Crypto hacks cost $1.18 billion in third quarter, security firm Hacken says
Hacken counted 107 incidents from July to September, with losses up 55% from the previous quarter. It said most of the money was lost through suppliers, unapplied fixes or systems outside audits.
Attackers took $US1.18 billion from crypto projects in 107 incidents between July and September, 55% more than in the previous quarter, blockchain security firm Hacken said in its third-quarter report, published on 15 October.
Smart contract exploits accounted for 48% of the losses, up from 12% in the second quarter, and access control and operational failures for 40%, down from 88%, the report said.
About $906.8 million of the quarter’s losses involved compromised suppliers or developer tools, publicly available security fixes that had not been installed, or components left out of the most recent security review, CoinDesk reported, citing the report. Hacken said audits often cover only specific smart contracts and exclude wallets, signing systems and third-party software, and that users who see an audit badge may assume a whole platform has been checked.
The largest incident in the period was the September attack on exchange Bitget, which lost at least $352 million after attackers exploited a vulnerability in a third-party security product to reach its withdrawal systems, according to the report. Other incidents it listed included Liquid Network ($319 million), Coldcard wallet software (about $114 million) and Tectonic (at least $75 million).
Hacken also said it reviewed 12 derivatives exchanges and prediction markets and found that more than $700 million at two major venues relied on a three-of-four signing arrangement or on administrative keys whose holders were not publicly identified. It did not name the venues and said it had found no evidence of an active vulnerability, CoinDesk reported.
Sources
Related coverage
All crypto →
CISA urges immediate patching of PHP2Shell flaws in PHP, used by 69.3% of websites
US agency CISA told organisations to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and to take unpatchable systems offline. Cloudflare reported early attack attempts; CISA said it had not observed exploitation.
Wallet maker NGRAVE says fake app alert led to at least $2.56 million in crypto thefts
Attackers used a third-party notification provider to send LIQUID app users a fake security alert linking to a copycat site that asked for recovery phrases, NGRAVE said.
PHP releases emergency patches for two critical 'PHP2Shell' remote code execution flaws
The PHP security team urged administrators to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; Cloudflare said it had seen early attack attempts and the UK's NCSC told organisations to patch or take systems offline.
Qubic halts its network and Cysic suspends its bridge after weekend exploits
Qubic said 1,404 wallets were drained of about 2.94 trillion QU tokens. Cysic said 10 million CYS tokens were minted without authorisation through its bridge.
Bitget adds Russia and Belarus to its list of prohibited countries
The exchange's updated terms of use are dated 16 October. Notices to users quoted by Interfax-Ukraine set 21 October as the deadline to close positions and withdraw assets.
Google quantum chip result revives debate over risk to older bitcoin wallets
Google says its Willow chip cut errors in a key quantum computing step about 40-fold. Crypto researchers disagree on what that means for when bitcoin's cryptography could be at risk.
