Quarterly Crypto Losses Expose Limits of Narrow Security Audits

Crypto security reviews may not provide investors with as complete a picture of risk as their formal conclusions suggest. A report from security firm Hacken found that $1.18 billion in losses during the third quarter involved weaknesses beyond the systems covered by the latest reviews.

The finding highlights a gap between checking a specific protocol or product and assessing the wider network of vendors, dependencies and operational systems that support it. A review can identify issues within its defined scope, but that scope may not include every supplier or connected system capable of affecting the security of digital assets.

Most losses involved risks outside the latest reviews

According to Hacken, 77% of third-quarter losses were associated with one of three conditions: compromised suppliers, delayed fixes or systems that were not included in the most recent security reviews. The figure indicates that security failures were often tied not only to the technology being examined, but also to how quickly identified issues were addressed and how broadly the review was applied.

For investors, the distinction is important. The existence of an audit or security assessment does not by itself show that every connected service has been examined or that previously identified weaknesses have already been resolved. It also does not eliminate the possibility that a supplier or other external dependency could become a point of failure.

Why audit scope matters

The report places attention on the limits of relying on audit status as a shorthand measure of security. A more useful assessment requires clarity about what was reviewed, when the work was completed and whether suppliers and supporting systems were included. The summary does not identify the individual incidents, projects or suppliers behind the reported losses, so it does not establish which specific controls failed in each case.

Hacken’s finding therefore serves primarily as a warning about interpretation. Investors and other market participants evaluating crypto products may need to distinguish between a recent review of a defined system and broader, ongoing security oversight. Without that distinction, an audit can create confidence that exceeds the protection it actually demonstrates.

Source: Coindesk