Crypto Hacks Expose Limits of Exchange and Hardware Custody
September was the worst month of 2026 for crypto theft, with Immunefi reporting $742 million lost across 33 hacked entities. This amount alone accounts for roughly a third of all money stolen in hacks so far this year.
About $270 million was later returned by an attacker, but the losses are still among the costliest since 2023. Twenty-four DeFi protocols were hit, with Bitget and Liquid Network together making up about 95 percent of the month's losses.
The two largest events that defined the month were a $387.5 million loss by Bitget on September 24 after attackers compromised its wallet system, and a $319-320 million loss by Liquid Network on September 6 due to a flaw in its bitcoin peg validation.
Other notable losses include Safe-related user losses of near $7.8 million, D'Cents app wallet losing about $6 million between September 15 and 20, and Duelbits losing roughly $6 million on the same day as Bitget.