The Odd Quarter: Prices Up, Thefts Up More
Bitcoin rose about 40% in Q3. In the same quarter, hackers walked off with $1.26 billion, and nearly three-quarters of that came from just four hacks.
Losses in Q3 were up more than 50% from Q2, but the number of hacks was only up a little over 10%. So hackers got better at picking the fattest targets.
Over the years, at meetups in a bunch of countries, I've heard the same line in every accent: 'Leave it with me, my project is safe.' That's why the best quarter for prices was also the worst for theft.
Hack 1: Bybit, $390 Million, Through the Security Product
Many people think big exchanges are solid. Risk controls, protection firms, cold and hot wallets kept separate. Bybit had all of that.
The hackers didn't even try to pick the lock. They went through a third-party security product that Bybit itself was paying for. Through that hole, they got into high-level internal accounts and sent the wallet system a batch of fake withdrawal requests. In plain English: the thieves got in through the very product meant to keep them out.
Cold wallets weren't touched, but hot and warm wallets got drained. Bybit said user balances weren't affected and its protection firm covered the losses. Withdrawals came back in stages, and the last batch reopened on October 2.
I've been through a withdrawal freeze myself. A few years ago, I put coins in a platform with a great reputation. Withdrawals froze for a whole week. The page said 'system maintenance.' My only workout was hitting refresh. Even if your coins are safe, not being able to move them is painful.
Hack 2: Liquid Network, $320 Million, the Bridge That Reused Its Checks
Liquid is a Bitcoin sidechain, like a fast side road next to the main highway. On it, you have LBTC, a token backed one-to-one by real Bitcoin locked up. Like a coat check: you hand in your jacket, you get a ticket, and that ticket always gets your jacket back.
The bug was in the checking system. To save computing power, it remembered things it had already checked and reused them. Attackers found a way to make fake proofs that looked already checked. So they printed tickets out of thin air and walked out with other people's jackets.
The twist: they called themselves white hats and gave back about 85%. Happy ending? Not really. The money came back only because they chose to give it back, nothing was protecting you.
Takeaway: every bridge and sidechain you use adds one more layer of code you can't check yourself.
Hack 3: Tectonic, $120 Million, the Price Oracle Blind Spot
Tectonic is a lending protocol on the Cronos chain. You put up collateral and borrow something else. What your collateral is worth depends on its price. That's exactly what attackers targeted.
First, they put up about $5 million and pumped the price of an obscure token over 100 times. Then they used that inflated token as collateral and borrowed $120 million in about 10 minutes.
They didn't break cryptography or any rule. What failed was a setting: the price of a market nobody trades determined the value of a $100 million loan.
On audits: I used to put too much faith in the word 'audited.' A report felt like a get-out-of-jail-free card. Now I see it like a car inspection. Passing means your brakes and lights worked that day; it doesn't stop someone from crashing into you later.
In the end, Cronos validators rolled the chain back 114 minutes and got most of the money back. But a rollback rewinds the whole chain. Every transfer made in those two hours was gone. So the people who saved the day can also rewrite your transactions. Think about that for a high-yield chain.
Hack 4: Ledger, $100 Million, the Hardware Wallet's Weak Randomness
The last hack hits the final line of defense. It's about a hardware wallet, specifically Ledger.
Nobody broke into the device. The problem was a bug in the firmware. Some versions didn't use enough randomness when creating your seed phrase. Those words you thought were impossible to guess were easier to guess than they should have been. Attackers worked out private keys offline and moved the coins.
The catch: updating the firmware doesn't fix an old seed. You need a brand new seed phrase.
The old saying 'Not your keys, not your coins' needs an update. If your key was guessable from day one, it's your key, but everybody's coins.
The Common Thread: A Layer You Can't See
Line up all four: Bybit failed through a security product. Liquid had a cache meant to speed things up. Tectonic relied on the price of an obscure token. Ledger had a random number generator that failed.
Not one of them was Bitcoin getting cracked. Not one was cryptography failing. Every time, what failed was a layer you never thought to worry about, and it's a layer you can't check yourself.
Hackers don't go for the weakest spot. They go for the spot that makes you feel safest, because when you feel safe, nobody's watching.
What You Can Change Right Away
You can't check every layer yourself. Instead, flip it: if I were a hacker, would I go smash the strongest lock? No. So the one thing you can do is not put big money on any single layer.
Exchanges: only keep what you need in the short term there, like cash in your wallet. The bulk leaves somewhere else.
Hardware wallets: yes, for big long-term amounts, but not everything on one device or one seed phrase. Check your model and the firmware version you made your seed on. If it's on the affected list, don't wait. New seed, move the coins, and only buy devices from official sources.
Audits: treat them like a car inspection. Before you put money in, ask: where is this most likely to get hit? The code, the price feed, or some third party I can't see? If you can't answer, put less in.
Always assume even the safest place can have a bad day. Spread things out so you can get through that day. Not to earn more, but to protect your capital, so when something happens, you can still pay your rent.
My grandmother used to say: don't put all your eggs in one basket. That advice applies to DeFi and to everything else.
So, Where Are Your Coins Right Now?
Next time you're about to put money somewhere that looks totally safe, ask yourself: if this goes wrong, can I handle it?
The four hacks of Q3 weren't about code or math, they were about the layers around them. You can't audit everything, but you can reduce your exposure to any single point of failure.
I've been in crypto for eight years, and I've seen too many people lose money because they trusted one thing too much. Spread out, check your seeds, and treat every platform like it might have a bad day.
The question is both where your coins are and whether you can sleep at night if one of those places fails. Check right away.