According to security firm Hacken, crypto losses from attacks and scams reached $1.18 billion across 107 incidents in the third quarter, up 55% from the previous quarter. About $907 million came through suppliers, unapplied fixes or components outside audit scope. The largest incident hit exchange Bitget, which lost at least $352 million through a third-party security product. Hacken argues that audit badges create a false sense of security because they often cover only part of a system.
What it means: The report's central message applies far beyond crypto. A security audit examines specific code at a specific moment. If attackers come in through a supplier, an unaudited library or a flaw that was found but never fixed, the audit badge protects no one. That around three quarters of losses came from such sources shows the software supply chain is now the weakest point. The Bitget case, where the breach came through a security product, is especially worrying. For European firms with a MiCA licence, DORA's requirements on ICT third-party risk are precisely the answer to such scenarios: a register of contracts, assessment of critical suppliers and exit plans. For Greek software and fintech companies, the practical lesson is that security does not end with an audit report. It needs continuous dependency monitoring, fast patching and a clear record of exactly what was covered. For users, choosing a licensed platform that is transparent about incidents is a more meaningful test than an audit badge on a website.
Related service: Consulting
Related stories
- Zcash plans fix to keep swaps private from future quantum computers
- Goldman, Wells Fargo and Morgan Stanley see tokenization as growth, not a threat
- Eurobank's Postbank Bulgaria brings crypto and stocks into its app
- MSCI rules could remove Strategy and Metaplanet from equity indexes
- Latvia eyes crypto tax payments and overhauls crypto taxation