Crypto hacks hit $1.18 billion in Q3 as Bitget and Liquid losses reveal new attack patterns

Third-quarter thefts climb while attack methods shift

Crypto security firm Hacken reported $1.18 billion in stolen digital assets during July through September, up 55% from the $763.9 million lost across 67 incidents in the second quarter. The number of incidents rose to 107.

The mix of attack types changed noticeably. In Q2, about 88% of losses came from compromised private keys, signers, and infrastructure failures. In Q3, losses attributed to smart contract bugs rose to 48% of the total, up from roughly 11% in the earlier period.

Private keys are secret codes that let owners move crypto. Smart contracts are self-executing programs on blockchains that can be exploited if they contain bugs.

What the numbers show

• Total Q3 thefts reached $1.18 billion across 107 incidents, a 55% increase over Q2.


• Smart contract-related losses rose to about 48% of the quarter's total, compared with just 11% in Q2.


• The average loss per incident fell slightly, from about $11.4 million in Q2 to about $11 million in Q3, even as the total number of incidents rose.


• In Q2, two major incidents at Drift Protocol and KelpDAO accounted for 75.5% of all losses.

Bitget says attackers used forged withdrawal commands

Bitget, a major crypto trading platform, disclosed on Sept. 30 that attackers gained unauthorized access to its exchange wallet environment through compromised third-party security products. The exchange ruled out a private-key compromise and said cold wallets were unaffected.

By Oct. 14, Bitget said the attackers had obtained high-privilege internal credentials and injected forged withdrawal commands into the system.

The final verified amount affected was approximately $388 million, up from an initial estimate of $351.6 million and a later update of $387.5 million. Bitget said the revisions reflected a fuller accounting of the original unauthorized transfers. User balances were unaffected because the company's Protection Fund covered the financial impact, and phased withdrawals reopened on Oct. 2.

Liquid and SideSwap faced a different kind of failure

Liquid, another exchange, suffered losses through a separate set of failures in September. Blockchain technology firm Blockstream found that a defect in its Elements range-proof cache allowed approximately 4,000 unbacked liquid staking tokens (LBTC) to pass validation checks. The bug caused nodes to reuse a record of a successful check for a transaction that should have failed.

SideSwap, which processed the conversion of LBTC into Bitcoin, acknowledged it handled the roughly 4,000-LBTC order automatically without checks on size, velocity, or wallet history. Both Blockstream and SideSwap said no keys, wallets, or systems were compromised. The LBTC tokens were simply accepted as valid when they should not have been.

Two failures, one lesson

The Bitget and Liquid incidents illustrate different points where security can break down. Bitget's problem was operational: forged withdrawal instructions were authorized because compromised internal credentials earned permission to move funds. Liquid's problem was technical: invalid assets passed a flawed validation process, and an operational workflow then released Bitcoin based on those accepted assets.

Blockstream traced its cache defect to a bug fix that added missing fields without clear length framing, allowing different arrangements of fields to produce the same input bytes and reuse a cached valid result.

Together, the cases show that securing crypto requires checks at every step — not just protecting keys, but also validating that assets are genuine and ensuring withdrawal processes include independent review points.

Why the changing attack mix matters

Hacken's Q3 data challenges the assumption that securing private keys and custody infrastructure should always be the top priority. When the largest share of losses shifts toward smart contract bugs, the focus of security efforts should adjust accordingly.

A category's share of past damage helps explain a period, but an institution's most important safeguard depends on its own exposure and control processes. Multiple independent checkpoints that can interrupt a transfer at different stages are more likely to prevent losses than relying on a single layer of defense.

What is confirmed

• Hacken recorded $1.18 billion in Q3 crypto thefts across 107 incidents, a 55% increase over Q2.


• Bitget confirmed approximately $388 million in losses from unauthorized withdrawal commands; user balances were covered by its Protection Fund.


• Liquid suffered losses from a Blockstream Elements cache defect that allowed invalid LBTC to pass validation, followed by an automatic release process at SideSwap.


• No private keys or wallets were compromised in either the Bitget or Liquid-related incidents.

What remains unclear

• Precise breakdowns of Q3 losses by category beyond the published percentages are not available, making exact comparisons with Q2 difficult.


• It is not yet clear whether Q4 will continue the trend of rising smart contract-related losses.

Sources

• CryptoSlate