Crypto hacks topped $768 million in September, the worst month of 2026 so far

September was the ugly outlier for crypto security in 2026: two blockchain security firms put monthly losses at more than $766 million, with the month dominated by the $388 million Bitget hack and the $320 million attack on the Liquid Network. For PSPs, exchanges, and other high-risk operators, the useful takeaway is simple: when incident volume and ticket size both jump, counterparty and treasury exposure can move just as fast as the headlines.

1. PeckShield counted 55 major incidents in September, with $766.5 million in stolen funds. CertiK recorded 97 incidents and estimated losses at $768.4 million. Both figures marked a significant increase from August, which is exactly the sort of monthly swing that matters when you are assessing processor, exchange, or wallet risk.
2. The month was driven by two large events: the $388 million Bitget hack and a $320 million hack of the Liquid Network. More than $270 million was later returned, according to reports. In practice, that means gross loss and net loss are not the same thing, but both still matter for operational risk, restitution exposure, and settlement planning.
3. Other September incidents included Safe Wallet, DCENT, and Duelbits, which lost $7.8 million, $6 million and $5.9 million, respectively. These are smaller than the month’s headline thefts, but for high-risk merchants they are the reminder that the long tail of incidents is still expensive enough to affect uptime, customer balances, and incident-response costs.
4. CertiK said, “September was a stark reminder of how quickly the threat landscape can shift.” Its security dashboard shows 656 security incidents in 2026 so far, with total losses of $2.68 billion. That is the number to keep in mind when vendors talk about crypto security as if it were a static checkbox.