By This Hour Crypto Desk
Reported cryptocurrency hack losses for the third quarter approached $1.2 billion after incidents linked to Bitget and Liquid, placing renewed attention on the parts of the industry’s security chain that can sit beyond a project’s own code review.
The figure comes through a Cointelegraph report and has not been supported by incident-level material in the information available for this article. That limitation matters as much as the headline number. A quarterly loss estimate can signal the scale of alleged harm, but without a breakdown of the underlying events, valuations and recovery status, it cannot on its own establish a complete account of what was lost, by whom, or under what circumstances.
One additional claim in the report gives the total a particular security implication. Hacken was cited as estimating that roughly 77% of the quarter’s losses stemmed from compromised suppliers, developer tools and infrastructure components that fell outside security audits. If that attribution is accurate, the apparent problem was not confined to vulnerabilities in the applications or platforms most visibly associated with an incident. It extended to dependencies and operational systems around them.
A large quarterly total without an incident ledger
The reported $1.2 billion figure is framed as a third-quarter total pushed higher by the Bitget and Liquid exploits. The supplied material does not identify the dates of those alleged incidents, the amount assigned to each, the affected systems, the method used, whether customer assets were involved, or whether any funds were later recovered. It also does not say whether the estimate reflects realized losses, assets moved from compromised addresses, claimed exposure, or another measurement method.
Those distinctions are central to interpreting a cumulative number. A loss tally can appear precise while still relying on judgments about what qualifies as an exploit, how assets should be valued and whether related transfers should be treated as part of a single episode. The available claims provide neither Hacken’s underlying methodology nor Cointelegraph’s reporting basis for the aggregate. The reported total should therefore be read as an attributed estimate rather than as a settled industry measure.
The two named entities are significant only in the limited sense supplied: the report says exploits involving Bitget and Liquid helped bring the quarter’s total close to the stated threshold. It does not establish that the entities faced the same kind of compromise, that their events had a shared cause, or that they bore similar financial consequences. Treating the names as evidence of one common failure would go beyond the record.
Nor does the material say whether the figure is meant to cover all cryptocurrency-related security incidents in the quarter or a defined subset tracked by Hacken. A broad headline about crypto hacks can encompass exchanges, wallets, protocols, software providers and other services, but the supplied claims do not specify the universe used for the estimate. The scope remains unresolved.
The reported 77% shifts focus beyond audited code
Hacken’s attributed estimate is the most consequential element of the report because it directs attention to where the alleged losses originated. Approximately 77% were said to be associated with compromised suppliers, developer tools and infrastructure components outside security audits. That is a different proposition from saying audited systems were generally insecure. On the supplied account, the exposure lay largely in systems and relationships that audits did not cover.
Suppliers, tools and infrastructure can be connected to an organization’s operations without being identical to the product or service that users encounter. The reported distinction suggests that evaluating a platform’s security posture may require more than examining the principal application. It may also require attention to the external components, internal development environment and operational infrastructure on which that application depends.
Yet the 77% figure should not be converted into a verdict on audits themselves. The information provided does not describe any particular audit, state which systems were reviewed, identify the entities performing reviews, or show how Hacken determined that a relevant component was outside an audit’s scope. It does not establish whether an audit could have detected an alleged compromise, whether its scope was appropriately limited, or whether an audited component was later affected through a separate pathway.
There is also no detail on how the categories in the estimate were separated. A supplier compromise, a developer-tool issue and an infrastructure weakness may carry different operational implications. Combining them can be useful for describing a wider exposure, but it can also obscure the differences between third-party access, software-development practices and the systems used to run a service. The report’s broad grouping identifies a concern; it does not explain the individual pathways behind it.
Why attribution changes the security question
The reported allocation of losses matters because it changes the question readers, users and organizations might ask after a major incident. A narrow question asks whether a platform’s visible product was audited. The broader question implied by Hacken’s estimate asks what systems, providers and tools are connected to the platform, and whether those connections were included in the security work being cited.
That does not mean every external relationship is necessarily a weakness. It means that a security claim can have boundaries. An audit may address a defined body of code or a stated system, while a reported compromise may arise elsewhere. The supplied information offers no basis to judge the adequacy of any particular audit or security program. Still, the claimed 77% share, if validated, would make the boundaries of review a material issue rather than a technical footnote.
The same caution applies to the $1.2 billion total. A large aggregate can indicate that alleged incidents had major financial consequences during the quarter, but it cannot explain concentration. The available material does not reveal whether a small number of cases accounted for most of the estimated losses or whether the total was dispersed across many incidents. It does not identify the share attributed to Bitget or Liquid, so neither name can be treated as representing the full trend.
Absent those details, the report supports a limited conclusion: the third quarter was described as nearing $1.2 billion in cryptocurrency hack losses, and a cited security firm attributed most of that reported loss value to areas outside audit coverage. It does not support stronger conclusions about the prevalence of any specific exploit technique, the comparative safety of particular businesses, or the effectiveness of security audits across the sector.
Key questions remain unanswered
The next useful evidence would be an incident-by-incident accounting that explains which events were included in the quarterly total and how their values were calculated. Such an account would also need to distinguish alleged theft from exposure, report any recoveries separately, and explain how linked incidents were counted. None of that documentation was included in the supplied material.
Further clarity would also be needed on the source of the supplier, developer-tool and infrastructure classifications. The report does not say what evidence placed an event in one of those categories, whether classifications were preliminary, or whether an event could fit more than one category. Without that information, the 77% estimate is best understood as Hacken’s attributed assessment, not as an independently established causal finding.
For Bitget and Liquid, the unanswered questions are especially basic. The provided claims do not describe the alleged exploits, identify the systems involved, assign losses to each event, or state what response followed. Readers should resist filling those gaps with assumptions based on the scale of the quarterly estimate or the prominence of the names in the report.
The report has not been independently corroborated. This article relies on the limited claims attributed to Cointelegraph and Hacken; no accessible source-page context or separate evidence was supplied to verify the reported third-quarter total, the alleged Bitget and Liquid exploits, or the estimate that about 77% of losses arose outside security-audit coverage.
For further context on this subject, see Report Raises Unverified Claims of AI-Linked Wallet Hack and Website Breaches.
Reporting notes
What is confirmed: The report cited Hacken’s estimate that about 77% of losses were tied to components outside security audits.
Why this matters: Hacken’s attributed estimate suggests most reported losses came from suppliers, tools and infrastructure outside audit scope.
What remains unclear: The incidents, loss allocation, valuation method, recoveries and classification process are not described. This report is based on one source and has not been independently corroborated.
