October 02, 2026 – Bitget and the Liquid Network accounted for about 95% of September’s losses. Most of the Liquid Bitcoin has since come back.
In Summary
DefiLlama data show 33 crypto hacks took about $742 million in September, the most since February 2025.
Bitget lost about $387.5 million from hot wallets, while the Liquid Network lost about 4,000 BTC.
The Liquid attacker returned 3,400 BTC, cutting net losses for the month to roughly $470 million.
Hacks in 2026 have reached about $2.24 billion, already above the total for all of 2024.
Crypto hacks drained about $742 million in September, the worst month of 2026 so far. Two attacks accounted for almost all of it.
That total comes from the DefiLlama hacks database, which logged 33 incidents during the month. The figures are gross, so they ignore any funds later returned.
September’s losses were nearly three times August’s $256 million. In fact, they were the highest for any month since February 2025.
That month, attackers took about $1.5 billion from the Bybit exchange. The FBI later attributed the theft to North Korea.
Two crypto hacks drove the total
The largest incident hit Bitget on 24 September. Attackers moved funds out of the exchange’s hot wallets across several networks.
In an update the next day, Bitget put the loss at about $387.5 million. That was up from its first estimate of $351.6 million.
The affected networks included Ethereum, the XRP Ledger, Zcash and TRON. Mandiant and SlowMist are helping with the investigation, the exchange said.
Bitget also said its Protection Fund covers the impact. It then reopened withdrawals in phases, starting with Bitcoin on 28 September.
Ether followed on 29 September, and USDT on 30 September. Other tokens, fiat and P2P withdrawals are due to return on 2 October.
The second big attack struck the Liquid Network, a Bitcoin sidechain run by a federation of members. On 6 September, an attacker created about 4,000 unbacked L-BTC tokens.
According to Blockstream, the attacker then redeemed them for real bitcoin. The reserve backing L-BTC fell from about 4,205 BTC to 197 BTC.
The flaw sat in how Liquid nodes cached range-proof checks. A coding gap dating from April 2018 let an invalid transaction pass as valid.
Blockstream said nobody had caught the bug in time. In its words, no reviewer, internal or external, identified this risk before the attack.
Most of the Liquid bitcoin came back
The story then took an unusual turn. The attacker, who claimed to be a white hat, sent back 3,400 BTC on 7 September.
About 602 BTC remain outstanding. On the fix side, operators halted the bridge nodes late on 6 September. Blockstream then deployed an emergency patch and shipped a full software fix on 9 September.
The return changes the picture. DefiLlama valued the full Liquid theft at $320 million. On that basis, the returned coins were worth roughly $272 million.
Net of that return, September’s losses would fall to about $470 million. Even so, that would still top every month this year except April.
Smaller attacks still hurt
Beyond the two giants, losses were modest. Gambling site Duelbits lost $7.0 million after a hot wallet key compromise.
On Neutron, Astroport and Drop lost $4.9 million and $4.4 million. Both fell to malicious governance proposals on 22 September.
Nostra, a lending market on Starknet, lost $3.5 million to price manipulation. Together, these four cases made up less than $20 million.
Notably, the number of incidents fell. DefiLlama counted 33 cases in September, down from 48 in August. Fewer attacks, however, caused far bigger damage.
Exchanges and chains bore most of the cost this time. By contrast, DeFi protocols suffered the largest losses across 2026 as a whole, at about $1.17 billion.
How 2026 compares
Losses for the year now total about $2.24 billion. That already exceeds the $1.67 billion stolen in all of 2024.
It is also about 82% of the 2025 total of $2.72 billion. Moreover, three months of the year remain.
Stolen keys and bridge flaws stand out. Key compromises cost about $704 million this year, while bridge and cross-chain attacks took about $696 million.
April was the previous worst month, at $648 million. That month, the Drift and Kelp exploits cost about $295 million and $293 million, respectively.
What it means for the crypto market
Large hacks can shake trust in exchanges and bridges. They can also push some users to move funds into cold storage or self-custody.
For platforms, the lesson is familiar. Hot wallets and cross-chain bridges hold large pools of value, so attackers keep targeting them.
Recovery efforts are also changing. Bounties, rapid freezes, and on-chain tracing now help claw back part of the losses in some cases.
Still, victims cannot count on recovery. The Liquid bug survived for more than eight years before anyone exploited it.
For more on crypto security and bitcoin, follow our coverage. September shows how a few crypto hacks can reshape a whole year.
