Cryptocurrency hack losses reached $766.49 million in September 2026, making it the year's worst month for security breaches. The figure represents a 462% jump from August's $136.3 million in losses, according to security tracking firm PeckShield.
Two major incidents accounted for the majority of September's losses. Bitget suffered a theft of approximately $387 million from its hot wallets, while Liquid Network lost about $320 million, though the attackers later returned most of the stolen funds.
Record Month and Incident Count
September surpassed the previous high of $646.89 million lost in April 2026. The month also saw the highest number of hacking incidents recorded in 2026, with PeckShield logging 55 major breaches compared to 50 in August.
The Bitget and Liquid Network incidents together accounted for approximately $707 million, or about 92% of September's total losses. The remaining 53 incidents cost roughly $59 million combined.
Recovery Efforts and Other Breaches
Liquid Network recovered 3,400 Bitcoin from the attackers. Additional funds were returned following a $7.81 million front-run involving a maximal extractable value (MEV) bot.
Other significant incidents in September included Payment Processor V2, which recovered $3.4 million of its $6.6 million loss, and Duelbits crypto casino, which lost $7 million. The Nostra oracle exploit resulted in $3.5 million in losses.
Bitget Investigation Findings
Blockchain security firm SlowMist investigated the Bitget breach and traced malicious activity back to August 31. According to SlowMist's progress report current as of September 29, an attacker exploited a zero-day vulnerability in a third-party security product weeks before funds were withdrawn. Investigators recovered a custom withdrawal tool from files the attacker had deleted.
SlowMist has not publicly named a culprit, though Bitget CEO Gracy Chen previously pointed to suspected North Korean hackers.
