In the same quarter, two security firms reported two different sets of figures.
Hacken: About $1.18 billion stolen in Q3, across 107 incidents.
CertiK: About $1.26 billion, across 247 incidents.
The amounts are similar, but the incident counts differ by more than twofold. Each firm defines what counts as “one incident” for itself, so don’t treat these quarterly reports as official statistics. First and foremost, they’re marketing materials.
What’s really worth noting is what Hacken itself wrote: about $907 million in losses were tied to compromised infrastructure, unpatched vulnerabilities, or components that weren’t covered by an audit in the first place. In plain English, the “audited” badge on a project’s website may mean only a small part of its contracts was reviewed. The money leaked out through back-end systems, private-key management, development tools, or vendors.
Then comes the irony: the ones saying “audits create a false sense of security” are the very companies that sell audits. Naturally, the conclusion is that you need more audits, more monitoring, and more annual subscription services. The crypto news accounts that repost these figures put an exchange link under the post, completing the whole traffic funnel.
The data can be a useful reference, but take the conclusions with a grain of salt. When you see an audit logo, check the report to see what was in scope, when the audit was done, and whether the code changed afterward. Most money isn’t stolen by genius hackers; it’s handed over through “the part nobody is responsible for.”
#安全 #Audit
Hacken: About $1.18 billion stolen in Q3, across 107 incidents.
CertiK: About $1.26 billion, across 247 incidents.
The amounts are similar, but the incident counts differ by more than twofold. Each firm defines what counts as “one incident” for itself, so don’t treat these quarterly reports as official statistics. First and foremost, they’re marketing materials.
What’s really worth noting is what Hacken itself wrote: about $907 million in losses were tied to compromised infrastructure, unpatched vulnerabilities, or components that weren’t covered by an audit in the first place. In plain English, the “audited” badge on a project’s website may mean only a small part of its contracts was reviewed. The money leaked out through back-end systems, private-key management, development tools, or vendors.
Then comes the irony: the ones saying “audits create a false sense of security” are the very companies that sell audits. Naturally, the conclusion is that you need more audits, more monitoring, and more annual subscription services. The crypto news accounts that repost these figures put an exchange link under the post, completing the whole traffic funnel.
The data can be a useful reference, but take the conclusions with a grain of salt. When you see an audit logo, check the report to see what was in scope, when the audit was done, and whether the code changed afterward. Most money isn’t stolen by genius hackers; it’s handed over through “the part nobody is responsible for.”
#安全 #Audit