Bitget Liquid Hacks Drive Most Q3 Crypto Losses

According to a recent security report, crypto-related thefts reached $1.18 billion in the third quarter, spanning 107 incidents and marking a 55% rise from the previous three-month period.

Scope of Q3 crypto losses

Another analytics firm, using a broader incident definition, put the total at $1.26 billion across 247 cases, up 53.9% from the prior quarter. Both sets of data underline a sharp increase in illicit activity.

The report highlights that roughly 77% of the losses—about $906 million—originated from compromised suppliers, developer tools, or other components that lie outside the perimeter typically covered by security audits.

Smart-contract bugs, the primary focus of most audit frameworks, accounted for $228 million lost in 71 incidents, making them the most frequent attack vector but not the costliest.

Supply-chain attacks, key compromises and failures in signing or withdrawal infrastructure drove the biggest losses. Four incidents, Bitget, Liquid Network, Tectonic and Coldcard, represent about 80% of the total thefts, with a median loss of $670,000 per event.

Bitget and Liquid Network: two hacks that defined the quarter

Bitget suffered a loss of $387.5 million, roughly a third of the total reported by Hacken. Attackers exploited a zero-day flaw in a third-party security product, gaining access to internal systems and injecting forged withdrawal commands. The breach affected hot and warm wallets; cold storage remained untouched.

CEO Gracy Chen blamed North Korean actors, a link later supported by Chainalysis, which traced the activity to the nation’s hacking groups. The vendor of the compromised product has not been identified.

On September 6, Liquid Network lost $319 million after a caching flaw in its node validation software allowed an attacker to bypass a full verification check and mint roughly 4,000 unbacked L-BTC. Blockstream, the creator of Liquid, confirmed that none of its signing keys were compromised.

The attacker returned about 3,400 of the minted tokens, keeping roughly 600 L-BTC as a self-declared bounty. Together, the two incidents represent more than $700 million, or about 60% of Hacken’s total loss figure and 56% of CertiK’s estimate.

If the industry continues to focus audits on on-chain code alone, the gap will likely stay open, inviting more supply-chain exploits. Aligning security budgets with the broader attack surface could reduce future losses, but it will require coordinated effort among platforms and tooling providers.

Recovery efforts have returned or reversed about $387 million, roughly a third of the gross losses. Part of that figure comes from the partial restitution by the Liquid attacker.

Operators covered approximately $410 million of user losses using their own funds. Bitget’s user-protection fund alone paid $387 million, while other entities such as Triple-A, Coinsbuy and TAC contributed an additional $22 million.

Recommendations and industry response

Industry leaders are urged to broaden the scope of security assessments beyond on-chain code. The guidance calls for systematic reviews of oracles, bridges, custody solutions and signing authorities, treating third-party tooling as integral to the overall risk profile.

Impact on African ecosystem and future builders

Crypto use is high in several African markets. In the 2025 Chainalysis Global Crypto Adoption Index, Nigeria ranked sixth and Ethiopia twelfth, while South Africa ranked 30th. Chainalysis has attributed a March 2025 spike in Sub-Saharan on-chain volume largely to centralized exchange activity in Nigeria. That’s the category most exposed to the supply-chain and infrastructure failures that defined Q3.

African DeFi builders working on protocol infrastructure, stablecoins and payment rails build on third-party tooling and oracle networks whose security they often can’t audit themselves. If 77% of losses came from outside audited scope, as Hacken’s report finds, a security strategy that stops at the smart contract layer has a hole in it. A serious audit costs more than many early-stage projects can afford, and that constraint is real. The threat doesn’t shrink to fit the budget. Pooled audit resources, regional security working groups and coordinated disclosure would help close the gap, and they would matter most for a developer ecosystem that is still growing.