Cryptocurrency hack losses surged by 462% in September 2026 to reach over $766 million, marking the worst month of the year for digital asset exploits. The spike was driven by two massive incidents: a $387 million exploit of Bitget hot wallets linked to a zero-day vulnerability, and a $320 million breach of the Liquid Network. While Liquid Network recovered $285 million from self-proclaimed white-hat hackers, the overall surge highlights escalating security threats across the Web3 ecosystem.
Cryptocurrency hack losses in September 2026
- ▪Cryptocurrency hack losses in September 2026 reached between $766.49 million and $768.4 million across 55 to 99 security incidents, making it the worst month of 2026 for crypto exploits
- ▪The total cryptocurrency losses in September 2026 represented an approximate 462% increase compared to August 2026, which saw $136.3 million in losses across 50 major hacks
The Bitget hot wallet exploit
- ▪An exploit of Bitget hot wallets resulted in the theft of approximately $387 million to $388 million, making it the largest cryptocurrency hack of 2026
- ▪Bitget CEO Gracy Chen stated that suspected North Korean hackers were believed to be behind the $387 million Bitget hot wallet exploit
- ▪An investigation by blockchain security firm SlowMist revealed that the $387 million Bitget hot wallet exploit began on August 31, 2026, utilizing a zero-day vulnerability in a third-party security product
The Liquid Network exploit
- ▪The Liquid Network suffered a $320 million exploit in September 2026, ranking as the second-largest cryptocurrency hack of the year
- ▪Following the Liquid Network exploit in September 2026, attackers claiming to be white-hat hackers returned approximately 3,400 BTC, valued at around $285 million of the $320 million stolen in the hack
Minor cryptocurrency exploits
- ▪Minor cryptocurrency losses in September 2026 occurred through decentralized price manipulation, trading exploits, and flaws in bridge, contract, and minting logic
- ▪Excluding the Bitget and Liquid Network exploits, the remaining 53 cryptocurrency security incidents in September 2026 resulted in combined losses of approximately $59 million
Laundering of stolen cryptocurrency
- ▪Stolen cryptocurrency funds in September 2026 were typically moved within hours and mixed within days using decentralized exchange swaps and the Tornado Cash mixer
- ▪Following the September 2026 Bitget and Liquid Network exploits, hackers swapped stolen assets for privacy-focused coins Monero and shielded ZCash to obscure transaction trails
Cryptocurrency exploit trends in Q3 2026
- ▪Phishing attacks accounted for over 11% of Q3 2026 cryptocurrency security incidents, while scams represented only 1% of the total exploits
- ▪Total cryptocurrency hack losses in Q3 2026 reached $1.2 billion across 247 incidents, representing a 53% increase in stolen funds and a 12.8% increase in incidents compared to Q2 2026
- ▪Ethereum and BNB Smart Chain remained the most frequently targeted blockchain networks for exploits during Q3 2026
Physical attacks on European cryptocurrency owners
- ▪CertiK attributed the high concentration of physical attacks on European cryptocurrency owners to exposure from local regulatory reporting requirements
- ▪CertiK analysts reported a rise in physical 'wrench attacks' targeting private cryptocurrency owners in Europe, with 39 incidents in the first half of 2026 compared to 14 in 2025
Debatable claims
- ▪Cryptocurrency exchanges bear sole responsibility for losses from third-party security exploits
- ▪The convenience of hot wallets does not justify their security risks
- ▪MEV bots that front-run exploits to recover funds do more harm than good
- ▪Unauthorized protocol exploitation is never justified, even if funds are returned
Story comments
Loading comments…