Crypto platforms and users lost approximately $766.4 million in September 2026 through exploits and phishing, according to a CertiK monthly tally published September 30. The figure marks the highest monthly loss and incident count for 2026, more than triple the $215 million reported in August.
Of the $766.4 million total, roughly $270.6 million was returned or frozen, leaving approximately $495.8 million actually lost. CertiK recorded $1.32 billion across 344 incidents in the first half of 2026, 46.8 percent below the first half of 2025.
Two incidents accounted for over 92 percent of September's losses. The largest was an attack on Bitget between September 24 and 25. CertiK and BleepingComputer cited $387.5 million in losses, while Bitget reported $351.6 million in an earlier statement. Final accounting remains pending.
The second major incident targeted the Liquid Network, a Bitcoin sidechain operated by Blockstream, on September 6. The exploit resulted in the disappearance of $319 million to $320 million, equivalent to approximately 4,000 bitcoin. TRM Labs identified the Liquid incident as the largest single theft of 2026.
The Liquid attack exploited a vulnerability in Elements, the open-source software underpinning the sidechain. The flaw affected how Liquid nodes cache verification of rangeproofs—cryptographic proofs that verify a hidden amount lies within a valid range. The caching error allowed transactions to pass verification even when their output amounts lacked sufficient covered inputs, effectively circumventing the critical cryptographic check and enabling unauthorized fund movement.
Bitcoin traded at approximately $83,800 on September 30, according to CoinGecko data, remaining unchanged from the previous day. Large-scale hacks typically influence user custody decisions rather than immediate asset prices.
