September 2026 Records 2026’s Highest Crypto Hack Losses — Is It the Second-Worst Month in Three Years?

• September recorded $768.5M in crypto losses, the highest monthly total of 2026.
• Bitget and Liquid Network accounted for 92% of September’s total crypto losses.
• Recoveries cut net losses to $495.3 million, down 35.6% from the gross total.

Crypto security incidents cost the industry $768.5 million in September 2026, making it the most expensive month of the year for hacks, exploits, and other breaches, according to CertiK.

Of that amount, $273.2 million was recovered or frozen, leaving $495.3 million in actual losses.

There were 99 security incidents in September, with an average loss of $7.8 million per incident. The numbers show that a few major attacks drive up total losses greatly, even when the number of incidents stays low.

September’s Losses Were the Highest in 2026

September recorded $768.5 million in crypto losses, more than any other month in 2026. Two major attacks caused most of the damage.

• The Bitget breach caused $387.5 million in losses, or about 50% of September’s total.
• The Liquid Network exploit caused another $318.7 million in losses.
• Together, the two attacks made up about 92% of all losses reported in September.

This was different from earlier months, when losses were spread across more smaller incidents. 

CertiK’s data shows that September’s losses were also among the highest monthly totals since 2023. However, the ranking changes depending on whether you count total losses or only money that was not recovered.

Bitget and Liquid Network Caused Most of the Losses

The two biggest attacks in September caused far more damage than the other incidents. Bitget lost $387.5 million after attackers compromised its wallet system and moved assets across several networks.

Liquid Network lost $318.7 million due to a vulnerability in the code used to verify certain transactions. Meanwhile, other attacks were much smaller. 

• Safe Wallet: $7.8 million
• D’CENT App Wallet: about $6 million
• Duelbits: about $6 million
• Shivon Zilis-related case: $4.7 million
• Drop: $4.4 million
• Unidentified victim: $4.3 million
• Nostra Finance: $3.5 million
• Other unidentified wallets: $2.9 million

Overall, these smaller attacks added to September’s losses, but Bitget and Liquid Network accounted for most of the damage.

Exploits Account for Most Losses

The attack-vector breakdown further explains the concentration of September’s losses. Exploits accounted for $733.8 million, representing 95.5% of total losses. Private key compromises contributed $14.2 million, while wallet compromises accounted for $11.9 million.

Phishing generated $6.2 million in losses, followed by scams at $2.1 million. Other attack categories contributed approximately $340,000.

By incident count, exploits accounted for 58.6% of incidents, or 58 cases. Phishing followed with 13 incidents, while private key compromises accounted for 11. Wallet compromises accounted for eight incidents, threats for seven, and other attacks and scams for one each.

The figures show that exploits caused both the largest share of financial damage and the most incidents.

Recoveries Reduced the Final Losses

In September, $273.2 million in stolen funds were frozen or recovered, significantly reducing the industry’s total losses. Without these recoveries, losses would have been close to $768.5 million. After the recoveries, net losses fell to $495.3 million, down about 35.6%.

The remaining losses still show the serious financial impact of major security breaches. 

In sum, September’s data also shows that a few major attacks can cause most of the damage. Just two incidents were responsible for more than 90% of the month’s losses, showing how one compromised system can cause more damage than many smaller attacks combined.

Related: Bitget Hack Reveals What Really Builds a Crypto Community: Trust, Support and Shared Responsibility