Crypto hacks surge 55% to $1.2B, but key theft drops by 30%

Hacken's third-quarter crypto hack total rose to $1.18 billion while the losses implied by its access-control and operational figures fell about 30%.

The crypto security firm's Oct. 15 disclosure reports a 55% increase in total theft for July-September compared with the second quarter.

The change included 48% more losses from smart contracts in the third quarter, up from about 11% in Hacken's original second-quarter summary. More incidents, alongside a slightly smaller mean recorded loss per incident, also distinguish the two quarters. The figures challenge a fixed security hierarchy that makes custody operations the overriding priority.

Bitget's September report showed forged withdrawal instructions without private-key compromise, while Liquid's report from the same month accepted invalid assets before a genuine authorization process released Bitcoin against them.

Hacken's second-quarter summary recorded $763.9 million extracted across 67 incidents, attributing 88.3% of losses to compromised keys, signers, and infrastructure.

Multiplying those figures gives approximately $675 million, while applying the 40% share for the third quarter to $1.18 billion gives approximately $472 million, about 30% less.

The third-quarter report calls its category access-control and operational failures, while the second-quarter report describes operational failures.

The third-quarter 48% share implies about $566 million, compared with roughly $84 million using the second-quarter original 11% share.

That discrepancy, rounded inputs, and uncertain detailed category comparability rule out a precise growth multiple, but the published mix points to much heavier contract losses.

The overall increase also looks different when separated into incident frequency and average severity. Recorded incidents rose from 67 to 107, so dividing the published totals by those counts gives an arithmetic mean of roughly $11.4 million in the second quarter and $11 million in the third quarter. More incidents can lift an aggregate even when the arithmetic mean falls.

Hacken attributed 75.5% of the second-quarter losses to just two incidents, at Drift Protocol and KelpDAO. Smart contract bugs appeared in 44 of that quarter's 67 incidents while accounting for only about 11% of lost value.

A falling category total can coexist with frequent failures and continued potential for severe losses. Establishing improved controls would require comparable exposure and evidence of which safeguards held or failed.

A category's share of past damage helps explain a period, while its importance to a particular institution depends on that institution's exposure and control processes.

Bitget's Sept. 30 investigation update said compromised third-party security products enabled unauthorized access to its exchange wallet environment in the Sept. 24 incident.

Its account update on Oct. 14 describes attackers obtaining high-privilege internal credentials and injecting forged withdrawal commands.

Bitget says private-key compromise was ruled out and cold wallets were unaffected. The exchange says compromised privileged credentials nevertheless enabled forged withdrawal instructions. That finding distinguishes the signing key from the processes allowed to request its use.

This is an operational authorization problem, and the question is how a withdrawal request earns permission to move funds, including what the system accepts as trusted internal activity. A custody design can protect the key while still allowing a compromised upstream process to ask for the wrong transfer.

Bitget's initial notice estimated approximately $351.6 million affected, and its Sept. 25 update raised that to about $387.5 million after including additional assets. The October account puts the final verified affected amount at approximately $388 million.

Bitget attributes those revisions to fuller accounting of the original unauthorized transfers. The revisions describe the original Sept. 24 transfers more completely, and illustrate how an initial crypto theft estimate and an eventual net loss can answer different questions.