September crypto hacks steal $768M from users

TLDR

September 2026 saw roughly $766 million to $768 million in crypto hacks, making it the worst month of the year for security breaches.

1. Blockchain security firms PeckShield and CertiK both report September losses near $768 million, with two mega incidents driving most of the damage.
2. The biggest hits were the Bitget exchange hot wallet breach and the Liquid Network exploit, plus dozens of smaller attacks on wallets, casinos, and DeFi infrastructure.
3. Despite rising prices and ETF inflows, repeated exploits are hurting cryptos reputation and are likely to increase regulatory scrutiny and push users toward more secure, regulated venues.

Deep Dive

1. Scale Of September Losses

PeckShield estimated $766.5 million stolen across 55 major incidents, while CertiK counted around $768.5 million across roughly 99 incidents, a narrow range that supports the headline figure of about $768 million for September losses. These totals represent gross value affected, not just permanently missing funds, but they still mark the worst month of 2026 for hacks according to both firms, and a jump of over 400 percent versus August levels reported by PeckShield and others.

CertiKs broader quarterly view shows $1.26 billion lost to 247 incidents in Q3 2026, with year to date losses reaching about $2.68 billion, underscoring how persistent these security failures have become even in a rising market.

2. How Users Were Hit

Two incidents dominated September. The Bitget exchange suffered a hot wallet compromise worth roughly $387 million to $388 million after attackers exploited a vulnerability in a third party security product and forged withdrawal commands, though cold wallets and private keys were reportedly not affected. The Liquid Network exploit used a software flaw to create around 4,000 unbacked L BTC, converting them to nearly 4,000 BTC worth about $320 million at the time.

Importantly, the Liquid attacker later returned about 3,400 BTC, and CertiK estimates roughly $273 million of Septembers hacked funds were frozen or returned, leaving net losses closer to $495 million. Beyond these headline cases, smaller but still painful incidents hit Safe Wallet, DCENT, and Duelbits, each costing users several million dollars, plus numerous phishing and smart contract exploits that did not make mainstream news.

3. What To Watch Next

Analysts note that these hacks are occurring while Bitcoin and Ethereum prices rise and spot ETFs attract billions in inflows, suggesting many institutions are choosing regulated wrappers and largely avoiding DeFi protocols that bear most of the exploit risk. At the same time, on chain insurance capacity is estimated around $130 million, far below Septembers gross losses, leaving most users effectively uninsured.

Going forward, watch for exchanges and networks increasing bug bounties, third party code audits, and incident disclosures, as well as regulators focusing on custody standards and operational resilience. For individual users, venues with transparent audits, strong withdrawal controls, and hardware wallet support are likely to be structurally safer than unaudited contracts and lightly regulated platforms.

Conclusion

Septembers $768 million in hacks shows that cryptos security problem is not just isolated bugs but a systemic issue across exchanges, bridges, and smart contracts. While the market can absorb these losses in dollar terms during a bull phase, the reputational damage and regulatory response could reshape where capital flows, favoring more secure and transparent platforms and putting a premium on projects that treat security as a core feature rather than an afterthought.