September emerged as the most damaging month for crypto security in 2026, with hacks and exploits causing more than USD 766 million in gross losses. The surge was driven by major breaches at Bitget and Liquid Network.
Blockchain security firms PeckShield and CertiK reported slightly different figures for the month. PeckShield recorded 55 major security incidents and estimated stolen funds at USD 766.5 million. CertiK tracked 97 incidents and put losses at USD 768.4 million.
CertiK’s dashboard shows 656 security incidents and about USD 2.68 billion in losses across the crypto sector during 2026. The Bitget hack represented the largest single incident during September. The exchange initially estimated the theft at USD 351.6 million before revising the figure to USD 387.5 million after completing a broader review of affected transfers. \
Bitget said, “ Attackers exploited a vulnerability in a third-party security product to obtain intranet access credentials. They then manipulated withdrawal commands within the wallet infrastructure. The cold wallets remained unaffected and its protection fund exceeded USD 464 million.”
The Liquid Network incident also contributed heavily to September’s total. The attack involved roughly USD 320 million in losses, according to security researchers and industry reports. However, more than USD 270 million was subsequently returned, meaning the gross incident figure does not equal the final unrecovered amount.
For exchanges, wallet providers and decentralised finance platforms, the incidents reinforce the importance of stronger access controls, transaction monitoring and rapid incident response. The concentration of losses in a few major breaches also demonstrates how infrastructure vulnerabilities can create significant financial exposure across digital-asset markets.
Also Read: Crypto as Company Asset: Tax, Accounting Rules for Web3 Firms