An audit badge may be the most expensive placebo in crypto.
The third-quarter report released this week by blockchain security firm Hacken puts the numbers on the table: hackers stole $1.18 billion from crypto projects in Q3 across 107 incidents, a 55% increase from the previous quarter.
The most striking thing isn’t the total, but where the losses came from: around $906.8 million (77%) occurred outside the scope of audits. That includes compromised vendors, contaminated development tools, publicly available patches that were never installed, and components excluded from audits.
Hacken co-founder Andrii Matiukhin summed it up in one sentence: “The problem is always the scope.” Audits typically examine only a handful of specific smart contracts, leaving wallets, signing systems, and third-party software out of scope. Users see an “audited” badge and assume it covers the entire platform—only to lose money through keys, vendors, and configurations that were never tested.
Some of this quarter’s biggest incidents: Bitget lost around $387 million in September (reportedly after a vulnerability in a third-party security product affected its withdrawal system), Liquid Network lost around $320 million, Tectonic around $120 million, and a Coldcard firmware vulnerability led to around $115 million in losses. Smart contract vulnerabilities accounted for the most incidents but the smallest losses per incident: 71 incidents totaling around $228 million.
The good news is that recovery mechanisms are working: around $387 million was recovered or rolled back (white hats returned $272 million after the Liquid incident, and Cronos validators rolled back Tectonic-related transactions). Operators covered around $410 million, leaving approximately $384 million unrecovered—just over 30% of the total.
My take: audits aren’t useless; they protect against flaws in “code logic.” But hackers are now targeting “people, supply chains, and keys.” There’s one rule ordinary investors can follow: stop treating “audited” as a get-out-of-jail-free card. Pay closer attention to whether the team keeps up with operational practices like patching, bug bounties, multisig, and hardware keys.
Next time you see a big “audited” banner, remember to ask: which part was actually audited?
Do you read a project’s audit reports, or do you only look at its returns?
#黑客 #安全审计 #Security
This is not investment advice. DYOR. Trading involves risk.
The third-quarter report released this week by blockchain security firm Hacken puts the numbers on the table: hackers stole $1.18 billion from crypto projects in Q3 across 107 incidents, a 55% increase from the previous quarter.
The most striking thing isn’t the total, but where the losses came from: around $906.8 million (77%) occurred outside the scope of audits. That includes compromised vendors, contaminated development tools, publicly available patches that were never installed, and components excluded from audits.
Hacken co-founder Andrii Matiukhin summed it up in one sentence: “The problem is always the scope.” Audits typically examine only a handful of specific smart contracts, leaving wallets, signing systems, and third-party software out of scope. Users see an “audited” badge and assume it covers the entire platform—only to lose money through keys, vendors, and configurations that were never tested.
Some of this quarter’s biggest incidents: Bitget lost around $387 million in September (reportedly after a vulnerability in a third-party security product affected its withdrawal system), Liquid Network lost around $320 million, Tectonic around $120 million, and a Coldcard firmware vulnerability led to around $115 million in losses. Smart contract vulnerabilities accounted for the most incidents but the smallest losses per incident: 71 incidents totaling around $228 million.
The good news is that recovery mechanisms are working: around $387 million was recovered or rolled back (white hats returned $272 million after the Liquid incident, and Cronos validators rolled back Tectonic-related transactions). Operators covered around $410 million, leaving approximately $384 million unrecovered—just over 30% of the total.
My take: audits aren’t useless; they protect against flaws in “code logic.” But hackers are now targeting “people, supply chains, and keys.” There’s one rule ordinary investors can follow: stop treating “audited” as a get-out-of-jail-free card. Pay closer attention to whether the team keeps up with operational practices like patching, bug bounties, multisig, and hardware keys.
Next time you see a big “audited” banner, remember to ask: which part was actually audited?
Do you read a project’s audit reports, or do you only look at its returns?
#黑客 #安全审计 #Security
This is not investment advice. DYOR. Trading involves risk.