Crypto hacks have caused roughly $2.35 billion in net losses so far in 2026 after accounting for freezes and returned funds, according to a Lightning.news report shared with Bitcoin Magazine. Security researcher Stacy Muur compiled a list of protocols hacked for more than $50,000 in 2026, covering 230 protocols year to date. “Crypto security is absolutely cooked,” Muur wrote.

September alone represented about $768 million of the losses in Muur’s tally. The incidents were driven primarily by centralized exchanges and decentralized finance protocols, rather than by pure Bitcoin self-custody hardware wallets, although hardware-wallet failures received substantial media attention during the period.

The largest individual loss was the September 24 theft of roughly $387.5 million from Bitget hot and warm wallets. Hot wallets are the internet-connected storage exchanges maintain to process withdrawals, which makes them recurring targets because their funds are immediately movable. Bitget and blockchain-analysis firms including Chainalysis, Elliptic and TRM Labs linked the incident to North Korea. Their assessments cited IP patterns consistent with previous DPRK-linked virtual private network use and on-chain overlaps with wallets connected to earlier Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. United Nations sanctions monitors have for years documented North Korea-linked cryptocurrency theft as a revenue source for the sanctioned state.

The attackers reportedly used third-party security products to inject fraudulent withdrawal commands without obtaining the exchanges’ private keys.

Liquid Network, Blockstream’s Bitcoin sidechain, suffered the next-largest loss after attackers exploited an Elements software bug in early September. Sidechains like Liquid secure pegged bitcoin through a federation of independent functionaries and run on Elements, an open-source codebase built from Bitcoin’s own. The exploit allowed them to mint approximately 4,000 unbacked L-BTC and peg the tokens out for roughly 4,000 real bitcoins, worth close to $320 million at the time, according to Galaxy Research.

The self-described white-hat attackers returned 3,400 BTC after negotiations conducted on-chain through OP_RETURN messages — a Bitcoin script feature that allows small data payloads, including short public messages, to be embedded in transactions — and kept approximately 600 BTC. No federation keys were compromised. The loss resulted from an inflation bug in the Liquid network protocol.

Samson Mow later described the incident as part of an “avalanche of AI-assisted attacks” that had already affected other Bitcoin-adjacent software before reaching Liquid. The network is operating again after covering the losses, reportedly with funding presumed to have come from investors. Liquid later announced the recovery.

DeFi platforms showed a similar pattern of concentrated, high-value losses. In these incidents, attackers targeted administrative controls — governance processes and multisignature arrangements for protocol treasuries — rather than the underlying cryptography. Drift Protocol lost approximately $285 million to $296 million in an April governance and multisignature compromise that followed months of social engineering. An investigation commissioned by the project attributed the operation to North Korean actors.

KelpDAO’s LayerZero-powered rsETH bridge was drained of roughly $292 million in unbacked tokens after its single-verifier design was subverted. Bridges depend on a set of verifiers to attest to cross-chain transfers, so designs that require only a single signature concentrate that trust in one party. LayerZero said preliminary indicators pointed to the DPRK’s Lazarus Group, specifically TraderTraitor. Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August. Validators later rewound the chain and recovered most of the funds, although several million dollars that had already been bridged off-network were not restored. The incident was documented by Bitquery.

Bitcoin hardware-wallet incidents were smaller in aggregate despite their extensive coverage. Galaxy Research estimated the Coinkite RNG hack at roughly 1,596 to 1,789 BTC, equivalent to approximately $100 million to $130 million, with higher estimates reaching about 2,055 BTC. In hardware wallets, the random number generator determines how unpredictable the private keys generated on-device are, so an RNG weakness can undermine key secrecy even when keys never leave the device. Galaxy Research published the assessment.

Ledger losses of roughly $86 million to $102 million were traced to devices sold through the authorized Southeast Asian reseller CryptoBilis. An unauthorized hardware implant captured recovery phrases during setup, making the incident a supply-chain attack, in which a product is compromised between manufacture and end use rather than through its maker’s own systems. Ledger said confirmed cases were limited to that reseller’s supply chain and that its own systems and direct sales were unaffected. Unconfirmed reports said compromised devices may also have reached the German market.

Taken together, these hardware-related incidents remained well below the losses from the largest centralized-exchange and DeFi attacks.

The year also coincided with the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development — a shift with implications for a sector where professional security audits have long been a standard, and costly, pre-launch step. Muur said, “AI is definitely making it much easier to find and exploit bugs. I think we’re entering a pretty serious cybersecurity arms race.” The statement was included in another post.

Reports said code-flaw exploits accelerated after the February release of models including GPT-5.3-Codex and Claude Opus 4.6, which demonstrated high success rates on smart-contract bug benchmarks at low cost. OpenAI has disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls to complete tasks.

Most of the year’s largest heists still relied on traditional attack vectors, including key compromise, social engineering and infrastructure flaws. However, the lower barrier to discovering and weaponizing software bugs introduces an additional risk, particularly for complex smart-contract systems and sidechains.

Bitcoin’s base layer itself has not been the source of these losses. Most of the 2026 damage has been concentrated in centralized-exchange hot-wallet infrastructure, DeFi governance, oracle designs and Bitcoin sidechain code. Pure self-custody hardware wallets, although not immune to failures, have accounted for a distinctly smaller share.

Industry leaders have nevertheless called for updated self-custody recommendations, including greater use of multivendor multisignature wallets as a future custody baseline for parts of the industry. Such setups require approvals from signing devices made by different manufacturers, so no single faulty or compromised vendor can move funds alone. How custody guidance, exchange vetting of third-party security products and DeFi governance controls evolve in response to the year’s findings is the thread to follow as Muur’s tally keeps growing. The article was first published by Bitcoin Magazine and written by Juan Galt.