Crypto hack losses reached $766.49 million in September, making it the worst month of 2026 so far. The total jumped about 462% from August’s $136.3 million, according to PeckShield.
Two incidents caused most of the damage. Bitget lost roughly $387 million. Liquid Network lost about $320 million, though the people behind it, claiming to be white hats later returned most of it.
Crypto Hack Losses Top Both of 2026’s Earlier Records
September’s total passed the $646.89 million lost in April, which had been the year’s highest month. The month also took the record for incident count.
PeckShield logged 50 major hacks in August, the highest of 2026 at the time, and then counted 55 in September. Bitget and Liquid Network together account for $707 million, or about 92% of the monthly total.
The remaining 53 incidents cost roughly $59 million combined. Both breaches now rank above the Drift and KelpDAO exploits that led the 2026 tally before September.
Liquid Network has since had 3,400 BTC returned. Funds also came back after a $7.81 million maximal extractable value (MEV) bot front-run.
Payment Processor V2 had $3.4 million of its $6.6 million loss returned. Crypto casino Duelbits lost $7 million, and the Nostra oracle exploit cost $3.5 million.
Bitget Breach Traces Back to August 31, SlowMist Finds
Bitget brought in blockchain security firm SlowMist to investigate the theft from its hot wallets. Its progress report, current as of September 29, shows the compromise began weeks before any funds left.
The earliest malicious activity dates to August 31. An attacker exploited a zero-day flaw, a previously unknown bug, in a third-party security product. Investigators also recovered a custom withdrawal tool from files the attacker had deleted.
SlowMist has not named a culprit, although Bitget CEO Gracy Chen previously pointed to suspected North Korean hackers.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights