September 2026 became the worst month for cryptocurrency hacks in 2026, with total losses reaching $766.49M across 99 security incidents. This represented a 462% increase in stolen funds compared to August and surpassed April's previous high of $648M.
The two largest exploits dominated the monthly theft total. Bitget lost $387.5M to a compromised wallet key attack, while the Liquid Network exploit resulted in $320M in losses, though approximately $285M was subsequently returned. These two incidents now rank as the year's largest hacks, exceeding previous major exploits from Drift Protocol, KelpDAO, and LayerZero.
The remaining hacks varied significantly in scope and method. A Gnosis safe attack was front-run by the Yoink bot, with funds returned. Other incidents ranged between $3M and $7M, targeting wallets, bridges, and Web3 applications. In total, 13 exploits exceeded $500K in losses.
Diverse Attack Methods
The exploits employed multiple techniques. Compromised wallet keys gave hackers direct access to hot wallets, while other attacks exploited flaws in bridge, contract, and minting logic. Decentralized price manipulation and trading exploits accounted for additional minor losses. Web3 infrastructure vulnerabilities represented a substantial share of the attacks.
Following successful thefts, hackers moved funds within hours and mixed them through decentralized exchanges, Tornado Cash, and no-KYC exchanges within days. September activity included conversions to Monero and shielded ZCash, indicating attempts to increase transaction privacy.
Q3 Trends and Broader Patterns
Third quarter losses totaled $1.2B, up 53% from Q2's $819.4M. The quarter saw 247 total security incidents, a 12.8% increase from Q2.
Ethereum and BNB Smart Chain remained the most frequently targeted networks, though occasional attacks affected niche Layer 2 solutions like Liquid. Scams comprised only 1% of exploits, while phishing represented 11% of Q3 incidents.
Security breaches have persisted at elevated levels over the past two years, occurring regardless of market conditions. Hackers continue to target points of elevated liquidity across evolving Web3 infrastructure. The concentration of incidents indicates that stricter security measures and audits are needed across protocols, exchanges, and other ecosystem participants.
