Crypto hackers stole $768M in September, the worst month of 2026, led by Bitget and Liquid Network breaches

Crypto hackers stole about $768 million in September, making it the worst month of 2026 for security breaches, according to CertiK and PeckShield.

Two attacks, on exchange Bitget and the Liquid Network, accounted for roughly $700 million of the total.

Bitget breach becomes one of September’s biggest crypto hacks

The Bitget incident was the largest single contributor to September’s crypto hacks, with the amount affected ultimately revised to approximately $387.5 million. The exchange initially estimated the loss at $351.6 million before updating the figure following a more detailed reconciliation of the transactions.

Bitget said its security systems detected unauthorized transfers from certain hot and warm wallets on September 24.

According to the exchange’s investigation, an attacker exploited a vulnerability in a third-party security product to obtain internal access credentials and then used fraudulent withdrawal commands to bypass existing risk controls.

The company said its cold wallets were not affected and that private keys were not compromised. Bitget also said its protection fund, which held more than $464 million, was sufficient to cover the financial impact of the incident.

The breach illustrates an important distinction within crypto security. While blockchain networks and cold-storage systems can remain intact, weaknesses in connected infrastructure, wallet-management systems and access controls can still create substantial losses.

Bitget subsequently began a phased process for restoring withdrawals while continuing its investigation and asset-recovery efforts.

Liquid Network attack adds $320M to crypto hacks losses

The second major incident involved the Liquid Network, a Bitcoin-based network that reported approximately $320 million in cryptocurrency withdrawn from its federation wallet.

Reuters reported that roughly 4,000 of the approximately 4,200 Bitcoin held in the affected wallet were taken during the incident. Liquid Network halted new transactions as a precaution while assessing the breach.

The incident was particularly significant because it accounted for a large portion of September’s overall losses. However, the amount ultimately retained by the attacker was lower than the initial value associated with the breach because more than $270 million was reportedly returned.

The Liquid incident therefore contributed heavily to September’s aggregate figures while its ultimate financial impact remained subject to recovery developments.

What September’s crypto hacks mean for investors

The September numbers provide another indication that cybersecurity remains a material consideration for participants in the digital-asset market.

Although the number and scale of incidents can fluctuate considerably from month to month, the concentration of losses in large attacks means a single vulnerability can have consequences worth hundreds of millions of dollars.

Other September crypto hacks included incidents involving Safe Wallet, DCENT and Duelbits. Reported losses from those incidents were approximately $7.8 million, $6 million and $5.9 million, respectively.

The figures also show why investors need to distinguish between different types of security exposure. Exchange breaches, wallet compromises, smart-contract exploits and infrastructure attacks can involve different technical vulnerabilities and therefore carry different risks.

September’s experience followed several other major security incidents earlier in 2026. The industry had already recorded significant attacks involving DeFi protocols, bridges and other cryptocurrency infrastructure before the Bitget and Liquid breaches added substantially to the year’s losses.

CertiK’s dashboard puts total 2026 security losses at approximately $2.68 billion across 656 incidents, demonstrating that crypto hacks continue to represent a significant operational and financial risk across the digital-asset ecosystem.

The September figures also reinforce the importance of rapid incident detection and effective recovery procedures. In both major cases, the response following the breaches became an important part of the story, whether through asset tracing, withdrawal restrictions, investigations or efforts to recover stolen funds.

As cryptocurrency adoption expands, the ability of exchanges, blockchain networks and infrastructure providers to protect assets will remain closely watched by investors.

September’s record losses show that security failures can quickly become market-relevant events, particularly when a single incident involves hundreds of millions of dollars.