An audit badge on the website of an exchange or a protocol reads like a guarantee. The security firm Hacken has now set out how little it covers when it matters: in the third quarter of 2026,
An audit badge on the website of an exchange or a protocol reads like a guarantee. The security firm Hacken has now set out how little it covers when it matters: in the third quarter of 2026, attacks on the crypto market cost $1.18 billion across 107 incidents, and $906.8 million of that fell on components that were never on the table at the last security audit. That is 77 percent of the quarter's losses. Co-founder Andrii Matiukhin summed it up to CoinDesk: “The problem is always scope”.
For investors, that does not mean audits are worthless. It means a badge answers a different question from the one you are asking. You want to know whether your balance is safe. What was usually examined is whether one particular smart contract was clean at one particular moment. This article shows where the gap sits in figures, which cases tore it open over the summer, and how to tell a meaningful audit report from a decorative one.
The figure appears in the quarterly report of the audit firm Hacken, which CoinDesk reported on October 18, 2026. $1.18 billion in damage spread across 107 separate incidents, 55 percent more than in the second quarter. The rise does not come from a larger number of small attacks but from a few very large ones.
An audit here means a security review of program code by an outside firm. Auditors read the source, look for errors in the logic, test edge cases and write a report listing findings by severity. What ends up in that report depends entirely on what the client had examined. That is exactly where the criticism bites.
Hacken assigns the $906.8 million to three causes: compromised suppliers and developer tools, security fixes already disclosed that nobody had installed, and components that simply were not in scope at the last security pass.
None of these three routes runs through the audited contract. An attacker who takes over a developer's account at a tooling provider does not have to break the smart contract. They gain access by the route the audit never looked at. Matiukhin also gave CoinDesk the reason why scopes stay small: “It’s expensive to have enormous scopes of all components that interact with funds”. And the company under review pays for the audit itself.
The single largest case of the quarter shows the pattern. According to the Hacken report, users of the exchange Bitget lost at least $352 million after attackers exploited a weakness in a third-party security product and gained access to the withdrawal infrastructure through it. The product attacked was, of all things, a security component.
At Liquid Network the report puts the damage at $319 million, at Tectonic at a minimum of $75 million. Around $114 million fell on Coldcard's wallet software. In July, three bridges and cross-blockchain protocols together lost more than $35 million in a six-hour attack; $24 million of that fell on AFX Trade, after attackers gained control of its validator keys.
In the same week the report appeared, a further case became public: around $93 million in damage from an unauthorised hardware implant connected to Ledger and CryptoBilis. CoinDesk keeps that case separate from the quarterly total, because it only came to light after the cut-off date.
It was not the audited contract that gave way but the line beside it: three quarters of the quarter's losses ran through suppliers, tools and unpatched software.
A typical audit looks at the smart contract, meaning the program on the blockchain that governs deposits, swaps or withdrawals. What is examined is one particular state of the source code, pinned down by a commit ID.
Regularly not included are the browser interface, the servers behind it, the custody solution with its keys, signing procedures, price oracles, bridges to other blockchains, and any bought-in third-party software. Hacken expressly recommends in the report that scopes be widened to oracles, bridges, custody systems and signing permissions. That the recommendation is needed already says what the normal case looks like.
Then there is the time factor. An audit describes a state on one day. Every later code change lies outside it. A badge without a date is therefore hard to assess at all.
For the report, Hacken looked at twelve derivatives exchanges and prediction markets. The finding concerns the structure of custody: at two large venues, on the report's figures, more than $700 million in secured value hung either on a setup with four keys of which three must sign, or on administrative keys whose holders are not publicly known.
Matiukhin was explicit on one point: “We are not aware of a live bug in the systems of any reviewed venue”. The finding concerns the concentration of control, not a specific flaw. Leave your balance on an exchange and you are relying on a small, partly unknown group of key holders acting correctly and not being attacked themselves.
An audit report is a recommendation, not an instruction. Matiukhin describes to CoinDesk what happens in practice: “Sometimes a critical vulnerability is classified as low by the team, and fix implementation is delayed or even declined”.
The move is known in the trade as a severity downgrade. It explains why fixes that had already been disclosed and were available count among the three main causes in Hacken's breakdown. The gap was known, the auditor had named it, and it was not installed.
An audit report worth something names four things. First, a date and a version ID for the code examined. Second, a written-out scope listing which components were included and which were not. Third, the findings by severity, including the points the client did not fix. Fourth, a follow-up review confirming that the critical points were actually closed.
Take one of those away and a logo is what remains. “Audited by” and “secure” are not the same thing, and in Hacken's accounting close to a billion dollars lies between them. Look as well at whether the report's date still matches the current version: a report from two years ago describes software that no longer exists in that form.
The practical consequence of the report concerns where your coins sit. A balance on an exchange is a claim against that company; the venue holds the keys. If its infrastructure fails or comes under attack, getting your coins back depends on the provider's solvency and crisis management. That infrastructure is exactly what sat outside the audit scope in the quarter's cases.
The counterpart is self-custody. With a hardware wallet, meaning a device that stores your private keys offline and signs transactions itself, the key never leaves the device. Which models suit which holdings, and how they differ in handling and recovery, is set out in our hardware wallet comparison. The Ledger case from the same week shows that this route demands care too: a device should be bought only direct from the manufacturer or from a dealer it has named, never second hand and never through a marketplace reseller.
For amounts you move regularly, an exchange stays practical. The question then shifts to the choice of venue. A licence under the EU's MiCA regulation means supervision of capital, segregation of client assets and complaint channels; which providers hold one in Germany is shown in the overview of regulated crypto exchanges. A licence is no substitute for a security audit, but it gives you an address if something goes wrong.
Four keys, three signatures: at two large venues, Hacken says, more than $700 million hung on a setup of that kind.
The effort stays small. Look for the audit report on your provider's site and see whether it carries a date and a scope. Compare that date with the platform's last major update. And see whether the provider discloses how custody is organised, how many keys exist and who holds them.
Find nothing on one of those three points and that is information in itself. It does not mean the provider works insecurely. It means you cannot verify it, and you should size the balance you leave there accordingly. For Bitcoin and other holdings you keep for months, there is little case for leaving them on a trading venue.
Whether the figure falls in the fourth quarter hangs on two developments. The first is scope: as long as audits cover the contract and leave custody outside, the route that carried 77 percent of the losses stays open. The second is how known gaps are handled. Part of the damage arose at points for which a fix already existed.
Both can be watched from outside. If a provider publishes a widened scope, that is a solid signal. If it stays with the old report and the old date, nothing about the situation has changed, whatever the badge looks like.
Three steps for applying the lesson of the Hacken report to your own portfolio:
(As of October 18, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
