Track market-moving stories before they get noisy

3 min read

Hacken noted hacks rose 55% in the third quarter. (Max Bender/Unsplash)Summary

Hackers stole $1.18 billion from crypto projects in the third quarter, up 55% from the previous quarter, according to blockchain security firm Hacken.About $900 million in losses stemmed from compromised suppliers or developer tools, uninstalled security fixes or components excluded from security reviews.Hacken warned that audit badges can give investors a false sense of security because reviews often omit wallets, signing systems and third-party software that attackers target.Crypto investors may be putting too much faith in security audits that fail to cover the systems hackers actually target, according to blockchain security firm Hacken.

In a report released on Thursday, Hacken found that hackers stole $1.18 billion across 107 incidents during the third quarter, 55% more than in the previous quarter. Of that amount, $906.8 million was lost due to compromised suppliers or developer tools, publicly available security fixes that were not installed or components excluded from the most recent security review.

"The problem is always scope." Andrii Matiukhin, co-founder and board director at the company, said in an interview with CoinDesk. "It's expensive to have enormous scopes of all components that interact with funds or influence economics, and teams cut corners, auditing only critical parts of the service.”

The findings raise questions about how much protection investors can expect from crypto projects advertising themselves as audited. Hacken said customers often assume an audit covers an entire platform when it may examine only specific smart contracts, leaving wallets, signing systems and third-party software outside its scope.

“Usually, when a customer sees a new project, they see an audit badge, assume the whole system is covered, and lose money through a key, a supplier, or a setting that was never tested,” Matiukhin said.

The biggest incident in the period was the September attack on crypto exchange Bitget, which lost at least $352 million after hackers exploited a vulnerability in a third-party security product to gain access to its withdrawal infrastructure, according to the report.

Matiukhin declined to identify the venues or provide a detailed assessment before publication of the report. He said it had found no evidence of an active vulnerability, but considered some of the arrangements inadequate given the amounts involved.

“We are not aware of a live bug in the systems of any reviewed venue,” Matiukhin said. “Instead, what we found is setups where key setups are not secure enough considering the scale of the venues reviewed.”

Matiukhin said delays in fixing known vulnerabilities were another concern, particularly when multiple blockchains relied on the same software but updated it at different times.

“Sometimes a critical vulnerability is classified as low by the team, and fix implementation is delayed or even declined,” Matiukhin said.

Responsibility ultimately rests with the companies holding customer funds, which must track vulnerabilities and install fixes promptly rather than rely on an audit completed months or years earlier, Hacken said.

12345678910

Table of contents

On July 24, 2025, Taiwan-based trading platform WOO X became the latest victim in a bruising summer of crypto breaches when attackers made off with roughly $14 million in unauthorized withdrawals from nine user accounts, forcing the exchange to pause withdrawals while it investigated and promised to reimburse affected users.

New chain-analysis shared by Yehor Rudytsia, Head of Forensics and Incident Response at Hacken, paints the post-heist picture as far more organized than a one-off theft. According to Rudytsia, the exploit, which Hacken dates to July, resulted in total losses of about $14 million and was carried out by a DPRK-linked actor tracked in law-enforcement circles as “TraderTraitor.”

Hacken says it is actively monitoring the on-chain movements and is supporting recovery efforts by flagging malicious addresses to the wider security community. The laundering choreography, as mapped by Hacken, left half the stolen funds on EVM networks and the rest on Tron and Bitcoin.

In the last 24 hours, on-chain traces show that the bulk of the EVM-side proceeds, more than $7 million, were routed through THORChain and swapped into Bitcoin, a technique observers have increasingly flagged as a common laundering path after major exchange thefts earlier this year. Rudytsia noted that THORChain’s native cross-chain swap functionality has repeatedly been used to convert large sums of ETH and ERC-20 tokens into BTC, making it attractive to sophisticated operators moving stolen assets across ecosystems.

On-chain Evidence Hacken’s report also documents the handling of the Tron-denominated portion (about $2.5 million in TRX). Those funds, the team found, were converted into USDT, bridged to Ethereum via LayerZero infrastructure, and from there, some of the bridged USDT was again pushed to Bitcoin through THORChain.

On-chain evidence of a nine-figure USDT transfer arriving on Ethereum from a LayerZero executor appears in public transaction records from October 1, 2025, which match the pattern Hacken described.

Complicating the trail, part of the funds that surfaced on Ethereum were sent to a wallet previously tied to the BingX hot-wallet exploit in 2024, itself attributed by investigators to North Korean-linked groups, suggesting either reuse of laundering infrastructure or coordination across multiple thefts.

The address that received those transfers is publicly visible on Ethereum explorer records, and investigators say the link deepens the picture of an organized laundering chain connecting multiple high-profile incidents.

Taken together, the movements indicate that roughly $8–9 million from the WOO X breach was bridged on the same day from Ethereum to Bitcoin, almost entirely via THORChain, leaving an estimated 90% of the stolen value now sitting on Bitcoin addresses as perpetrators accelerate conversion into the oldest and most liquid on-chain asset.

Security teams monitoring the flows warn that once funds consolidate on Bitcoin, conventional tracing and intervention become harder and the risk of eventual cash-out increases. Rudytsia told Blockchain Reporter that Hacken is continuing to monitor the accounts and will push flagged addresses to exchanges and compliance partners in the hope of freezing or otherwise freezing flow paths where possible.

For now, the case is a fresh reminder that as cross-chain tooling gets more powerful, it also gives sophisticated attackers faster, lower-friction routes to turn stolen tokens into harder-to-trace assets, and that forensic work on multiple chains, together with cooperation from on- and off-ramp services, remains the only immediate line of defence in today’s time.

AUTHOR

Mushumir Butt is a seasoned crypto journalist with over three years of experience reporting on the world of blockchain and cryptocurrency. At Blockchain Reporter, he delivers insightful news, in‐depth project reviews, and precise price analysis and predictions. With a strong background in SEO and digital marketing, Mushumir excels at breaking down complex trends into clear, accessible content, ensuring readers stay ahead in the fast‐paced crypto space.