category (now termed 'access-control and operational failures') accounted for approximately 40% of losses, suggesting attackers are diversifying their methods.
The third quarter saw 48% more losses from smart contracts compared to the previous quarter. This shift indicates that while private key compromises remain a concern, vulnerabilities in smart contract code are becoming increasingly lucrative targets for attackers.
Bitget's operational failure
Bitget's September 24 incident, which resulted in approximately $388 million in losses, highlights the growing importance of operational security. The exchange reported that attackers obtained high-privilege internal credentials and injected forged withdrawal commands, without compromising private keys or affecting cold wallets.
Private-key compromise was ruled out and cold wallets were unaffected. The exchange says compromised privileged credentials nevertheless enabled forged withdrawal instructions.
Liquid's validation vulnerability
Separately, Liquid suffered losses due to a validation defect in Blockstream's Elements range-proof cache, which allowed approximately 4,000 unbacked Liquid Staking Tokens (LBTC) to pass validation. SideSwap, which processed the peg-out converting LBTC into BTC, acknowledged it handled the order automatically without proper checks.
Blockstream traced the defect to a cache-bug fix that added missing fields without unambiguous length framing. Both Blockstream and SideSwap maintained that no keys, wallets, or systems were compromised, emphasizing that the authorization operated on assets the network had already incorrectly accepted.
Reevaluating security priorities
These incidents demonstrate that security cannot be reduced to protecting private keys alone. The Bitget case shows how operational authorization processes can be exploited even when keys remain secure, while the Liquid incident reveals how validation failures can create vulnerabilities that operational checkpoints fail to catch.
As Hacken's quarterly report suggests, institutions cannot determine their most critical safeguards based solely on the previous quarter's largest loss category. The practical question now becomes: which independent checkpoints can interrupt the release path when earlier safeguards fail?
Bitget has reopened phased withdrawals since October 2, with its Protection Fund covering the financial impact, while Blockstream reported that 3,400 BTC were returned with approximately 602 BTC still outstanding at the time of their assessment.
Related
