The audit reality check
Real talk: seeing an 'audited' badge on a new project doesn't mean your funds are locked down. According to a new report from the blockchain security firm Hacken, investors are catching major Ls because they assume an audit covers a whole platform, when in reality, it often only checks specific smart contracts.
The scope issue
Andrii Matiukhin, co-founder and board director at Hacken, pointed out that auditing is expensive, so teams lowkey cut corners. They might only check the most critical parts, leaving wallets, signing systems, and third-party software wide open to exploits.
"The problem is always scope," Matiukhin explained. "Teams cut corners, auditing only critical parts of the service."
In Q3 alone, hackers walked away with $1.18 billion across 107 incidents—a 55% jump from the previous quarter. Over $900 million of that came from compromised developer tools, supplier issues, or security fixes that were just sitting there uninstalled. It’s giving major negligence, honestly.
Recent hacks in focus
- Bitget: The exchange lost at least $352 million in September after a vulnerability in a third-party security product was exploited.
- Ledger/CryptoBilis: A hardware "spy" implant was found in a device sold by a reseller, leading to about $93 million in losses.
- Protocol exploits: Hacks at Liquid Network, Tectonic, and Coldcard wallet software accounted for hundreds of millions in stolen assets.
Beyond current hacks, Hacken found that two major derivatives exchanges rely on a four-key signing setup for over $700 million in assets, which they flagged as inadequate for the scale involved.
Why it matters
Stop relying on outdated audits. Companies holding your funds are the ones responsible for tracking vulnerabilities and patching them fast. Always stay vigilant, assume nothing is 100% secure, and never trade more than you’re willing to lose. This is definitely not financial advice.
