Crypto Hacks Hit $768M in September 2026 — Worst Month of the Year

Crypto investors suffered their worst month of 2026 in September, with two leading blockchain security firms tallying combined losses exceeding $766 million from hacks and exploits. According to PeckShield, 55 major incidents resulted in $766.5 million in stolen funds, while CertiK recorded 97 incidents and estimated losses at $768.4 million. Both figures represented a sharp increase from August.

The bulk of September's losses stemmed from two high-profile attacks. The $388 million Bitget breach and a $320 million exploit targeting the Liquid Network accounted for the majority of the damage, though more than $270 million from the Liquid Network incident was subsequently returned, according to reports. Both incidents rank among the largest crypto thefts of 2026. "September was a stark reminder of how quickly the threat landscape can shift," CertiK said in a statement.

Other notable September incidents included Safe Wallet losing $7.8 million, DCENT suffering a $6 million exploit, and Duelbits reporting a $5.9 million loss. The Bitget hack has been traced by SlowMist to a zero-day exploit dating back to August 31, with the exchange's CEO pointing to a third-party security vulnerability and suspecting North Korean actors based on IP evidence.

CertiK's security dashboard now shows 656 total security incidents in 2026, with cumulative losses reaching $2.68 billion. The September surge underscores persistent vulnerabilities across crypto exchanges and DeFi protocols, reinforcing the need for stronger third-party risk management and real-time threat monitoring as the industry heads into the final quarter.