Third-quarter crypto exploits drained $1.18 billion from the industry, and security firm Hacken argues that a persistent culprit sits in plain sight: audit reports that investors treat as guarantees rather than limited technical reviews. The figure covers July through September and represents one of the heavier quarterly losses on record for the sector.

Hacken's core claim is blunt. Audit certificates, often displayed prominently on project websites, do not certify that a protocol is safe. They certify only that a specific team reviewed specific code at a specific moment. Anything deployed afterward, any dependency, any upgrade, any bridge integration, sits outside the document's scope.

What do audits actually cover?

An audit examines a codebase snapshot. It does not track post-deployment changes, administrative key handling, third-party dependencies or the operational security of the team itself. A project can pass an audit on Monday and introduce a critical flaw on Tuesday without violating any term of the report.

Investors frequently read the presence of an audit — from any firm, at any depth, however dated — as an all-clear signal. Hacken's assessment is that this reading is wrong, and that the market's reliance on it inflates confidence beyond what the documents can support. The company did not, according to the headline findings, break down the $1.18 billion by cause, so the share attributable to unaudited versus previously audited code remains unspecified. That gap matters; without it, the audit critique rests on sector-wide observation rather than a direct accounting of the quarter's losses.

Why the incentive structure fails

The deeper problem is economic. Projects pay auditors once, before launch, when the incentive to obtain a clean report is highest and the incentive to disclose weaknesses is lowest. After deployment, nobody funds continuous review unless the project chooses it. The result is a security posture frozen at launch, defending a codebase that keeps evolving.

For context, $1.18 billion in a single quarter annualizes to roughly $4.7 billion — a sum that dwarfs what most protocols spend on security in total across their lifetimes. The asymmetry between loss scale and defense spending is the structural issue Hacken's critique points toward, even if the firm's headline does not quantify the spending side.

What should change?

The implied prescription is straightforward. Investors should treat an audit as one data point among several, weighing its age, scope, auditor reputation and whether the reviewed code still matches what runs in production. Projects should fund continuous monitoring, re-audit material changes and disclose administrative controls with the same prominence as audit badges.

Whether the market adopts any of this is another question. Audit badges work as marketing, and marketing incentives rarely yield voluntarily. Absent regulatory pressure or insurance pricing that reflects real security posture, the false sense of security Hacken describes is likely to persist into future quarters.