Cryptocurrency platforms and projects suffered $1.18B in losses across 107 hacks during the third quarter, with compromised suppliers and developer tools accounting for 77% of the total damage, according to a security report from Hacken.
Two major breaches drove the quarter's toll: Bitget lost $387M and Liquid lost $320M. The concentration of losses in infrastructure and tooling compromises, rather than smart contract vulnerabilities or direct protocol failures, marks a shift in attack surface for exchanges and platforms managing hundreds of millions in user funds.
Hacken's analysis found that most successful exploits bypassed traditional security audits by targeting external components: software supply chains, cloud infrastructure, and developer environments that exchanges rely on but often do not monitor with the same rigor applied to on-chain code. The Bitget incident exposed the vulnerability of centralized systems managing API access and signing operations. Liquid's compromise similarly used external infrastructure dependencies.
The $1.18B figure represents a material portion of total crypto losses for the year to date. In comparable periods, quarterly hack totals have ranged from $400M to $800M. The 77% share attributable to infrastructure and supplier compromises is higher than the historical average of 50-60% for similar periods, according to publicly reported incident analyses.
Both Bitget and Liquid have announced recovery plans and compensation for affected users. Bitget said it is rebuilding security protocols around third-party integrations and cloud access. Liquid committed to enhanced monitoring of external dependencies and stated it would implement mandatory security reviews for all supplier relationships.
Platforms audit their own code exhaustively but treat external vendors and infrastructure as lower-risk. Attackers have increasingly focused on this gap. The 107 incidents in Q3 represent a 15% increase in incident count from Q2, even as the total dollar value fluctuated.
Infrastructure compromises are harder to detect and remediate than code exploits because they sit outside the audit and testing workflows most teams have built. Recovery requires not just patching but also forensic work to identify what data or credentials may have been exposed. The convergence of large losses and high incident frequency in Q3 occurred as this class of attack became standard operational risk for custody and trading platforms.
