In September 2026, losses from cryptocurrency hacks surged to $766.49 million, marking the highest monthly figure for the year. This represents a 462% increase compared to the $136.3 million recorded in August, according to data from PeckShield.
Two major incidents accounted for 92% of the total monthly losses, amounting to $707 million. Bitget suffered a theft of approximately $387 million, while Liquid Network lost about $320 million, though a significant portion of the latter was later returned by individuals claiming to be white hat hackers.
PeckShield reported 55 major security incidents in September, surpassing the previous record of 50 hacks set in August. Other notable losses included $7 million from the crypto casino Duelbits and $3.5 million from the Nostra oracle exploit.
Investigations into the Bitget breach, conducted by SlowMist, indicate that the compromise originated from a zero-day vulnerability in a third-party security product. Malicious activity was traced back to August 31, and investigators identified a custom withdrawal tool used by the attackers.
Some funds were recovered following specific exploits. Liquid Network saw the return of 3,400 BTC, and Payment Processor V2 recovered $3.4 million of its $6.6 million loss. Additionally, $7.81 million was returned after a maximal extractable value bot front-run.
