September 2026 was the worst month of the year for crypto hacks: $766 million stolen, over 92% of it from Bitget and Liquid

September 2026 by the numbers

By CertiK's count, platforms and users lost about $766.4 million to hacks and phishing in September. That is the highest figure of 2026, both in dollar terms and in the number of incidents. August's losses came to $215 million, so the total grew more than 3.5 times in a single month. The entire first half of the year added up to $1.32 billion across 344 incidents, and September alone produced more than half that amount.

Almost all of it came from two hits. Liquid Network lost $318.7 million on September 6, and Bitget lost $387.5 million on September 24. Together they account for more than 92% of the month's losses, and the other large incidents nearly disappear beside them.

Who was robbed and how

By type of victim, centralized exchanges top the list with $387.5 million, followed by mainnets with $325.1 million. Individuals lost $18.5 million, DeFi $13.3 million and gambling projects $5.99 million.

By attack vector, CertiK breaks the losses down like this:

• Third-party service breach — $387.5 million, exactly the amount Bitget lost.
• Invalid signature — $324.7 million.
• Wallet compromise — $20.1 million.
• Access control flaws — $13.3 million.
• Reentrancy — $2.25 million.

In the first half of the year, wallet compromise was the most expensive vector, costing victims $444.5 million. In September it accounted for only $20.1 million, while most of the money went out through the third-party service and forged signatures.

Bitget: almost a month inside the exchange

On September 30, SlowMist and Mandiant, which are investigating the breach, published interim findings. The attackers got into the system as early as August 31 through a zero-day vulnerability in a third-party security product that has not been named, and they stayed inside for almost four weeks before the theft. In effect, the door was opened by the very software that was supposed to protect the exchange.

No private keys were stolen. The attackers obtained internal employee credentials and launched their own tool that forged withdrawal parameters. Bitget's own signing systems then approved the fake transfers.

The theft itself, on September 24, lasted 2 hours and 52 minutes, from 18:31 to 21:23 UTC. The largest wave, about $185 million, went out at 19:16 UTC. Only hot and warm wallets were affected, while cold storage and the Bitget Wallet app were left untouched.

Bitget, Elliptic analysts and on-chain researchers treat North Korea as the working theory, although no government has officially announced an attribution. We covered what the first hours looked like in our breakdown of how hackers drained funds from Bitget's hot wallets. If your coins are still sitting on Bitget, read our instructions on how to withdraw your crypto from Bitget to a personal wallet.

Liquid: 36 minutes from empty tokens to real bitcoin

Liquid is a Bitcoin sidechain built by Blockstream. Users lock up BTC and get L-BTC tokens in return, which can later be redeemed back for bitcoin. TRM Labs has reconstructed the attack minute by minute.

At 13:53 UTC on September 6, the attackers minted about 4,000 L-BTC with no backing whatsoever. They were helped by a bug in the range proof verification cache in the Elements software, which let an invalid output pass as one that had already been checked. At 14:06 UTC a withdrawal request went out through SideSwap, and at 14:28 UTC the Liquid federation, an 11-of-15 multisig, approved a payout of about 4,000 BTC. Getting from minting empty tokens to holding real bitcoin took 36 minutes.

The payout was worth roughly $319 million. On September 7 the attackers returned about 3,400 BTC, roughly $272 million or 85% of the loot. They kept the other 598.5 BTC, about $47 million, as a "bounty" and wrote on-chain that they were "white hat hackers." Nobody has confirmed that claim.

Blockstream has released a fix for Elements, and the signing keys were not compromised. The Liquid network is still paused, though: L-BTC trading and redemptions are halted, and the tokens are estimated to be about 86% backed.

In both of the month's biggest hacks the keys stayed safe, and the transfers were approved by the victims' own systems after those systems had been fed forged data. That is why there is no point keeping coins on an exchange just to swap them later: you can trade them through an instant crypto exchange that needs no account.

