Crypto security losses totaled $1.26B in Q3, up 53.9% QoQ, with Bitget's $387.5M hack representing 31% of quarterly losses.
Security & Exploits ·
Crypto security incidents resulted in roughly $769 million in losses during September, according to CertiK's tracking of 99 separate incidents. Of that total, approximately $273 million was recovered or frozen, bringing the net loss to $495.3 million. Exploits were the dominant attack vector, generating $734 million across 58 incidents—representing nearly 96% of monthly losses. The broader third quarter saw cumulative security losses reach $1.26 billion, a 53.9% increase from the prior quarter.
Bitget, a major cryptocurrency exchange, experienced a significant breach on September 24 when unauthorized fund transfers occurred from its hot wallet infrastructure. The company's investigation determined that attackers leveraged a vulnerability present in a third-party security tool to gain access to internal credentials, which they then used to construct fraudulent withdrawal orders. Bitget immediately halted user withdrawals in response. Related reporting traced the Bitget incident to a zero-day exploit dating back to August 31.
The $387.5 million loss from Bitget's breach accounted for 31% of the quarter's total security losses, making it a significant contributor to Q3's overall damage. The incident underscores both the concentration risk posed by large-scale breaches and the ongoing threat that supply-chain vulnerabilities in third-party security products present to custodial platforms. Specific details regarding the third-party tool affected or the identity of the attackers remain undisclosed in available reporting.