Crypto security firm CertiK tallied $766.4 million in exploit and phishing losses for September 2026, the highest monthly figure it has recorded this year. Breaches at Bitget and Liquid Network account for most of the damage, though hundreds of millions in frozen and returned funds have cut the remaining toll roughly in half.
Crypto security firm CertiK reported roughly $766.4 million in exploit and phishing losses for September 2026, with incidents at Bitget and Liquid Network accounting for most of the damage. The month's total is the largest CertiK has recorded in any month this year.
Bitget and Liquid Network Account for Most of September's Damage
CertiK's incident ranking assigns $387.5 million to Bitget and $318.7 million to Liquid Network—about $706.2 million combined, according to The Defiant's calculation. The next-largest entry, labeled Safe wallet users, was $7.8 million.
Bitget said attackers exploited a vulnerability in a third-party security product on Sept. 24, stole internal access credentials and forged withdrawal instructions. The exchange said private keys were not compromised and cold wallets were unaffected, and that its Protection Fund would cover the financial impact without reducing user account balances. Its published recovery schedule calls for withdrawals of its remaining coins, along with fiat and peer-to-peer services, to resume on Oct. 2.
Liquid Network said a Sept. 6 vulnerability in its Elements software allowed the creation of roughly 4,000 unbacked LBTC, which exploiters then converted into bitcoin through the network's withdrawal mechanism. In its Sept. 8 incident report, Liquid said 3,400 BTC had been returned to the federation's wallet on Sept. 7, illustrating why gross losses and unrecovered funds differ substantially.
Recoveries Cut the Final Toll
Those headline figures measure losses before recoveries, rather than the final damage borne by users. CertiK's live September dashboard lists $768.5 million across 98 security incidents, with $273.2 million frozen or returned, bringing its adjusted losses to $495.3 million.
According to CertiK: "September has seen the highest recorded losses as well as the most incidents in 2026."
September Tops Every Earlier Month in 2026
The September alert exceeds each of CertiK's January–August month-end loss alerts. The closest was April's $651 million, followed by January's $370.3 million. July and August alerts reported $187.7 million and $214.7 million, respectively; February, March, May and June each came in below $100 million.
September's alert alone amounts to more than half of the $1.31 billion in losses CertiK reported for the first half of 2026, a tally that covered 344 incidents. CertiK's monthly alerts combine direct exploits with phishing losses into a single figure.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