Where the stolen money goes

The funds stolen from Bitget were laundered through CoW Protocol orders, cross-chain swaps on Chainflip and CoinJoin for the bitcoin. Platforms reacted in different ways. Chainflip tried to block the swaps, THORChain refused to blacklist the addresses, citing its open architecture, and the SHIELD system at NEAR Intents blocked more than $50 million tied to the attackers.

On September 30 it was ZEC's turn. Between 08:15 and 08:46 UTC, three transfers moved 2,746 ZEC, about $3.9 million, into Zcash's Ironwood shielded pool. That is roughly 15% of the ZEC stolen from the exchange, out of about 18,917 in total. Those coins are now harder to follow, but investigators are still matching the timing and amounts of funds coming out of the pool.

Over the month as a whole, CertiK says $270.6 million of the $766.4 million has been returned or frozen. About $496 million has not been recovered so far.

What this means for you

An ordinary holder lands in reports like this either together with a hacked platform that holds their balance or on their own, through a personal wallet. Individuals lost $18.5 million in September alone. A few habits noticeably cut both risks.

• Your exchange balance is the exchange's IOU. The exchange holds the keys to the coins, and after a hack your withdrawal depends on its reserves and its decisions. Keep a working amount there for trading and your savings in your own wallet. If you don't have a wallet yet, start with our guide on whether to keep your crypto in a custodial or non-custodial wallet.
• Seed phrase: offline only. On paper or metal, with no photos, cloud storage or notes on your phone. We compared the different methods in our guide on where to keep a seed phrase so you don't lose your crypto.
• Don't sign what you don't understand. If your wallet asks you to approve a transaction or grant a token permission and you can't tell what it is or why it's needed, decline. A token spending approval you have granted stays active even after you close the site.
• Check the entire address. Compare every character, including the ones in the middle. Malware can swap an address in your clipboard, and scammers can slip a lookalike address into your transaction history.
• Don't trust "compensation" emails. A big hack is a familiar pretext for phishing: refund emails, "urgent wallet verification," fake support sites. Real support never asks for your seed phrase, password or 2FA codes.

If you still have stablecoins on an exchange and want to hold your reserve in bitcoin in your own wallet, you can exchange USDT TRC20 to Bitcoin without registration. VertEXchange has no accounts or balances, and coins go straight to your address. If you hold ether, you can swap ETH to BTC on the same terms.

Frequently asked questions

How much crypto was stolen in September 2026?

About $766.4 million was lost to hacks and phishing, according to CertiK. That makes September the worst month of 2026 by both the amount stolen and the number of incidents, with losses more than 3.5 times August's total.

How was Bitget hacked?

According to interim findings from SlowMist and Mandiant, the attackers got in on August 31 through a zero-day vulnerability in a third-party security product, obtained employee credentials and ran their own withdrawal tool with forged parameters. The exchange's signing systems approved those transfers, and no private keys were stolen.

Who hacked Bitget?

Bitget, Elliptic and on-chain researchers are working on the theory that North Korea is behind it. No government has officially announced an attribution.

What happened to Liquid Network?

On September 6, attackers used a bug in the Elements software to mint about 4,000 unbacked L-BTC and got about 4,000 BTC for them, roughly $319 million. The next day they returned about 3,400 BTC and kept 598.5 BTC. Blockstream has released a fix, but the network is still paused, with L-BTC trading and redemptions halted.

Will the stolen money be returned?

Partly. Of the $766.4 million lost in September, $270.6 million has been returned or frozen, and about $496 million is still unrecovered. The Liquid attackers gave back 85% of the bitcoin, and in the Bitget case the SHIELD system at NEAR Intents blocked more than $50 million tied to the attackers.

How can I protect my crypto from hacks?

Keep only your trading money on an exchange and your savings in your own wallet. Store your seed phrase offline, don't sign transactions or approvals you don't understand, check the recipient's address in full and ignore "compensation" emails after high-profile hacks.