September 2026 has become the worst month of the year for cryptocurrency security breaches, with hackers stealing more than $768 million. Data from Certik showed a sharp increase in exploit-related losses compared with August, as dozens of separate incidents affected projects across the crypto industry.
CertiK recorded 97 distinct security incidents during September, putting total losses at approximately $768.4 million. PeckShield, which tracked 55 major exploits, estimated the damage at $766.5 million. While the firms recorded different numbers of incidents, both estimates placed September’s losses at more than $766 million.
CertiK’s security dashboard now shows 656 security breaches recorded throughout the year, with total losses reaching approximately $2.68 billion. The latest figures make September a major contributor to the year’s overall crypto security damage and underscore the scale of losses from exploits across the industry.
Crypto users see these security losses as terrifying
Crypto users on X reacted strongly to the scale of September’s security losses, with several posts describing the $768 million figure as “terrifying” and a “bloodbath.” Sergei Sergienko highlighted the size of the losses in a video post, while other users argued that the figure represents a security concern rather than a temporary market decline.
Your assets aren’t as safe as they promised. Seven hundred sixty-eight million proof. Gone. September just became the worst month for crypto hacks in all of twenty twenty-six. That’s not a dip. That’s a bloodbath. One month. One figure that should terrify every single p https://t.co/8aMi1oGzwk
— Sergei Sergienko (@sergei000) October 1, 2026
Some reactions focused on the concentration of the losses in two major incidents. Users noted that the Bitget exploit, estimated at $388 million, and the Liquid Network breach, estimated at $320 million, together accounted for roughly 92% of September’s reported losses. One post from Max used dark humour to compare the hackers’ proceeds with the recurring revenue of startups
“the hackers have better monthly recurring revenue than most startups”
reflecting the scale of the two incidents.
Bitget’s response has also been part of discussions about the scale of the incident. The exchange said it had replenished its User Protection Fund to more than $300 million following the reported $388 million exploit. Bitget backs the fund with its own capital. It is intended as an additional safeguard for user assets, providing context on how the exchange is addressing concerns following one of September’s largest security incidents.
Bitget and Liquid Network hack account for most losses
Two major exploits accounted for the bulk of the cryptocurrency losses recorded in September 2026. The largest incident involved Bitget, where an exploit resulted in approximately $388 million in stolen funds. The scale of the attack made it one of the year’s biggest crypto security incidents, although Bitget said its user protection fund remained strong enough to protect affected users.
The Liquid Network was hit by another major breach, with losses estimated at around $320 million. Together, the Bitget and Liquid Network incidents represented roughly $708 million, meaning the two attacks accounted for more than 92% of the $768.4 million in losses recorded by CertiK for September. Despite the size of the attacks, more than $270 million was reportedly returned or recovered, reducing the amount of capital that ultimately remained compromised.
September’s security wave also affected several other crypto platforms and protocols, although their losses were considerably smaller than the two mega-exploits. Safe Wallet recorded approximately $7.8 million in losses, while DCENT suffered about $6 million and Duelbits lost around $5.9 million. The contrast shows how a small number of large-scale exploits can dramatically influence monthly crypto security figures, even when dozens of other breaches occur in the same period.
Why Are Crypto Hacks Still Producing Such Large Losses Despite Better Security Tools?
Crypto security has improved significantly. Exchanges use multi-signature wallets, hardware security modules, real-time monitoring, transaction screening, and automated systems designed to detect suspicious activity. Yet September 2026 showed that stronger security tools have not stopped attackers from causing huge financial damage.
Security tools are designed around known vulnerabilities and detectable patterns, while hackers are constantly looking for new ways around them. As crypto infrastructure becomes more sophisticated, the attack surface also grows.
A successful attack on a small protocol may affect thousands or millions of dollars, but compromising a major exchange, bridge, custodian, or network can expose hundreds of millions at once. The Bitget and Liquid incidents that accounted for the overwhelming majority of the month’s reported loss illustrated this.
There is also a difference between protecting assets and protecting the systems that control those assets. An organization can keep funds in secure wallets while still having vulnerabilities in its backend infrastructure, authorization mechanisms, smart contracts, APIs, or administrative systems. Attackers do not necessarily need to break through the strongest layer of security if they can find another route to influence a transaction.
This means the security challenge is no longer about building a better wallet or deploying better monitoring software. It is about securing the entire chain of systems, people, permissions, and infrastructure that can ultimately move large amounts of money.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
