Hacken counted $1.18 billion stolen from crypto projects in the third quarter of 2026, across 107 incidents1. Seventy-seven percent of that money, $906.8 million, moved through suppliers, keys and other pieces that sat outside every recent audit. Smart contract exploits, the mistakes an audit exists to catch, held to $228.2 million across 71 incidents2. That made it the costliest quarter since the first quarter of 2025.
Audits caught $228.2 million in Q3 2026; $906.8 million sat outside their scope
Crypto losses in Q3 2026 by category, in US dollars, as Hacken counted them
- Outside audit scope: $906.8M
- Smart contract exploits: $228.2M
Sources: CoinDesk [1]; TokenPost [2].
Read the chart as a table
| Item | Value | Note |
|---|---|---|
| Smart contract exploits | $228.2M | 71 incidents, the mistakes an audit is built to catch |
| Outside audit scope | $906.8M | Suppliers, keys and components every recent audit left out |
Read quickly, that number suggests audits add little protection. Investors see 77 percent of a quarter's losses get past a security review and conclude the audits added little value. The number tells a different story once it splits apart. Audited code held close to what each audit was built to catch, about a fifth of the quarter's total.
Andrii Matiukhin, Hacken's co-founder and board director, points at scope as the real problem1. “The problem is always scope. It's expensive to have enormous scopes of all components that interact with funds or influence economics, and teams cut corners, auditing only critical parts of the service,” he said.
Matiukhin's own numbers show the audited code working as planned1. “We are not aware of a live bug in the systems of any reviewed venue. Instead, what we found is setups where key setups are not secure enough considering the scale of the venues reviewed,” he said.
Hacken found $700 million at two big derivatives exchanges with key setups it called too weak for their size1. Those setups sat outside any audit's reach, the same place the quarter's bigger losses hid.
Bitget felt that gap first. An attacker reached one of its wallet servers through a flaw in third-party security software on Aug. 31, 2026, Halborn's forensic review found3. The intrusion sat quiet for 24 days. On Sept. 24, the attacker moved $387.5 million in two hours and 52 minutes, starting at 18:31 UTC4. Recovery stayed under 0.3 percent within two weeks.
Bitget's attacker sat inside its systems 24 days before Sept. 24's $387.5 million theft
Dated steps in Bitget's hack and the report that later named the pattern, in UTC
Sources: Halborn [3]; The Hacker News [4].
Read the chart as a table
| Date | Event |
|---|---|
| Aug. 31, 2026 | Attacker reaches Bitget's wallet server. Through a flaw in a third-party security product, Halborn's trace found |
| Sept. 24, 2026 | Attacker moves $387.5 million. In 2 hours and 52 minutes, starting at 18:31 UTC |
| Oct. 15, 2026 | Hacken names the scope gap. Its Q3 report ties 77% of the quarter's losses to components outside audit scope |
Gracy Chen, Bitget's chief executive, described how the attacker moved inside the exchange's own systems4. “Along the way, they used legitimate credentials. They disguised their activity as routine administrative operations while removing traces of their actions,” she said. Credentials did the forging. The wallet's private key stayed untouched the whole time, Halborn's review found3.
Dmytro Nasyrov audits contracts for a living, as founder and chief technology officer of Pharos Production. He reviewed the limits of his own trade bluntly. “The real audit happens in invariant identification, manual flow tracing and adversarial scenario construction,” he wrote in June 20265. That same process still caught $228.2 million in trouble this quarter, before it reached a wallet, the kind it was hired to find2.
Those audits run in tiers. Boutique reviews cost $8,000 to $25,000, mid-tier work costs $25,000 to $80,000, and top-tier jobs run up to $350,000, by his own count.
The moral question is simple. Who pays when a badge claims more than it tested? Retail users pay first, since they read "audited" as a finished promise, when it was only a partial one. Platforms profit twice: once from the badge's trust, and again from the audit's real, narrower price.
Stefan Beyer's research, cited by CryptoSlate in August 2026, offers one more measure6. The three leading audit-finding categories make up 37.6 percent of what audits flag. Private-key theft and phishing cause 43.9 percent of the money actually lost. Audits grade the test they were given; the money moves somewhere else.
Even Nasyrov's top tier tops out around $350,0005. Bitget's single September loss ran past $387 million, more than a thousand times that ceiling4. Users who trusted the badge carried a risk the audit's price excluded.
The verdict is plain. Hacken's own count says the audited code worked, and the badge claimed more than that. A scope letter, published beside the badge, would tell a user exactly what the audit covered and what it skipped. Readers who want each new scope gap tracked, incident by incident, can join The Signal, CryptoLately's newsletter, at cryptolately.com/newsletter.
Sources
- Olivier Acuna, "Hacken report warns audit badges create false security as Q3 crypto losses hit $1.18B," CoinDesk, Oct. 18, 2026, https://www.coindesk.com/tech/2026/10/18/crypto-audits-give-investors-false-sense-of-security-as-q3-hacks-cost-usd1-18-billion-hacken-says
- Simon Yoon, "Crypto Hacks Left $384 Million Unrecovered After $1.18 Billion in Q3 Losses," TokenPost, Oct. 15, 2026, https://www.tokenpost.com/news/technology/32486
- Gabi Urrutia, "The Bitget Hack: a CISO's Technical Analysis," Halborn, Oct. 7, 2026, https://www.halborn.com/blog/post/bitget-hack-technical-analysis-september-2026
- Swati Khandelwal, "Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M," The Hacker News, Sept. 28, 2026, https://thehackernews.com/2026/09/bitget-says-attacker-exploited-third.html
- Dmytro Nasyrov, "State of Smart Contract Audits 2026: What 30+ Engagements Tell Us About Cost, Quality and Coverage," DEV Community, June 28, 2026, https://dev.to/dmytronasyrov/state-of-smart-contract-audits-2026-what-30-engagements-tell-us-about-cost-quality-and-coverage-5em
- Andjela Radmilac, "Why crypto 'audited' badges are giving investors a dangerous false sense of security," CryptoSlate, Aug. 9, 2026, https://cryptoslate.com/why-crypto-audited-badges-are-giving-investors-a-dangerous-false-sense-of-security/