September crypto hacks surge to $766M

TLDR

September 2026 was the worst month of the year for crypto hacks, with roughly three quarters of a billion dollars briefly stolen.

1. Blockchain security firms estimate September losses at about $766 to $768 million across 55 to 97 incidents, a sharp jump from August.
2. Two infrastructure breaches at Bitget and Liquid Network accounted for the vast majority of the losses, while dozens of other hacks were relatively small.
3. The surge reinforces that hot wallets, cross-chain infrastructure and custodial platforms remain high-risk, so users and institutions need tighter operational security and monitoring.

Deep Dive

1. Scale Of Losses

Multiple security firms report that September 2026 was the costliest hack month of the year for crypto. PeckShield counted 55 major incidents with around $766.5 million in gross losses, while CertiK tracked 97 incidents and estimated $768.4 million in losses, a difference of under $2 million in total value. These figures are summarized in reports by Cointelegraph and others as cryptos worst security month of 2026 so far, with year to date losses near $2.68 billion by CertiKs dashboard.

The jump was extreme versus August. PeckShield put August losses at about $136.3 million, meaning Septembers tally was roughly 462 percent higher, according to detailed breakdowns from CryptoPotato and Crypto.news.

2. Where The Money Was Lost

The headline totals are heavily concentrated. Bitgets exchange hot-wallet breach accounted for roughly $387.5 million that reached attacker-controlled addresses, according to post-mortem coverage from Crypto.news and CryptoPotato, after an initial estimate near $351.6 million. Liquid Networks exploit created about 4,000 unbacked L-BTC and enabled nearly 4,000 BTC to be withdrawn, valued around $318 to $320 million, though about 3,400 BTC, worth roughly $270 million, were later returned.

PeckShields own breakdown and CoinsKid community reporting show that once Bitget and Liquid are excluded, the remaining 53 incidents total only about $59 million. Named victims include Safe Wallet (around $7.8 million), DCENT (about $6 million) and Duelbits (roughly $5.9 million), plus a long tail of smaller DeFi, wallet and casino hacks.

3. Risk Patterns And User Takeaways

Analysts note that many of Septembers biggest incidents involved infrastructure and operational security, not just smart contract code. Bitgets own updates and third party analysis point to compromised third party security products and backend authorization logic, while Liquids issue stemmed from a rangeproof cache flaw in its Elements-based sidechain, later patched by Blockstream.

For everyday users, the pattern reinforces several practical points. Keeping large balances in hot or custodial wallets concentrates risk in centralized infrastructure; diversifying into cold storage, using multi-factor authentication, limiting withdrawal permissions and treating unfamiliar apps, links and plug-ins with caution can materially reduce exposure to the kinds of failures seen in September.

Conclusion

Septembers $766 to $768 million in gross losses came primarily from two outsized infrastructure breaches, set against a broader backdrop of rising but uneven security incidents. The month underscores that cryptos weakest points often lie in wallet backends, bridges and sidechains, not just DeFi contracts, and that both platforms and users need to treat operational security as a first class risk alongside market volatility.