Crypto hacks caused between $766.5 million and $768.4 million in losses during September, the worst month of 2026, security firms PeckShield and CertiK reported. Bitget's $387.5 million hot-wallet breach and Liquid Network's $319 million exploit drove most of the total, though Liquid's attacker returned the bulk of the stolen Bitcoin within a day.
PeckShield tracked 55 major security incidents in September with about $766.5 million stolen. CertiK counted 97 incidents and put losses at $768.4 million. The two firms use different tracking methods and reported different incident counts, but their estimates of total stolen value landed within $2 million of each other.
September's toll dwarfed August, when PeckShield had counted 50 attacks worth roughly $136.3 million. That marked an approximately 462% month-over-month increase. CertiK's own dashboard placed August losses at $220.3 million under its methodology.
Bitget's breach drove the bulk of September's losses
Bitget's Sept. 24 hot wallet breach was the single largest incident of the month. The exchange confirmed that approximately $387.5 million in crypto reached attacker-controlled addresses, up from an initial estimate of $351.6 million.
The breach hit Bitget's hot and warm wallets across Ethereum and other EVM networks, XRP Ledger, Zcash and Tron, exposing ETH, XRP, USDT, USDC, ZEC, BNB, AVAX and TRX. Mandiant and SlowMist traced the intrusion to compromised third-party security software that gave the attacker access to Bitget's wallet environment, and Bitget said its cold wallets and private keys were not compromised.
Bitget has since restored BTC, ETH and USDT withdrawals and reported a proof-of-reserves ratio of 131% across 19 covered assets, with its Protection Fund replenished above $300 million on Sept. 30.
Liquid's attacker returned most of the stolen Bitcoin
Liquid Network suffered the other major September attack on Sept. 6, when a flaw in its Elements codebase let an attacker create roughly 4,000 unbacked L-BTC. CertiK placed the affected amount at 3,998.5 L-BTC, worth approximately $318.7 million when the exploit occurred.
The attacker then withdrew real Bitcoin through Liquid's normal peg-out process, reducing the federation's reserve from about 4,205 BTC to 197 BTC. But after communicating with the Liquid team through onchain messages, the attacker returned 3,400 BTC the next day — roughly 85% of the withdrawn Bitcoin, worth around $269 million at the time.
Smaller hacks and ongoing recovery
CertiK logged an estimated $7.8 million loss at Safe Wallet. DCENT and Duelbits lost around $6 million and $5.9 million respectively, bringing CertiK's 2026 tally to 656 incidents and roughly $2.68 billion in losses.
Bitget's fund-tracing effort continues, with Mandiant and SlowMist assisting while the exchange offers a 5% bounty for recovering stolen assets. Circle and Tether had already frozen roughly $318,000 in stablecoins linked to the breach. Liquid's peg-outs remain suspended after Blockstream patched the Elements software and resumed block production, while Bitget's remaining withdrawals are set to resume at 08:00 UTC on Oct. 2.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
