Crypto Hacks Drain $768 Million in September, Worst Month of 2026

PeckShield counted 55 major incidents totaling about $766.5 million in stolen funds, while CertiK recorded 97 incidents and put losses at $768.4 million. Despite different counting methods, the two estimates landed within $2 million of each other.

September was a stark reminder of how quickly the threat landscape can shift, CertiK said in a statement.

The month's losses were dominated by two incidents: a $388 million hack of the Bitget exchange and a $320 million exploit of the Liquid Network. Together, they account for roughly $708 million — about 92% of the month's losses by PeckShield's tally.

At Bitget, investigators later confirmed that about $387.5 million reached attacker-controlled addresses after a hot-wallet breach, up from the initial estimate of around $351.6 million.

The Liquid Network attack was stranger: a verification flaw let an attacker mint roughly 4,000 unbacked L-BTC tokens, which were then withdrawn as real bitcoin — draining the network's BTC reserve from about 4,205 coins down to just 197. CertiK valued the haul at roughly $318.7 million when the attack happened.

More than $270 million was later returned across the two incidents, and the Liquid attacker restored 3,400 BTC to the network — leaving net September losses closer to $500 million.

Smaller incidents filled out the month: Safe Wallet lost $7.8 million, DCENT $6 million, and Duelbits $5.9 million.

The two firms' differing incident counts reflect different tracking methods: PeckShield focuses on major incidents, while CertiK logs a wider net of smaller attacks — which is why their loss totals still converged on nearly the same dollar figure.

The September figures were far above the prior month. PeckShield had counted about $136.3 million across 50 major attacks in August, while CertiK's own methodology put August losses at $220.3 million.

September was also the busiest month for incidents: CertiK's dashboard logged 99 attacks, the most since February 2025.

Analysts say the spike was driven almost entirely by the two mega-breaches rather than a broader surge in attack volume — without Bitget and Liquid, September would have looked much like the quieter summer months.

For the year so far, CertiK reports 656 security incidents and about $2.68 billion in crypto losses. The third quarter alone saw 247 incidents and $1.26 billion stolen, according to CoinDesk's review of the firm's data.

Nicolai Sondergaard, senior research analyst at Nansen, said the optics are bad: repeated exploits reinforce the idea that crypto infrastructure remains operationally fragile, which can slow institutional adoption and invite tougher regulatory scrutiny.