“Usually, when a customer sees a new project, they see an audit badge, assume the whole system is covered, and lose money through a key, a supplier, or a setting that was never tested,” Matiukhin said.
The biggest incident in the period was the September attack on crypto exchange Bitget, which lost at least $352 million after hackers exploited a vulnerability in a third-party security product to gain access to its withdrawal infrastructure, according to the report.
The risks extend beyond exchanges. Just this week, hardware wallet maker Ledger said it found an unauthorized hardware “spy” implant in a device sold by CryptoBilis, a Southeast Asian reseller, resulting in losses of about $93 million.
Three crypto bridges and cross-chain protocols lost more than $35 million during a six-hour exploit in July, Hacken said. AFX Trade accounted for $24 million of that after attackers gained control of its validator keys. Other attacks walked off with $319 million at Liquid Network, at least $75 million at Tectonic, and roughly $114 million at Coldcard wallet software.
Hacken also examined 12 derivatives exchanges and prediction markets and found that more than $700 million in secure assets at two major venues depended on a four-key signing arrangement requiring three signatures, or on administrative keys whose holders were not publicly identified.
Leave a Reply