Crypto hacks hit $772M in September, CertiK dashboard shows

Crypto platforms and users lost $772.4 million to security incidents in September, according to CertiK’s latest security dashboard, making it the costliest month of 2026. The tally is led by the Bitget breach and Liquid Network exploit; it is a gross-loss figure, so it includes funds later returned.

Which incidents drove September’s total?

Bitget accounted for $387.5 million and Liquid Network for $318.7 million, CertiK’s dashboard shows. Together, those two incidents made up about 92% of its September total.

Bitget said attackers exploited a vulnerability in a third-party security product to obtain internal access credentials and forge withdrawal commands. The exchange put the affected amount at about $388 million and said its private keys and cold wallets were not compromised, according to its incident update cited by Cointelegraph’s report on September losses.

How did the Liquid Network exploit work?

Blockstream attributed the Sept. 6 incident to a flaw in Elements, the open-source software that underpins Liquid. The flaw allowed an attacker to create about 4,000 unbacked L-BTC, then use Liquid’s peg-out process to withdraw roughly 4,000 BTC, worth about $320 million at the time.

The attacker returned 3,400 BTC on Sept. 7, according to Blockstream’s technical assessment. About 602 BTC remained outstanding in that assessment, which explains why the monthly gross-loss tally is higher than the amount still missing from Liquid.

Why do security firms report different totals?

CertiK’s current dashboard lists $772.4 million for September, while a report published Oct. 1 cited its earlier estimate of $768.4 million. PeckShield counted 55 major incidents and $766.5 million in losses, compared with CertiK’s 97 incidents in that report, reflecting differences in coverage and timing.

CertiK’s dashboard classifies $739.5 million of September’s losses as exploits and lists 100 incidents across its attack-type categories. The figures can change as firms update incident valuations and recovery data, so the dashboard remains the current reference for CertiK’s tally.

What happens to the funds still missing?

Blockstream said about 602 BTC from the Liquid incident remained outstanding as of its Sept. 25 assessment. The attacker’s return of 3,400 BTC reduced the unrecovered amount, but the security firms still count the original withdrawal in September’s gross-loss totals.