Two transfers left Bitget's hot wallets at 18:31 UTC on September 24. They were tiny, small enough to sit under the exchange's risk-control threshold, and no alarm went off. Half an hour later the attacker started moving serious money. When it stopped, about $387.5 million had left the building.
Bitget wasn't even September's first nine-figure loss. On the 6th, somebody had found a way to mint roughly 4,000 L-BTC on Blockstream's Liquid Network with no bitcoin behind them, and had cashed them in for real BTC before anyone caught on.
Put those two next to the usual drizzle of smaller exploits and you get the figure the tracking firms published on October 1: between $766 million and $768 million stolen in one month, more than in any other month of 2026. The number is real. It's also a little misleading, and the way it misleads says more about crypto security right now than the total does.
$766 million or $768 million, depending on who's counting
PeckShield, which only logs what it considers major incidents, counted 55 of them and $766.5 million. CertiK casts a wider net, phishing included, and arrived at 97 incidents and $768.4 million. Two methods, two very different incident counts, and totals $2 million apart, which in this field passes for agreement.
The previous worst month of the year was April. September topped it by about $120 million.
Look at the two tall bars and a pattern jumps out: each is really two events. April was Drift and KelpDAO, September was Bitget and Liquid. The months in between weren't exactly calm either. CertiK's running total for 2026 now stands at $2.68 billion accross 656 incidents, and the third quarter alone came to $1.26 billion, 53.9% more than the second.
One adjustment changes the picture, though. CertiK puts about $270.6 million of September's losses in its "returned or frozen" column, which brings the net damage down to roughly $496 million, and the firm itself notes that the month's ranking shifts once you only count what's still missing. Nearly all of that returned money came from one very odd episode, which I'll get to.
Bitget and Liquid: 92% of the damage
Bitget: in through a security product
The most uncomfortable detail of the Bitget breach is where it began. According to the exchange and to interim reports from SlowMist and Mandiant, the attacker got in through a zero-day flaw in a third-party security product, something Bitget had installed precisely to be safer. SlowMist traced the earliest malicious activity to August 31, more than three weeks before any funds moved. The vendor hasn't been named.
Mandiant's account of what came next: a web shell on the compromised appliance, a hop to a production server that handled wallet jobs, and a custom withdrawal tool written to mimic Bitget's own withdrawal logic. The wallet system had no reason to object, since as far as it could tell the requests were coming from inside the house. CEO Gracy Chen says no private keys were taken and the cold wallets were never reached.
The draining itself took less than three hours. The single biggest asset was XRP, about 103 million tokens, with ETH and stablecoins behind it, spread over eight networks. Bitget says VPN and on-chain patterns point to North Korean operators; no government has said so officially.
For Bitget's customers, the story ends better than it started. The exchange's User Protection Fund, which held more than $464 million that day, swallowed the loss, and Bitget said it had rebuilt the fund to $309 million by September 30. Withdrawals stayed frozen for a few days and came back one asset at a time from September 28.
Liquid: 4,000 bitcoin out of thin air, and a partial refund
Liquid is a sidechain built by Blockstream and run by a federation of companies. You lock bitcoin with the federation and recieve L-BTC on Liquid, one for one; burn the L-BTC and your bitcoin comes back. The whole arrangement rests on one assumption: no L-BTC can exist without bitcoin sitting behind it.
On September 6 that assumption broke. Liquid nodes cached the results of range-proof checks (the cryptography that confirms a hidden amount is valid), and a flaw in that cache let a transaction through even though its outputs weren't covered by its inputs. The attacker used it to conjure roughly 4,000 L-BTC, took them to SideSwap, a federation member, and redeemed them through a perfectly ordinary peg-out for about 3,996 real BTC. Around 95% of the federation wallet was gone.
What followed is the part people will remember. The attacker posted an on-chain message presenting themselves as white-hat researchers and told Blockstream, more or less, to patch first and talk refunds after. Blockstream patched its bridge nodes during the night. On September 7, 3,400 BTC came back. About 600 BTC, worth some $47 million, did not, and the attacker asked for a 10% bounty on top.
Blockstream said no. It has promised to plug the hole in the peg itself and considers the missing coins stolen, white hat or not. At the end of September, redemptions to bitcoin were still switched off while an outside firm audited the fix.
The other 53
PeckShield logged 53 more hacks in September, worth about $59 million between them.
D'CENT is the one that hit ordinary people. The South Korean wallet maker says the weakness sat in its App Wallet before version 8.1.0, not in its hardware devices, and on-chain tracing later found more than 12.4 million XRP missing from over 7,000 wallets. That's far more than CertiK's early $6 million estimate, and none of those users had a protection fund to fall back on.
