Bitget Theft Drives September Crypto Hack Losses to $766M

September's crypto hack losses totaled $766.49 million, the largest monthly figure of 2026. That sum was up roughly 462% from August's $136.3 million, according to PeckShield.

Most of the damage came from two incidents. Bitget lost approximately $387 million, while Liquid Network incurred around $320 million in losses, though the attackers, who described themselves as white hats, later returned most of that amount.

September Losses Exceed 2026's Previous Records

The September figure surpassed the $646.89 million lost in April, which had been the year's most costly month up to that point. The month also set a new record for the number of incidents.

PeckShield had logged 50 major hacks in August, the highest of 2026 at the time, and then counted 55 in September. The Bitget and Liquid Network breaches together represent $707 million, or about 92% of the monthly total.

The other 53 incidents each contributed to a combined loss of roughly $59 million. Both breaches now rank above the Drift and KelpDAO exploits, which had led the 2026 damage tally before September.

Since the theft, Liquid Network has received 3,400 BTC back. Funds were also recovered after a $7.81 million maximal extractable value (MEV) bot front-run.

Payment Processor V2 regained $3.4 million of its $6.6 million loss. Crypto casino Duelbits lost $7 million, and the Nostra oracle exploit caused $3.5 million in damage.

SlowMist Traces Bitget Breach to August 31

Bitget engaged blockchain security firm SlowMist to investigate the hot-wallet theft. A progress report, current as of September 29, shows the compromise began weeks before any funds were taken.

The earliest malicious activity dates back to August 31. The attacker exploited a zero-day vulnerability, a previously unknown bug, in a third-party security product. Investigators also recovered a custom withdrawal tool from files the attacker had deleted.

SlowMist has not named the culprit, though Bitget CEO Gracy Chen has previously suspected North Korean hackers.