Crypto losses in September 2026: about $766M, the worst month this year

September 2026 cost crypto about $766 million, more than five times August. Two incidents explain almost all of it.

MINTGRAPHSEPTEMBER 2026 · REPORTED

1. Liquid Network6 Sep, about $320M
2. Most returned7 Sep, 3,400 BTC back
3. Bitget24 Sep, about $388M
4. CertiK count30 Sep, about $766M
5. PeckShield1 Oct, up 462% on August

Two cases were over 90% of the month. The next biggest was under $8M.

Source · CertiK, PeckShield, Cointelegraph, Bitget, Oct 2026

Do the trackers agree?

Closely, but not exactly. They count different things.

CertiK posted on 30 September 2026:

Show moreShow less

PeckShield added a comparison on 1 October 2026. August was $136.3 million, so September was up about 462%. It also said Bitget and Liquid Network are now the year's two largest thefts so far, ahead of the Drift hack and the KelpDAO/LayerZero exploit.

GuideDrift pays back about 1 cent per dollar so far: what hack recovery really looks like→

Show moreShow less

CertiK's dashboard showed 656 incidents and $2.68 billion lost in 2026 when Cointelegraph reported on 1 October (REPORTED). We did not re-read it since.

• Bitget387 M USD387 M USD
• Liquid Network320 M USD320 M USD
• MEV bot front-run7.81 M USD7.81 M USD
• Duelbits7 M USD7 M USD
• Payment Processor V26.6 M USD6.6 M USD
• DCENT Wallet6.57 M USD6.57 M USD
• Astroport4.9 M USD4.9 M USD
• Drop4.4 M USD4.4 M USD

Source: PeckShield post, 1 October 2026

Reported figures. Liquid Network and two smaller cases were later partly or fully returned.

One look at that chart shows the point. The next-largest case was under $8 million.

What happened at Bitget?

On 24 September 2026 at 18:31 UTC, an attacker started moving funds out of Bitget's hot and warm wallets. Bitget's first post said about $351.6 million. A day later it revised the figure to $387.5 million, adding Zcash and TRON assets, and said it was not new theft. Its incident page now says about $388 million across 12 wallets (CONFIRMED, Bitget).

Bitget's own post of 24 September 2026:

Show moreShow less

Bitget says the attacker used a zero-day flaw in a third-party security product to steal high-level credentials, then wrote forged withdrawal orders into its wallet system. It says private keys and cold wallets were not touched. Mandiant and SlowMist reports, released on 30 September, match that path, Bitget says.

SlowMist traced the first malicious activity to 31 August, weeks before the theft (REPORTED, Cointelegraph). Withdrawals came back in stages, from 28 September to 2 October. Bitget says its protection fund covers the loss. Its CEO said she was "not very optimistic" about recovering the stolen funds (REPORTED, Cointelegraph).

What happened at Liquid Network?

On Sunday 6 September 2026, attackers withdrew about 4,000 BTC, worth around $320 million, from Liquid's federation wallet (REPORTED, Cointelegraph). SideSwap said the coins came from a bug in Elements, the open-source software under Liquid.

The next day, people calling themselves white hats sent back 3,400 BTC, about 85%, after Blockstream patched the affected nodes. About 598 BTC was still outstanding then. Ledger's CTO said that looked "more like extortion than white-hat hacking." As of 7 September, Blockstream and Liquid had not described the rest as a bounty.

Sources put the total returned between $270 million and $285 million. As of 15 October 2026, the liquid.net banner says L-BTC peg-out operations remain paused (our check).

What does the full quarter look like?

The security firm Hacken counted $1.18 billion across 107 incidents in the third quarter, in a report covered on 15 October 2026 (REPORTED, Cointelegraph). Its findings:

• About 77% came from compromised suppliers, developer tools or parts outside security reviews.
• About $387 million, 33%, was returned or reversed.
• Operators paid users back about $410 million from their own funds.
• About $384 million, 32%, was neither returned nor covered.

That matches Bitget's own account: a breached vendor product.

Three lessons for ordinary users

1. The follow-up scam is aimed at you. Bitget and Drift both warn that fake "refund" and "recovery" messages follow big hacks.
2. Exchanges are a risk you take on. Keep only what you trade there. Hold the rest in a wallet you control.
3. These totals leave out small losses. Drainers and phishing hit individuals every day, and most never reach a tracker.

What we could not confirm

• CertiK's breakdown by type (exploit, phishing, wallet compromise). Its post did not include it.
• Exact recovered amounts. Sources differ, and Liquid's outstanding coins were still unsettled in the reports we read.
• One name. Cointelegraph lists Safe Wallet at $7.8 million. PeckShield's list shows a $7.81 million MEV bot case instead. We used PeckShield's list because we could read it.

MintGraph plans to repeat this roundup each month. Corrections are welcome in @mintgraphnodes.

This is research and safety guidance, not financial advice.

One next step

Open Bitget's official incident page for the live timeline, and ignore anyone who offers to "recover" your funds in a DM.

Bitget incident pagebitget.com

Sources

• CertiK Alert on X, 30 September 2026
• PeckShield Alert on X, 1 October 2026
• Cointelegraph: crypto hacks top $768M in September
• Cointelegraph: SlowMist traces Bitget hack to 31 August
• Cointelegraph: Liquid white hats return $270M
• Cointelegraph: Q3 hacks near $1.2B, 15 October 2026
• Bitget security incident page