Crypto Audits Don't Guarantee Safety as Q3 Hack Losses Reach Rp18 Trillion

Blockchain security firm Hacken revealed that losses from cryptocurrency asset hacks in the third quarter of 2026 reached US$1.18 billion, or about Rp18 trillion (assuming an exchange rate of Rp15,300). The figure jumped 55% compared with the previous quarter, raising serious questions about the effectiveness of the security audits that investors have long relied on.

Hacken's report, released Thursday (15/10), stated that of the total losses, about US$906.8 million, or 77%, stemmed from compromises at software suppliers, developer tools, security fixes that were already available but not installed, and components not covered by the latest audits. The findings highlight a wide gap between investor expectations and the protection audits actually provide.

Hacken founder and director Andrii Matiukhin stressed that the root problem always lies in audit scope. According to him, extending audits to every component that interacts with funds or affects a platform's economy is expensive, so many teams take shortcuts by auditing only critical parts. As a result, wallet systems, signing mechanisms, and third-party software often go untested.

“Usually, when customers see a new project with an audit badge, they assume the whole system is covered, then lose money through keys, suppliers, or settings that were never tested,” Matiukhin said.

The largest incident in the period was the September attack on crypto exchange Bitget, which resulted in losses of at least US$352 million. Hackers exploited a vulnerability in a third-party security product to breach the withdrawal infrastructure. The case confirms that risk is not concentrated only at the exchange but also spreads through the software supply chain.

A similar threat hit hardware wallet maker Ledger. This week, Ledger disclosed unauthorized hardware implants inserted into devices sold by CryptoBilis, a reseller in Southeast Asia, with potential losses reaching US$93 million. Meanwhile, three crypto bridges and cross-chain protocols lost more than US$35 million in a six-hour exploit in July. AFX Trade was the biggest victim, with US$24 million in losses after its validator keys were taken over by attackers. Other attacks hit Liquid Network (US$319 million), Tectonic (at least US$75 million), and Coldcard wallet software (about US$114 million).

Hacken also highlighted key management practices at 12 derivatives exchanges and prediction markets. More than US$700 million in safe assets at two large venues depend on a four-key signing scheme requiring three approvals, or on administrative keys whose holders are not disclosed to the public. Matiukhin declined to name the venues but judged the arrangements inadequate given the size of the funds managed. He confirmed there was no evidence of an active vulnerability but still considered the scheme risky.

In addition, delays in patching known vulnerabilities are another concern. According to Matiukhin, when several blockchains use the same software but update it at different times, the gap can remain open. “Sometimes critical vulnerabilities are classified as low by teams, so the implementation of fixes is delayed or even rejected,” he said.

Hacken stressed that ultimate responsibility remains with the companies that hold customer funds. They must proactively track vulnerabilities and install fixes on time, rather than relying on audits conducted months or years ago. In an evolving crypto landscape, an audit badge should be a starting point, not an absolute guarantee.

For Indonesia, the findings serve as a reminder for regulators and players in the domestic crypto asset industry. With crypto adoption rising in the country, transparent audit standards and broad coverage need to be a priority. Going forward, the question is whether investors will demand more thorough audits, or whether they will keep falling victim to a false sense of security.