September 2026 Sees Crypto Hacks Hit Worst Month of the Year at Over $766 Million

September 2026 emerged as the single worst month of the year for cryptocurrency hacks and exploits, with industry trackers reporting combined losses exceeding $766 million.

Blockchain security firms PeckShield and CertiK tallied losses of approximately $766.5 million and $768.4 million, respectively, across dozens of major incidents ([cointelegraph.com](https://cointelegraph.com/news/crypto-hacks-total-766m-in-september-peckshield?utm_source=openai)). The spike marks a dramatic rise from August’s totals, with one report noting a 462% month‑on‑month increase ([beincrypto.com](https://beincrypto.com/crypto-hack-losses-september-2026-bitget/?utm_source=openai)).

Two breaches dominated the damage. On September 24, Bitget suffered a security breach that drained its hot and warm wallets for nearly $388 million, making it the largest individual theft of the month ([cointelegraph.com](https://cointelegraph.com/news/crypto-hacks-total-766m-in-september-peckshield?utm_source=openai)). Shortly before, on September 6, the Liquid Network sidechain was exploited via a software bug, resulting in roughly $320 million worth of L‑BTC tokens being minted and exchanged for real bitcoin; while the attacker returned around 3,400 BTC, approximately 598.5 BTC remain unrecovered ([nominis.io](https://www.nominis.io/insights/nominis-monthly-report-crypto-exploits-and-attacks-in-september-2026?utm_source=openai)).

Beyond these two major breaches, dozens more incidents occurred. Exploits ranged from DeFi platform drains to smart‑account and bridge vulnerabilities, amounting to approximately $68.5 million in additional losses ([nominis.io](https://www.nominis.io/insights/nominis-monthly-report-crypto-exploits-and-attacks-in-september-2026?utm_source=openai)). Notable among them was the DCENT App Wallet exploit—at least $20 million worth of XRP was drained from tens of thousands of wallets ([nominis.io](https://www.nominis.io/insights/nominis-monthly-report-crypto-exploits-and-attacks-in-september-2026?utm_source=openai)).

These figures underscore a troubling trend: the increasing boldness and scale of crypto crime. From January through September 2026, cumulative losses tracked by CertiK reached roughly $2.68 billion ([cointelegraph.com](https://cointelegraph.com/news/crypto-hacks-total-766m-in-september-peckshield?utm_source=openai)). The third quarter alone accounted for about $1.26 billion in losses across 247 incidents ([cryptocompass.com](https://cryptocompass.com/articles/1-26-billion-in-three-months-crypto-hacks-hit-their-2026-high?utm_source=openai)).

Attribution has also surfaced geopolitical implications. North Korea has been strongly implicated in the Bitget hack, with cybersecurity firms referencing IP addresses connected to known DPRK infrastructure ([tomshardware.com](https://www.tomshardware.com/tech-industry/cryptocurrency/north-korea-named-as-primary-suspect-in-usd387-million-bitget-crypto-hack-investigators-identify-ip-addresses-tied-to-vpn-infrastructure-previously-used-by-north-korean-hacker-groups-thieves-swapped-stablecoins-for-eth-in-minutes-to-dodge-freezes?utm_source=openai)).

The severity of these events highlights ongoing vulnerabilities across custodial exchanges, sidechains, and wallet infrastructure. As crypto continues to mature, it faces mounting pressure to bolster security measures and protect increasing amounts of decentralized value.