Key Highlights:
- Major September crypto security breaches at Bitget and the Liquid Network demonstrated distinct architectural breakdowns across instruction integrity, proof validation, and release mechanisms rather than direct private-key theft.
- Bitget suffered approximately $388 million in unauthorized transfers after attackers abused compromised privileged internal credentials to inject forged withdrawal instructions into otherwise secure custody environments.
- Hacken security analytics reveal that third-quarter crypto losses reached $1.18 billion across 107 incidents, marked by a sharp jump in access-control and operational failures even as the average loss per incident held steady around $11 million.
Infrastructure and Authorization Breaches Eclipse Direct Key Thefts
Recent post-mortem analyses of high-profile cryptocurrency security breaches highlight a major operational shift across the digital asset industry: sophisticated attacks are bypassing raw cryptographic defenses by subverting the peripheral validation pipelines and internal authorization controls that dictate how withdrawals are initiated. September post-incident reports from centralized exchange Bitget and Liquid Network infrastructure entities detail how tens of millions of dollars moved through automated payout rails without adversaries directly compromising underlying private keys or cold storage vaults.
According to updates released on Sept. 30 and Oct. 14 regarding a Sept. 24 breach, Bitget revealed that compromised third-party security software granted attackers unauthorized entry into its exchange wallet ecosystem. Once inside, the perpetrators obtained high-privilege internal administrative credentials, allowing them to inject forged withdrawal commands directly into normal transfer pipelines. Bitget confirmed that its cold wallets remained entirely isolated and private keys were never compromised. However, the system recognized the forged instructions as valid upstream operational activity. Initially estimated at roughly $351.6 million, the verified affected amount was later revised upward to approximately $388 million as complete accounting of the unauthorized transfers concluded.
Validation Flaws and Automated Pipelines Trigger Liquid Losses
In parallel, the Liquid Network experienced a systemic failure driven by cryptographic proof caching rather than compromised internal credentials. In a Sept. 23 assessment published by Blockstream, researchers detailed how a cache defect in the Elements range-proof mechanism enabled roughly 4,000 unbacked Liquid Bitcoin (LBTC) tokens to bypass validation nodes. Blockstream determined that an earlier bug fix introduced missing fields without explicit length framing, meaning different field configurations generated identical byte arrays that erroneously retrieved cached records of previously validated proofs.
The operational layer compounded the validation failure. SideSwap, the non-custodial swap service handling the peg-out conversion from LBTC to native Bitcoin ($BTC), processed the full 4,000-LBTC request completely automatically. The transaction moved without triggering velocity thresholds, size boundaries, or wallet reputation screening. Because automated keys and forwarding protocols carried out the peg-out without manual intervention, the network disbursed real Bitcoin against unbacked assets. SideSwap and Blockstream both confirmed that neither authorization keys, wallets, nor underlying systems suffered direct intrusion; instead, authentic release workflows executed payouts based on network-validated, yet fundamentally invalid, input tokens.
Industry Loss Metrics Shift Toward Operational Vulnerabilities
These individual operational breakdowns align with macroeconomic vulnerability trends tracked by cybersecurity firm Hacken. Hacken’s quarterly security data reveals that while second-quarter losses stood at $763.9 million across 67 incidents, the third quarter saw aggregate losses climb to $1.18 billion spanning 107 incidents. While total lost capital climbed, the arithmetic mean per incident actually dropped slightly, shifting from approximately $11.4 million in Q2 to $11 million in Q3.
The composition of these exploits also saw a significant realignment. In the second quarter, 88.3% of stolen funds—approximately $675 million—stemmed from compromised private keys, signers, and foundational infrastructure, heavily concentrated in just two exploits involving Drift Protocol and KelpDAO. By contrast, Hacken’s third-quarter data classified 48% of total losses (roughly $566 million) under access-control and operational breakdowns, while the broader category of compromised keys shrank to 40% (about $472 million). Smart contract logic bugs frequently caused incidents across both quarters, yet access management and verification pipelines accounted for the vast majority of lost capital.
Why This Matters
The operational failures at Bitget and Liquid underscore that protecting cryptographic private keys is no longer sufficient to guarantee asset custody. When organizations design security models around cold storage without building independent authorization checks, upstream systems can be deceived into approving fraudulent activity. Blockstream reported that 3,400 $BTC were successfully recovered on Sept. 7, leaving roughly 602 $BTC outstanding, while Bitget deployed its corporate Protection Fund to keep client balances intact before reopening phased withdrawals on Oct. 2. However, the reliance on downstream financial reserves demonstrates that custody architectures must incorporate independent, multi-stage controls—such as transaction velocity limits, length-safe validation framing, and behavioral checkpoints—to prevent compromised permissions from causing catastrophic capital outflows.
Frequently Asked Questions
Were user balances lost during the Bitget operational security incident?
No. Bitget confirmed in its Oct. 14 report that customer balances remained fully protected. The platform absorbed the financial impact of the approximately $388 million unauthorized withdrawal incident through its designated corporate Protection Fund and restored phased withdrawal services beginning on Oct. 2.
How were invalid assets converted to Bitcoin on the Liquid Network without key theft?
An Elements range-proof cache flaw allowed roughly 4,000 unbacked LBTC to satisfy node validation checks because identical byte arrangements reused cached verification results. SideSwap subsequently processed the peg-out conversion into native Bitcoin automatically, as its release mechanisms did not enforce velocity caps, wallet history verifications, or manual pauses on large orders.
