Crypto companies and their users have lost close to $2.7 billion to security incidents in 2026, and thefts attributed to North Korea-linked actors account for more than $1 billion of that figure.

Data from blockchain security firm CertiK show 658 incidents recorded through September. Approximately $420.4 million in stolen assets have since been frozen or returned, leaving losses of roughly $2.26 billion and an average loss of $4. million per incident.

September Was the Costliest Month of 2026

September sharply reshaped the year's tally. Losses during the month reached about $766.5 million, surpassing April's $651.3 million to make it the most expensive month of 2026. Two breaches drove most of the damage: Bitget's $387.5 million hack and a $318.7 million incident involving Liquid Network, which together accounted for more than $700 million.

The surge has left the annual total increasingly dependent on a small number of outsized attacks. It has also pushed state-linked theft deeper into the industry's security calculations, after blockchain analytics firm Elliptic reported that suspected North Korean hackers have taken more than $1 billion in cryptocurrency this year.

Mega-Hacks Are Reshaping the Annual Toll

September's events propelled Bitget and Liquid Network to the top of CertiK's 2026 incident ranking, widening the gap between the largest breaches and the hundreds of smaller attacks recorded during the year.

Bitget alone represents about 14.4% of CertiK's year-to-date losses. Liquid Network ranks second, followed by KelpDAO at $291.3 million, Drift Protocol at $285.3 million, and an unidentified victim at $284.8 million. Combined, those five incidents account for roughly $1.57 billion, or almost 59% of the $2.68 billion recorded so far this year.

That concentration means a single compromise at a major exchange, protocol, or infrastructure provider can materially change the industry's annual loss profile. The shape of 2026 differs from the previous year, when a single theft of about $1.46 billion from Bybit dominated annual losses; this year, no individual incident has approached that scale, and the toll has instead been built up from several nine-figure breaches. For context, Bitget and Liquid Network together contributed approximately $706 million, equivalent to more than a quarter of all gross security losses tracked by CertiK in 2026. September's figures further illustrate the imbalance: beyond those two attacks, the month's remaining incidents contributed only a fraction of its $766.5 million total.

Recoveries Narrow the Gap Between Gross and Adjusted Losses

Some of the year's damage has since been reversed. CertiK counts $420.4 million of assets as frozen or returned, reducing its adjusted loss figure to $2.26 billion. Liquid Network recovered a large portion of the assets involved in its incident, while other attacks have also resulted in partial or full returns. As a result, the gap between gross and adjusted losses has widened as exchanges, issuers, security firms, and blockchain operators move faster to identify and restrict stolen funds.

That recovery capacity, however, does not eliminate the immediate cost to affected businesses. Large breaches can force operators to suspend services, replenish customer balances, rebuild infrastructure, and commit capital before stolen assets are recovered.

The attacks are also spreading across different parts of the crypto market. CertiK's annual data show that incidents involving multiple blockchains have generated the greatest dollar losses, while Ethereum has recorded the largest number of security events.

The threat has extended beyond software as well. CertiK recorded 52 so-called wrench attacks — incidents in which holders are physically coerced into surrendering their assets — during the first half of 2026, up from 39 in the same period last year. Exposure from those physical attacks climbed to $124.2 million from $10.5 million, while the average amount involved increased to about $2.4 million from roughly $270,000.

North Korea's Crypto Theft Machine Crosses $1 Billion in 2026

The growing size of individual breaches has amplified the impact of one of crypto's most persistent adversaries.

Elliptic said the Bitget incident pushed the value stolen in attacks it attributes to North Korea above $1 billion in 2026, spanning more than 51 suspected incidents. That figure reflects only the cases Elliptic has attributed to North Korean actors, meaning the total can shift as further incidents are reviewed. The analytics firm assessed the Bitget breach as highly likely to be linked to the Democratic People's Republic of Korea, citing laundering behavior, infrastructure shared with earlier attacks, and other indicators.

Measured against CertiK's $2.68 billion industrywide gross-loss figure, Elliptic's North Korea tally equals more than 37% of the security losses recorded this year. Elliptic previously linked the roughly $286 million Drift Protocol exploit to North Korean actors. Drift also ranks among CertiK's five largest incidents of 2026, placing suspected DPRK operations behind more than one of the year's biggest crypto thefts.

The concentration extends a campaign that has generated billions of dollars for North Korea over the past decade. Elliptic estimated last year that DPRK-linked hackers had stolen more than $6 billion in cryptocurrency since 2017, and governments and international organizations have said the proceeds help finance the country's nuclear weapons and ballistic-missile programs.

North Korean hacking groups initially built their reputation by attacking banks and conventional financial infrastructure before increasingly targeting cryptocurrency businesses, where large pools of transferable assets can move across borders without relying on the traditional banking system. The US Treasury designated Lazarus Group and related groups in 2019, describing them as state-sponsored operations controlled by North Korea's Reconnaissance General Bureau.

Several of crypto's largest historical breaches have since been attributed to the country. US authorities tied Lazarus to the roughly $620 million Ronin Bridge theft in 2022, while the Treasury Department said the group used crypto mixers to launder proceeds from the $100 million Atomic Wallet attack and other hacks.

The escalation peaked in February 2025, when attackers stole about $1.46 billion from Bybit, the largest confirmed crypto theft on record. The FBI formally attributed that breach to North Korea, while Elliptic tracked the subsequent movement of funds through thousands of addresses, cross-chain services, and laundering platforms.

Those laundering techniques have become more elaborate as exchanges, stablecoin issuers, and blockchain analytics firms improve their ability to freeze and trace stolen assets. Elliptic said North Korean operators increasingly use repeated cross-chain transfers, mixers, and less-monitored networks to break the transaction trail.

That leaves North Korea as one of the biggest variables in crypto's 2026 security bill, as the state-backed actors pose a growing threat to the emerging industry. With CertiK's totals covering only incidents recorded through September, the final annual tally will depend on fourth-quarter incidents and on how much more of the year's stolen assets are ultimately frozen or returned.