September crypto hacks topped $766 million, led by Bitget and Liquid

Crypto hacks and exploits caused more than $766 million in reported losses in September, making it 2026’s worst month so far, with Bitget and Liquid Network accounting for most of the total. Cointelegraph’s report said PeckShield counted 55 major incidents and $766.5 million in stolen funds, while CertiK counted 97 incidents and estimated $768.4 million.

The two firms’ estimates are close, but their incident counts differ. The monthly totals are gross losses: the Liquid Network attacker later returned most of the bitcoin taken in that exploit.

How did the Liquid Network exploit release real bitcoin?

Liquid represents bitcoin held in reserve with L-BTC tokens on its sidechain. To withdraw bitcoin, a user sends L-BTC through the network’s peg-out process, which releases the matching BTC from the reserve. On September 6, a flaw in Liquid’s transaction validation let an attacker create about 4,000 L-BTC without backing them with bitcoin, then exchange those tokens for roughly $320 million in real BTC.

Blockstream’s incident assessment said a rangeproof verification cache flaw let a transaction pass validation despite its output not being backed by its inputs. Liquid nodes accepted the transaction, and the peg-out process treated the newly created tokens as valid. Blockstream says 3,400 BTC were returned on September 7; about 602 BTC remain subject to recovery efforts. It coordinated a halt of Liquid’s bridge nodes and released a software fix.

What drove the rest of September’s total?

The other largest incident was a breach at crypto exchange Bitget. Cointelegraph put the loss at about $388 million. Together, Bitget and Liquid account for roughly $708 million of the month’s reported $766.5 million to $768.4 million, based on the rounded figures.

Bitget later said investigations by Mandiant and SlowMist identified a compromise of third-party security products that enabled unauthorized access to the exchange’s wallet environment. The two firms’ findings broadly matched the attack path Bitget had disclosed. The exchange’s first incident notice said cold wallets remained secure, while some hot and warm wallets were affected.

How much did the figures rise from August?

PeckShield’s September estimate was far above its August total of about $136 million, according to Cointelegraph. Its tracker counted 50 major incidents in August and 55 in September. CertiK likewise described September’s losses as a significant increase from August.

The headline total reflects how a small number of large breaches can dominate a monthly tally. Liquid’s partial recovery changed how much bitcoin remained missing from that incident, but it did not erase the original theft from the gross loss figures reported for September.