A crypto security firm reported that $1.18 billion in digital assets were stolen during July through September, marking a 55% increase from the prior quarter. The same period saw a 30% decline in losses tied to compromised private keys, according to a disclosure released on October 15. The data challenges assumptions that custody-focused safeguards alone prevent major breaches.

Hacken’s analysis shows 48% of third-quarter theft stemmed from smart contract vulnerabilities, up from 11% in the second quarter. While incident frequency rose from 67 to 107, the average loss per event remained stable at roughly $11 million. The firm noted that two incidents accounted for 75.5% of second-quarter losses, highlighting concentration risk.

Two separate exchange breaches in September illustrate divergent failure modes. Bitget attributed a $388 million loss to unauthorized withdrawal commands executed through compromised internal credentials, with no private-key exposure. Liquid’s incident involved validation defects that allowed invalid assets to be processed before release. Both cases required breakdowns across distinct security layers: asset legitimacy checks and withdrawal authorization protocols.

Blockstream identified a cache-bug in Ethereum’s liquid staking token framework that enabled approximately 4,000 unbacked LBTC tokens to bypass validation. SideSwap’s automated peg-out mechanism processed these tokens without additional safeguards, though neither the staking contract nor SideSwap’s systems were directly compromised.

Bitget restored $300 million from its protection fund and resumed withdrawals on October 2, stating user balances remained intact. The firm emphasized that custody design must address upstream authorization risks, where valid assets may still trigger unsafe transfer requests. The quarterly shift underscores that safeguard priorities depend on institutional exposure patterns rather than universal threat rankings.