Crypto audits give investors false sense of security as Q3 hacks cost $1.18 billion, Hacken says

Crypto security reviews are supposed to catch weaknesses before attackers find them, and Hacken’s Q3 tally shows that the review process did not cover every exposed surface. The report points to attacks that reached beyond the latest audits, including suppliers, patch timing, and other systems tied to a project. For builders and operators, that means a narrow focus on code reviews alone no longer matches the way losses are being recorded.

Exploits against smart contracts sit at the center of a long-running problem for DeFi and other onchain systems: software can be public, composable, and still fragile. Bitcoinist’s note that smart-contract losses took a larger share than in the previous quarter suggests the attack mix is shifting rather than disappearing. That puts pressure on teams that rely on automated contracts to keep tightening testing, monitoring, and upgrade discipline.

Hacken’s figures matter because they show security work is now spread across code, vendors, and operational controls, not just the contract itself. Coindesk’s emphasis on compromised suppliers and delayed fixes points to the same trade-off crypto projects face when they move fast and depend on many outside services. The industry is being asked to preserve open, programmable systems while accepting the more ordinary security burden that comes with them.

What remains open is which project types and attack paths made up the biggest share of the $1.18 billion total, beyond the broad categories already identified. Bitcoinist gives a quarterly window, but not the full breakdown by protocol, chain, or incident type. Further disclosure from Hacken or the affected projects would be needed to show where the losses clustered and whether the pattern continues into the next quarter.