September's $768M crypto hack parade: even the security firms can't agree on the body count 💸

September emerged as the worst month of 2026 for crypto hacks and exploits, with two leading blockchain security firms tallying losses exceeding $766 million across dozens of separate incidents. PeckShield reported 55 major incidents resulting in $766.5 million in stolen funds, while CertiK recorded 97 incidents and estimated losses at $768.4 million. Both firms indicated the figures represented a significant increase from August.

The month's largest incidents included a $388 million hack of Bitget and a $320 million exploit of the Liquid Network. More than $270 million of the stolen funds were subsequently returned, according to reports. Other notable breaches involved Safe Wallet, DCENT, and Duelbits, which lost $7.8 million, $6 million, and $5.9 million, respectively.

"September was a stark reminder of how quickly the threat landscape can shift," CertiK said in a statement Wednesday. The firm pointed to the evolving nature of attacks, which this month ranged from zero-day exploits on major exchanges to targeted compromises of wallet providers.

Separately, SlowMist traced activity from the Bitget hack to a zero-day exploit dated Aug. 31, shedding additional light on the timeline of the breach. CertiK's security dashboard records a total of 656 security incidents in 2026, with cumulative losses reaching $2.68 billion. The September incidents rank among the largest crypto thefts of the year, underscoring the scale of exposure facing the industry as attackers continue to outpace defenses.