Bitget's $387.5M hack drives Q3 crypto security losses to $1.26B, CertiK says
In brief
- Q3 crypto security losses totaled $1.26 billion, up 53.9% from $819.4 million in Q2, per CertiK.
- Security incidents rose about 13%, from 219 in Q2 to 247 in Q3, per CertiK data.
- Bitget's $387.5 million hack accounted for about 31% of Q3 losses.
- September losses reached roughly $769 million across 99 incidents; $273 million was frozen or returned.
Bitget tops CertiK's Q3 ranking
Q3 losses were up 53.9% from $819.4 million in Q2, according to the blockchain security company's tally. Under CertiK's methodology, the Bitget hack was the quarter's largest recorded incident. It had company near the top, though. Liquid Network's $319 million exploit on Sept. 6 ranked second, followed by Tectonic at $120 million and the $112.7 million Coldcard theft.
Those rankings follow how CertiK counts and classifies incidents. They're one firm's ledger, not a definitive industry total.
September did most of the damage
CertiK recorded roughly $769 million in losses across 99 security incidents in September, which works out to more than half the quarter's total in a single month. Exploits accounted for $734 million across 58 incidents (nearly 96% of the month's losses).
Not all of it stayed gone.
About $273 million was frozen or returned, leaving adjusted September losses of $495.3 million, per CertiK's figures as reported by Cointelegraph.
What Bitget says happened
Bitget detected unauthorized transfers from some of its hot wallets on Sept. 24 and suspended withdrawals. The exchange said attackers exploited a vulnerability in a third-party security product to obtain internal credentials, then used them to forge withdrawal commands.
That's Bitget's own account of the breach. Security firm SlowMist has separately traced the Bitget hack activity to an Aug. 31 zero-day exploit, according to a related Cointelegraph report. The exchange's hot wallet incident landed in the same month that pushed CertiK's quarterly count past $1 billion, and it's the single biggest reason Q3 looks so much worse than Q2 on CertiK's books.
Frequently asked questions
How much did crypto lose to security incidents in Q3 2026?
CertiK recorded $1.26 billion in losses across 247 incidents in Q3 2026, according to Cointelegraph. That's up 53.9% from $819.4 million in Q2, when there were 219 incidents.
What were the largest crypto hacks of Q3 2026?
Under CertiK's methodology, Bitget's $387.5 million hack was the largest Q3 incident at about 31% of losses. Next came Liquid Network's $319 million exploit on Sept. 6, then Tectonic at $120 million and the $112.7 million Coldcard theft.
How did the Bitget hack happen?
Bitget said attackers exploited a vulnerability in a third-party security product to obtain internal credentials and forge withdrawal commands. The exchange detected unauthorized hot wallet transfers on Sept. 24 and suspended withdrawals.
