September crypto hacks reach $766M losses

TLDR

September 2026 was cryptos worst hack month of the year, with security firms estimating roughly $766 million in gross losses from dozens of incidents.

1. Blockchain security firms PeckShield and CertiK report about $766768 million stolen in September across 5597 incidents, a huge jump from August.
2. Two infrastructure breaches, Bitget and Liquid Network, contributed around 92% of the total, although most Liquid funds were later returned.
3. The surge in hacks reflects rising risk in centralized infrastructure and bridges, making stronger custody, monitoring, and security practices increasingly important for crypto users and platforms.

Deep Dive

1. Scale Of September Losses

PeckShields monthly report found September crypto hacks caused about $766.5 million in losses across 55 major incidents, roughly 462 percent more than Augusts 136.3 million and surpassing Aprils previous 646.89 million peak, making it the worst month of 2026 so far. A separate tally from CertiK put September losses at roughly 768.4 million across 97 incidents, with the two firms totals separated by less than 2 million despite different tracking methods, as summarized by crypto.news overview of the month.

CertiKs dashboard shows 656 security incidents and about 2.68 billion in crypto losses in 2026 to date, underlining that the September spike sits within a broader uptrend in attack volume and value at risk.

2. Major Incidents Driving The Total

The exchange Bitget suffered the largest single loss, confirming about 387.5 million reached attacker controlled addresses after a September 24 breach of its hot and warm wallet infrastructure, traced to a zero day vulnerability in third party security software and misuse of internal credentials rather than stolen private keys, according to incident coverage in Cointelegraphs Q3 security loss report.

Liquid Network was the second largest case: an exploit of an Elements cache flaw created roughly 4,000 unbacked L BTC and allowed nearly 4,000 BTC to be withdrawn, valued around 318320 million at the time. The attacker later returned about 3,400 BTC, roughly 85 percent worth about 270 million, leaving around 602 BTC unresolved, as detailed in the same crypto.news monthly analysis.

Beyond these two, smaller but still material incidents hit Safe Wallet, DCENT, Duelbits and other platforms, typically in the single digit millions, showing that both large venues and smaller services remain exposed.

3. Shifting Threat Landscape And User Takeaways

Data through late September indicates about 2.2 billion in direct protocol and infrastructure losses across 288 attacks in 2026, with risk shifting away from classic DeFi smart contract bugs toward centralized exchanges, custodial wallets, bridges and AI assisted exploits, according to a broader security review. Centralized venues account for roughly one third of losses, while bridges have lost over 480 million in 2026 and more than 3.8 billion since 2021.

Security practices are improving on some fronts: formal verification, multiple audits and real time monitoring materially reduce exploit rates, but attackers increasingly automate code scanning and target supply chain weaknesses such as third party security tools. For users, this environment favors diversified custody, careful selection of exchanges with strong reserves and incident transparency, and disciplined wallet hygiene, including hardware wallets for long term holdings, strong authentication, withdrawal controls, and skepticism toward unsolicited links and signatures.

Conclusion

Septembers roughly 766 million in gross hack losses were concentrated in a few large infrastructure incidents but reflect a wider trend of rising security risk across the crypto stack. Even when partial recoveries reduce net losses, reputational damage and regulatory scrutiny can outlast the incidents themselves, making security design and custody choices central to how both users and institutions participate in crypto.