Cryptocurrency hacks and exploits totaled $766.49 million in September across 55 major incidents, marking an increase of about 462% compared to August's $136.3 million in losses, according to data from PeckShield.
The sharp increase was heavily concentrated in two major breaches. The Bitget incident accounted for approximately $387 million, while the Liquid Network theft involved about $320 million, of which $285 million was subsequently returned. Together, these two events rank as the largest and second-largest crypto thefts of the year to date, surpassing prior exploits involving Drift and KelpDAO/LayerZero.
Excluding the Bitget and Liquid events, the remaining 53 hacks during September totaled about $59 million, representing less than half of August's total losses.
Details of the Major Incidents
In the Bitget incident, unauthorized transfers from portions of the exchange's hot wallets were flagged on September 24 at 18:31 UTC. According to CEO Gracy Chen, an attacker infiltrated a backend system in the wallet infrastructure, spoofed transaction data, and manipulated the authorization process to release funds. Chen stated that cold wallets, which hold the majority of the exchange's assets, were unaffected and that private keys were not compromised. Bitget announced plans to cover the losses using its User Protection Fund, which holds over $464 million.
The Liquid Network incident occurred earlier on September 6, when approximately 4,000 BTC were withdrawn from the Liquid Federation wallet using the SideSwap peg-out authorization key, though Liquid noted the key itself was not compromised. On-chain messages indicated the withdrawing party promised to return the funds after nodes were patched, though security figures expressed skepticism regarding the method.
Laundering and Smaller Exploits
Updates from SlowMist indicated that North Korea-linked actors attempted to launder stolen Bitget funds by converting proceeds to Bitcoin through CoW Protocol orders and Chainflip deposit addresses, followed by the use of CoinJoin. SlowMist founder Cos noted that anti-money laundering mechanisms are struggling to keep pace with automated scripts, while Chainflip reportedly blocked certain flows and rejected deposits.
Other entries in PeckShield's top ten losses for September ranged between $3.15 million and $7.81 million. This included an MEV bot front-run incident involving "yoink," which was returned, and a white-hat rescue operation involving the LimitBreak contract, which accounted for $6.6 million with $3.4 million returned.
