Crypto exploits and hacks drained $1.18 billion across the industry in the third quarter, and 77% of that damage hit projects and platforms that had no security audit in place, according to a quarterly tally of incidents reported by Altcoin Buzz.

The figure lands amid a year of outsized thefts. Quarter after quarter in 2025, attackers have pulled nine-figure sums from protocols, centralized platforms and key-management failures, and Q3 keeps that run intact at $1.18 billion. The single sharpest signal in the data is the audit gap: roughly $908 million of the quarterly total — 77% — came from targets operating without a formal security review.

What does the 77% unaudited share actually mean?

The number cuts against a common assumption in the market: that audited projects are where the money bleeds. In Q3, the inverse held. Nearly four out of five stolen dollars came from unaudited codebases, unaudited deployments or operations that skipped external review altogether.

That distribution matters for how the industry allocates defense spending. Security firms have spent years marketing audits as table stakes for DeFi protocols. The Q3 data suggests the residual risk has migrated — toward hastily launched token contracts, cross-chain bridges stood up without review, and centralized operations with no third-party oversight of custody code.

The pattern also shapes underwriting. Insurers and on-chain risk platforms price coverage partly on audit status. If 77% of losses sit outside audited perimeters, carriers writing policies for reviewed protocols are absorbing less tail risk than headline totals imply, while the unaudited segment remains effectively uninsurable.

Where the losses concentrated

The quarterly data points to a structural picture rather than a single catastrophic event:

• $1.18 billion in total hack and exploit losses for Q3
• 77% of losses — about $908 million — hit targets without security audits
• The unaudited share spans protocol code, bridge infrastructure and operational key management
• Audited projects accounted for the remaining 23% of stolen funds

The 23% audited share is not zero, and that carries its own lesson. Audits are point-in-time reviews. Code ships after the report, dependencies change, and attackers probe implementations rather than the reviewed commit. An audit stamp reduces risk; it does not retire it.

Why the audit gap keeps widening

Speed-to-market economics explain most of it. A token launch or bridge deployment can move from idea to mainnet in days. A credible audit takes weeks and costs tens of thousands of dollars minimum. Teams racing a narrative — a memecoin cycle, a yield farm, an airdrop window — routinely skip the review and absorb the risk, or never price it at all.

The incentive problem compounds downstream. Users ape into unaudited contracts chasing yield. Liquidity pools fill. Then the pool becomes a target large enough to justify a sophisticated attack, and the loss lands in the quarterly ledger.

What comes next

The $1.18 billion Q3 figure puts annualized 2025 losses on pace to challenge the worst years on record for crypto theft. Expect the unaudited 77% to sharpen regulatory attention: jurisdictions drafting custodian and issuer rules — from the EU's MiCA framework to pending stablecoin legislation in the US — increasingly treat independent security review as a compliance expectation rather than a market nicety. Teams that ship unaudited code in the next two quarters will be betting against both attackers and regulators.