Crypto hacks produced roughly $2.35 billion in net losses in 2026 after accounting for freezes and returned funds, according to a Lightning.news report shared with Bitcoin Magazine. The figure is drawn from a compilation by security researcher Stacy Muur of protocols hacked for more than $50,000, covering 230 protocols year-to-date.
September alone accounted for about $768 million in Muur's tally. The losses were driven mainly by centralized exchanges and DeFi rather than by Bitcoin self-custody hardware wallets, which drew significant news coverage during the period.
Largest single incident
The biggest loss was Bitget's September 24 drain of roughly $387.5 million from hot and warm wallets. The exchange and firms including Chainalysis, Elliptic, and TRM Labs linked the incident to North Korea, citing IP patterns consistent with prior DPRK-linked VPN use and on-chain overlaps with wallets tied to earlier Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. Attackers used third-party security products to inject fraudulent withdrawal commands without taking private keys.
Liquid Network inflation bug
Liquid Network, Blockstream's Bitcoin sidechain, took the next-largest hit when attackers exploited an Elements software bug in early September to mint about 4,000 unbacked L-BTC and peg them out for roughly 4,000 real bitcoins, valued near $320 million at the time. The self-described white-hat actors returned 3,400 BTC after negotiations conducted on-chain via OP_RETURN messages and kept about 600 BTC. No federation keys were compromised; the loss stemmed from an inflation bug in the Liquid network protocol.
Samson Mow later described the episode as part of an "avalanche of AI-assisted attacks" that had already reached other Bitcoin-adjacent software before hitting Liquid. The network is running again and has covered the losses.
DeFi losses
DeFi platforms showed a similar pattern of concentrated, high-value losses:
- Drift Protocol lost approximately $285–296 million in an April governance and multisig compromise involving months of social engineering. An investigation commissioned by the project attributed the operation to North Korean actors.
- KelpDAO's LayerZero-powered rsETH bridge was drained of roughly $292 million in unbacked tokens after a single-verifier design was subverted. LayerZero said preliminary indicators pointed to DPRK's Lazarus Group, specifically TraderTraitor.
- Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August. Validators later rewound the chain and recovered the majority, though several million dollars already bridged off-network were not restored.
Hardware wallet incidents
Incidents involving Bitcoin hardware wallets were smaller in aggregate despite wide coverage. Galaxy Research placed the Coinkite RNG hack at roughly 1,596–1,789 BTC, on the order of $100–130 million, with higher upper-bound estimates near 2,055 BTC.
Ledger losses of roughly $86–102 million traced to devices sold through authorized Southeast Asian reseller CryptoBilis, where an unauthorized hardware implant captured recovery phrases during setup in a supply chain attack. The company said confirmed cases were limited to that reseller's supply chain and that its own systems and direct sales were unaffected, though there are unconfirmed reports of such bugged devices reaching German markets. Combined, these hardware-adjacent events remain well below the single largest CEX and DeFi incidents.
AI and the security arms race
The year coincided with the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development. Muur said that "AI is definitely making it much easier to find and exploit bugs. I think we're entering a pretty serious cybersecurity arms race."
Reports note that code-flaw exploits accelerated after the February release of models such as GPT-5.3-Codex and Claude Opus 4.6, which showed high success rates on smart-contract bug benchmarks at low cost. OpenAI has disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls to complete tasks.
Most of the year's largest heists still relied on traditional vectors such as key compromise, social engineering, and infrastructure flaws, but the lowered barrier for discovering and weaponizing bugs adds a new layer of risk, particularly for complex smart-contract systems and sidechains.
Base layer unaffected
Bitcoin's base layer itself has not been the source of these losses. The bulk of the 2026 damage concentrated in CEX hot-wallet infrastructure, DeFi governance, oracle designs, and Bitcoin sidechain code, while pure self-custody hardware wallets, even when imperfect, accounted for a distinctly smaller share. Nevertheless, industry leaders have called for updated self-custody recommendations, pushing multivendor multisig wallets as the future of the niche.
