Cryptocurrency platforms and users lost approximately $767 million to hacks, exploits, and phishing attacks in September 2026, making it the costliest month for crypto security incidents so far this year, according to verified data from two blockchain security firms, CertiK and PeckShield.

The tally covers hacks, exploits, and phishing attacks affecting exchanges, protocols, and individual users. CertiK recorded 97 incidents during the month, with losses valued at $768.4 million, while PeckShield recorded 55 major incidents, resulting in $766.5 million in losses. The two firms' loss estimates align within roughly $2 million of each other, even though their incident counts differ — a gap that can appear when monthly dollar totals are dominated by a small number of very large breaches.

Two incidents accounted for more than 90 percent of the month's losses, a concentration that left the September total heavily dependent on a small number of large-scale breaches. The largest was an attack on BitGet on September 24, 2026, involving the exchange's hot wallets — internet-connected wallets used to process day-to-day withdrawals, an online-by-design setup that is generally more exposed than offline cold storage — which cost approximately $387.5 million. As the breach unfolded, BitcoinKE reported that BitGet said stolen funds were nearing $400 million.

Earlier in the month, Blockstream's Liquid Network, a federated Bitcoin sidechain — a network whose transfers are validated by a defined set of functionaries rather than a permissionless miner set — used for settlement between exchanges and traders, suffered an exploit worth about $318.7 million, as covered in BitcoinKE's case study.

CertiK said about $270.6 million of the September 2026 losses was returned or frozen, leaving roughly $495.8 million unrecovered based on its figures. Because returned and frozen funds are tracked separately from unrecovered losses, the month's final accounting can shift as recovery efforts run their course.

The September 2026 total was more than three times the roughly $215 million in losses reported for August 2026, according to CertiK, marking a steep month-over-month increase.

The September 2026 surge highlights how crypto losses are increasingly tied not only to smart-contract vulnerabilities but also to wallet infrastructure, third-party security systems, and transaction-signing controls — a pattern visible in both of the month's headline incidents, one striking exchange hot wallets and the other a sidechain used to move funds between trading venues.

Source: BitcoinKE