Astroport, meanwhile, was the cheapest attack of the month and maybe the most instructive. Eleven minutes before a Neutron governance vote closed, a wallet spent roughly $20,000 on 31.6 million NTRN tokens and used them to carry a proposal handing over admin rights to the Astroport and Drop contracts. Astroport says its code was never exploited. Nobody had to touch it.
Where the money actually leaked
CertiK's breakdown by attack type has one line I find almost funny. Reentrancy, the textbook smart-contract bug that drained DeFi protocols for years, accounted for about $2.25 million. In a $768 million month, that's loose change.
The serious losses came from elsewhere. Bitget lost $387.5 million through third-party software, a tool it had bought from someone else. Liquid's flaw lived in node software, the layer that decides whether a transaction is valid at all; CertiK files that under "invalid signature", a category worth $324.7 million in September. Duelbits, D'CENT and the Safe victims belong in the wallet and key compromise bucket, already CertiK's most expensive category in the first half of the year ($444.5 million over 33 incidents). And Astroport lost its contracts to a governance vote, which is less a hack than a purchase.
None of those failures would show up in a smart-contract audit. The weak spots have moved to everything wrapped around the code: suppliers, signing pipelines, voting rules, the hardware people keep their keys on.
Bitget also shows how patient these operations have become. Three weeks inside the network without stealing a thing, then a couple of test transfers under the alert threshold before the real run. It's an expensive way to rob someone, and it matches what is known of the North Korea-linked teams blamed for Drift and KelpDAO in April, and for the roughly $1.5 billion taken from Bybit in February 2025.
Who actually lost money
Oddly enough, the biggest theft of the year so far left Bitget's customers whole, at least on paper, because the exchange could afford to eat it. Liquid users kept their L-BTC too, though everything on the network was stuck during the pause and getting back to bitcoin was still impossible weeks later.
The people who really lost out in September were individuals: D'CENT app users, Safe wallet holders, the unnamed victims further down CertiK's list. That's the side of self-custody that rarely makes it onto the T-shirts. Taking your coins off an exchange removes one point of failure and adds another, which is you, plus every device and app you trust with your keys.
October has already supplied an example. On the 9th, attackers emptied an estimated $93 million from 315 wallets, according to Bitquery, and every case Ledger has confirmed so far involves devices bought through CryptoBilis, a reseller in Southeast Asia. Ledger found an unauthorized hardware implant in at least one of them and says it's own systems and direct sales weren't affected. A researcher in Europe has since posted photos of a similar component inside a Ledger bought from a retail store; Ledger hasn't tied that one to the thefts.
My conclusion isn't to leave everything on an exchange. An exchange account and a hardware wallet simply break in different ways, and you get to choose how much you leave exposed to each.
What I'd actually change
If most of your crypto sits on an exchange
Keep there what you actually trade, and set that amount in advance instead of letting it creep up. It's also definately worth a minute to check whether your platform publishes proof of reserves and, in the EU, whether it holds a MiCA licence. Neither is a guarantee, but a company that lets outsiders look at its books is making a different bet from one that doesn't.
When an exchange you use gets hit, expect fake support accounts and "refund" links within hours. Stick to the official site and app, and remember that no real support agent will ever ask for your recovery phrase.
If you hold your own keys
Buy hardware wallets from the manufacturer's own store. Not a marketplace, not a reseller, not a "sealed" unit from someone on a forum: one of the tampered Ledgers examined in October looked untouched from the outside. Set it up yourself and let the device generate the recovery phrase. If it arrives already initialized, or with a phrase printed on a card in the box, send it back.
If your wallet maker ever announces a breach, updating the app isn't enough. D'CENT told affected users to create a new recovery phrase and move everything to it, which is the right instinct: a patch stops future leaks, it can't un-leak a key.
And L-BTC, WBTC and their cousins are not bitcoin. They're claims on bitcoin held by a bridge or a federation, so treat them as a seperate asset with its own risks. Liquid just showed what those risks look like.
If you use DeFi
Go through your token approvals every few months. Old unlimited approvals are standing permissions you forgot you gave, and Revoke.cash will list and cancel them in a few minutes. Before parking serious money in a protocol, also look at how its admin rights can change hands. If there's no timelock, remember that Astroport's attacker needed about $20,000 and eleven minutes.
About that $768 million
The headline figure will be quoted for months, usually without the footnotes. Two incidents made up more than 90% of it. Roughly a third has already been returned or frozen. The biggest victim paid its customers out of its own pocket. Take Bitget and Liquid out and September looks like any other rough month in an industry that has plenty of them.
What stays with me is the shift in where things break. The big money no longer goes through clumsy DeFi bugs; it goes through security vendors, validation code, governance votes and supply chains, all harder to audit and slower to fix than a smart contract. One of those links might be the hardware wallet in your desk drawer.
If September gets you to move your long-term coins somewhere you control, set that wallet up properly, or clear out those old approvals, then at least the month was good for something.
