<h2 id="header-0">Crypto News</h2>
September was the worst month of 2026 for crypto hacks and exploits. Security firms CertiK and PeckShield both tracked losses above $766 million, driven mainly by two large breaches at the exchange Bitget and the Liquid Network.
<tweet-embed url="https://x.com/PeckShieldAlert/status/2105505048377848307?s=20"></tweet-embed>
CertiK recorded 97 security incidents during the month, with total losses reaching $768.4 million. PeckShield counted 55 major incidents and put the figure at $766.5 million. Both firms said the total marked a sharp increase from August.
<h2 id="header-1">Threat Landscape Can Shift Quickly</h2>
The largest single incident hit Bitget on Sept. 24. Bitget CEO Gracy Chen said a flaw in a third-party security product let the attacker obtain high-level internal credentials, which were then used to issue fraudulent withdrawal commands. The exchange's private keys were not compromised, and its<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/cold-storage"> cold storage</a> wallets were unaffected, Chen said. Bitget initially estimated the loss at $352 million before raising the figure to $388 million.
CertiK described the pace of incidents as notable even by the standard of recent years. "September was a stark reminder of how quickly the threat landscape can shift," the firm said in a statement.
Smaller incidents also added to September's total. Safe Wallet lost $7.8 million, DCENT lost $6 million, and the betting platform Duelbits lost $5.9 million, according to the reported figures.
<h2 id="header-2">Bitget and Liquid Network Exploits Rank as Year's Largest</h2>
The second-largest incident struck the Liquid Network, a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/bitcoin/"> Bitcoin</a> (BTC)<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/side-chain"> sidechain</a> operated by Blockstream, on Sept. 6. Attackers withdrew roughly 4,000 BTC, worth about $320 million, from the network's federation wallet. Blockstream attributed the exploit to a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/bug-exploit"> bug</a> in Elements, the open-source software that underpins Liquid, rather than to compromised private keys.
Related Article: <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/blockstream-refuses-ransom-bitcoin-stolen-liquid-network">Blockstream Refuses Ransom for Bitcoin Stolen From Liquid Network</a>
Purported white-hat hackers later returned 3,400 BTC, worth about $270 million, to the Liquid federation wallet. JAN3 CEO Samson Mow<a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/Excellion/status/2097060644977877433"> said</a> the return followed confirmation that the affected bridge nodes had been patched, and that roughly 598 BTC remained outstanding.
<tweet-embed url="https://x.com/Excellion/status/2097060644977877433"></tweet-embed>
CertiK's security dashboard shows 656 incidents across 2026 so far, with total losses of $2.68 billion. The Bitget and Liquid Network incidents now rank as the two largest crypto thefts of the year by dollar value, surpassing earlier exploits at other protocols.
Bitget has not disclosed how much of the stolen funds have been recovered or frozen. Chen said some assets have been frozen with help from other industry participants, but the exchange would release a total figure only after verifying the amounts. Investigators are continuing to assess a possible North Korea link to the<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/hacking"> hacking</a>, based on preliminary indicators that Chen said are still being reviewed.

Crypto Hacks Hit $768M in September, Worst Month of 2026

Table of Contents

Other articles published on Oct 1, 2026

Stablecoin Firm Rain Seeks OCC Charter for National Trust Bank

Arbitrum DAO Weighs 100M ARB Plan to Back Paxos' USDG Stablecoin

Strive Buys 2,000 BTC, Adds $500M Buyback Facility

Join our free newsletter for daily crypto updates!