Crypto hacks top $2.68 billion in 2026 as five incidents drive 59% of losses
In brief
- CertiK recorded 658 incidents through September, with gross losses of $2.68 billion.
- About $420.4 million was frozen or returned, leaving adjusted losses near $2.26 billion.
- September losses hit about $766.5 million, led by Bitget and Liquid Network.
- Elliptic says thefts it attributes to North Korea passed $1 billion this year.
September was the costliest month
September losses reached about $766.5 million, according to CertiK. That's above April's $651.3 million and makes it the most expensive month of 2026. Two incidents did most of the damage: Bitget's $387.5 million breach and a $318.7 million incident at Liquid Network together accounted for more than $700 million of the month's total.
Bitget alone represents about 14.4% of CertiK's year-to-date losses.
A handful of incidents drive the total
CryptoSlate's take is that the losses are heavily concentrated, and CertiK's ranking shows why. Liquid Network sits second behind Bitget, followed by KelpDAO at $291.3 million, Drift Protocol at $285.3 million and an unidentified victim at $284.8 million. Those five incidents account for about $1.57 billion, or almost 59% of the $2.68 billion CertiK has recorded this year. Bitget and Liquid Network contributed roughly $706 million between them (more than a quarter of all gross losses CertiK has tracked).
Recoveries help a bit. CertiK said about $420.4 million of stolen assets has been frozen or returned, which puts adjusted losses at roughly $2.26 billion and the average loss at $4.1 million per incident. Liquid Network recovered a large portion of the assets involved, and other attacks also ended in partial or full returns. CryptoSlate reported the gap between gross and adjusted losses has widened as the industry moves faster to identify and restrict stolen funds.
That doesn't make a big breach cheap, though. CryptoSlate noted operators can be forced to suspend services, replenish customer balances, rebuild infrastructure and commit capital before they see any assets come back.
There's a physical side as well. CertiK counted 52 so-called wrench attacks in the first half of 2026, up from 39 a year earlier, and exposure from those attacks climbed to $124.2 million from $10.5 million. Incidents spanning multiple blockchains produced the biggest dollar losses, while Ethereum logged the most security events.
Elliptic's North Korea tally
Elliptic said the Bitget incident pushed the value stolen in attacks it attributes to North Korea above $1 billion in 2026, across more than 51 suspected incidents. The firm assessed the Bitget breach as highly likely linked to North Korea, pointing to laundering behavior, infrastructure shared with earlier attacks and other indicators. It's Elliptic's own count, built with a different methodology from CertiK's loss figures, so the two numbers aren't directly comparable.
Frequently asked questions
How much has been lost to crypto hacks in 2026?
CertiK has recorded $2.68 billion in gross losses across 658 incidents through September, according to CryptoSlate. About $420.4 million has been frozen or returned, leaving adjusted losses of roughly $2.26 billion and an average loss of $4.1 million per incident.
Which crypto hacks were the largest in 2026?
CertiK's ranking puts Bitget's $387.5 million breach first, followed by Liquid Network at $318.7 million, KelpDAO at $291.3 million, Drift Protocol at $285.3 million and an unidentified victim at $284.8 million. Those five account for almost 59% of the year's recorded losses.
Is North Korea linked to the Bitget breach?
Elliptic assessed the Bitget breach as highly likely linked to North Korea, citing laundering behavior, infrastructure shared with earlier attacks and other indicators. Elliptic said the incident pushed thefts it attributes to North Korea above $1 billion in 2026, across more than 51 suspected incidents.
