Cryptocurrency hack losses reached a devastating $768.5 million in September 2026, representing a dramatic 462% increase from August's $136.3 million, according to CertiK. This makes September the worst month of 2026, with PeckShield reporting $766.5 million in losses across 55 major incidents. The month also set a new record for incident count with 99 major hacks compared to 50 incidents in August. Bitget and Liquid Network together accounted for $707 million, or approximately 92% of the monthly total, with Bitget losing roughly $387.5 million and Liquid Network losing about $319 million. The remaining 53 incidents cost roughly $59 million combined. As CoinDesk reports, September was the worst month yet, with 99 incidents representing the most since February 2025.
The cryptocurrency industry has experienced a significant security crisis with the biggest 10 hacks since 2022 draining over $5 billion to date. According to reports from AMBCrypto, these attacks demonstrate that the industry's security problems extend far beyond traditional smart contract vulnerabilities. The most significant attack was the Bybit hack in February 2025, which resulted in $1.46 billion in losses. The FBI investigation linked this attack to North Korea's TraderTraitor group, revealing that the breach involved social engineering and infrastructure compromise rather than finding bugs in blockchain code.
The majority of major hacks involved compromising people, passwords, and approval systems rather than breaking code. As reported by AMBCrypto, the Ronin Network hack followed a similar pattern, draining $625 million by compromising five of nine validator keys. Initial access reportedly came through a fake job offer sent to an employee. Other notable attacks included the BNB Chain exploit that drained approximately 2 million BNB by compromising a flaw in the bridge's proof-verification system, and the Wormhole hack that allowed minting around 120,000 wrapped ETH through a vulnerability in the code. CoinDesk notes that smart contract exploits accounted for 125 cases, but three-quarters of stolen funds came from compromised keys, custody systems, and signing infrastructure.
Bitget engaged blockchain security firm SlowMist to investigate the theft from its hot wallets, with their progress report as of September 29 revealing critical details. The compromise began weeks before any funds left, with the earliest malicious activity dating to August 31. An attacker exploited a zero-day flaw, a previously unknown bug, in a third-party security product. Investigators also recovered a custom withdrawal tool from files the attacker had deleted. While SlowMist has not named a culprit, Bitget CEO Gracy Chen previously pointed to suspected North Korean hackers. The breach affected portions of Bitget's hot and warm wallet infrastructure across Ethereum and other EVM networks, XRP Ledger, Zcash and Tron, with assets including ETH, XRP, USDT, USDC, ZEC, BNB, AVAX and TRX. Bitget confirmed that $387.5 million in crypto reached attacker-controlled addresses after investigators expanded an initial estimate of $351.6 million. The exchange has since restored BTC, ETH and USDT withdrawals and reported a 131% total reserve ratio across 19 covered assets, with its Protection Fund replenished above $300 million on September 30.
Liquid Network suffered the other major September attack on September 6, when a vulnerability in the Elements codebase allowed an attacker to create roughly 4,000 L-BTC without matching Bitcoin backing. The attacker then used Liquid's normal peg-out process to withdraw close to 4,000 real BTC, reducing the federation's Bitcoin reserve from approximately 4,205 BTC to 197 BTC. CertiK independently placed the affected amount at 3,998.5 L-BTC, valued at approximately $318.7 million when the exploit occurred. Unlike most large thefts, most of the Bitcoin was returned quickly after communicating with the Liquid team through onchain messages and negotiations. The attacker returned 3,400 BTC on September 7, with roughly 85% of the Bitcoin withdrawn returned within a day. The recovery means September's $766 million-$768 million figure should be read as gross value affected by security incidents, not the amount still permanently missing. Blockstream deployed an emergency patch after halting the network and released Elements v23.3.4 with a hardened proof-cache implementation, with block production resuming on September 9.
The security crisis has intensified with TRM Labs reporting a record 207 crypto hacks in H1 2026, more than double the 85 incidents recorded in H1 2025. According to AMBCrypto, smart contract exploits accounted for 125 cases, but three-quarters of stolen funds came from compromised keys, custody systems, and signing infrastructure. The losses reached $972 million in H1 2026, with North Korea-linked actors responsible for 66% of stolen funds. CertiK reports 656 security incidents and $2.68 billion in crypto losses during 2026 so far. The figures follow an already active year for attackers, with at least $1.3 billion lost during the first eight months of 2026, with compromised credentials and private keys playing a large role in several major incidents. September's two largest attacks used different paths - Bitget obtained access through compromised third-party security infrastructure and forged withdrawal commands, while Liquid's exploit came from a software validation flaw in Elements' rangeproof verification code. CoinDesk reports that crypto suffered 247 security incidents in the third quarter, with losses totaling $1.26 billion, with the insurance safety net remaining relatively small at $130.2 million in on-chain coverage capacity.
