Crypto projects lost $1.18 billion to hackers in the third quarter of 2026, a 55% increase from the previous quarter, according to a blockchain security firm's quarterly review. The figure points to a stubborn gap between the audit badges that projects display and the operational weaknesses that attackers actually exploit.

The security firm found that about $900 million of the quarterly losses came from compromised suppliers or developer tools, uninstalled security fixes, or components excluded from security reviews. It also found that 77% of third-quarter losses involved compromised suppliers, delayed fixes, or systems outside the latest security reviews.

Key facts

• Hackers stole $1.18 billion from crypto projects in the third quarter, up 55% from the previous quarter.
• About $900 million in losses stemmed from compromised suppliers or developer tools, uninstalled security fixes, or components excluded from security reviews.
• 77% of third-quarter losses involved compromised suppliers, delayed fixes, or systems outside the latest security reviews.
• The security firm warned that audit badges can give investors a false sense of security because reviews often omit wallets, signing systems, and third-party software that attackers target.

The findings land at a difficult moment for crypto security. Projects have spent years promoting third-party audits as a sign of maturity, and investors have learned to look for audit reports before committing capital. But the quarterly data suggests that a clean report can coexist with unpatched software, unchecked vendors, and unprotected signing infrastructure.

Audit badges and the scope gap

Security audits are usually scoped to code. A project may commission a review of a smart contract, a token contract, a bridge, or a lending protocol, and the resulting report can be detailed and professionally produced. Yet the review may not cover the wallets that hold protocol funds, the signing systems that authorize transactions, the web applications that interact with users, or the third-party services that support the stack.

That scope gap matters because attackers follow the path of least resistance. A flaw in a reviewed contract may be difficult to exploit; a compromised developer tool or an unpatched server may be much easier. When investors see an audit badge, they may assume the whole system has been tested. In practice, the badge may cover only one layer of a much larger attack surface.

Supply chain attacks move up the list

The concentration of losses around compromised suppliers and developer tools reflects a broader shift in crypto attacks. Rather than trying to break a well-reviewed contract directly, attackers can target the people, software, and services that build and maintain it. A compromised package, a malicious update, a phishing attack against a developer, or a breach at a hosting provider can give an attacker a route into the project without ever touching the audited code.

Supply chain risk is hard to eliminate because modern crypto projects depend on many external components. Teams rely on open-source libraries, cloud services, code repositories, continuous integration pipelines, domain registrars, wallet software, and communications tools. Each dependency can become an entry point. Attackers know that a single weak vendor can provide access to multiple projects at once, which makes supplier security a systemic issue rather than a simple procurement problem.

Delayed fixes leave known doors open

The quarterly review also highlighted uninstalled security fixes. A vulnerability does not need to be unknown to be dangerous. If a patch is available but not deployed, the window for exploitation stays open. Crypto teams often move quickly to launch features but may move more slowly on patch management, especially when upgrades require coordination, testing, or governance approval.

Delayed fixes can be particularly damaging in decentralized systems where upgrades are complex. A smart contract may be immutable, but the surrounding infrastructure is not. Servers need updates, dependencies need patching, and access controls need review. When those tasks slip, an audit that was accurate at the time of review can become outdated. The report remains on the website, but the system it described has changed.

What audits often leave out

The security firm's warning focused on wallets, signing systems, and third-party software as common omissions. These are critical components. A wallet holds assets; a signing system authorizes transfers; third-party software connects the project to users and markets. If those systems are not in scope, an audit may provide limited assurance about the safety of funds.

Investors may not see the boundaries of an audit. Reports can be technical, lengthy, and difficult to compare. A project may display a logo or a short badge rather than a clear statement of what was reviewed, when it was reviewed, and what remained outside scope. That simplification can create a false sense of security. It can also reward projects for appearing secure rather than for maintaining security over time.

Why the numbers matter for investors

The $1.18 billion total is large, but the composition of losses may be more important than the headline figure. If most losses come from overlooked suppliers, uninstalled fixes, and systems outside the latest reviews, then the biggest security gains may come from operational discipline rather than another code review. That means vendor management, patch tracking, access control, key management, monitoring, and incident response deserve as much attention as smart contract testing.

For investors, the practical lesson is to treat an audit as one data point rather than a guarantee. Useful questions include: What exactly was reviewed? Was the review limited to contracts or did it include wallets, signing systems, and third-party dependencies? How old is the review? Have material changes been made since? Were findings fixed and verified? Does the project have a process for monitoring threats after the review ends?

The marketing problem in crypto security

Audits are also a marketing tool. Projects use them to build trust with users, exchanges, and investors. That creates an incentive to present audits prominently and to gloss over limitations. The result is a market where a badge can signal diligence even when the underlying security program is narrow. The quarterly loss data challenges that signal.

Security is not a one-time event. It is a continuous process that includes code review, threat monitoring, vulnerability management, supplier oversight, and incident response. A project can pass an audit and still fail operationally. A project can also maintain strong security without displaying a perfect badge. The distinction matters because attackers do not respect audit scope; they look for any gap they can reach.

Building a more realistic security posture

Projects can reduce the risk of overlooked systems by expanding the scope of reviews and repeating them when the stack changes. They can require evidence that critical findings have been fixed, not just acknowledged. They can assess vendors and developer tools with the same seriousness as smart contracts. They can separate signing authority, limit access, and monitor for unusual activity. They can test incident response plans before an attack rather than during one.

Investors can also push for better disclosure. A clear scope statement, a remediation record, and a description of post-audit monitoring would be more useful than a logo. Those disclosures would not eliminate risk, but they would help distinguish a project that has reviewed a narrow piece of code from one that has a broader security program.

The quarterly figures show a security market that is still learning the difference between proof of review and proof of resilience. With $1.18 billion lost in three months and 77% of losses tied to compromised suppliers, delayed fixes, or systems outside the latest reviews, the evidence suggests that the most dangerous gaps are often the ones that never appear in the audit report.

Source: Coindesk News