Crypto Hacks Hit $1.26B in Q3 as September's $768M Marks Worst Month of 2026

A Record Quarter for Bitcoin Was Also a Record Quarter for Hackers

Bitcoin closed the third quarter up roughly 40%, outperforming every major asset class, according to CoinDesk. Hackers had a strong quarter too.

Security firm CertiK logged 247 security incidents between July and September, with losses of about $1.26 billion. That is a 53.9% jump from the $819.4 million lost in the second quarter, even though the number of incidents rose only 12.8%, according to CertiK’s dashboard data.

Fewer attacks are doing more damage. Year-to-date losses now stand at $2.68 billion across 656 incidents, putting 2026 on track to rank among the costliest years the industry has recorded.

September Alone Cost the Industry $768 Million

The quarter’s damage was heavily back-loaded. September losses came in at $766.5 million across 55 incidents, according to PeckShield, and $768.4 million across 97 incidents, according to CertiK, Cointelegraph reported. Either way, it was the worst month of 2026 by a wide margin.

Two incidents account for almost all of that figure. Beyond them, the month’s list included a $7.8 million loss at Safe Wallet, $6 million at the hardware wallet maker DCENT and $5.9 million at the gambling platform Duelbits.

“September was a stark reminder of how quickly the threat landscape can shift,” CertiK said in its monthly summary.

Bitget’s $388 Million Breach Led the Losses

The largest single hit landed on Sept. 24, when the exchange Bitget lost $387.5 million from its hot and warm wallet infrastructure. The figure was initially reported at $351.6 million and was revised upward after additional transfers on Zcash and Tron were included. Cold wallets were not touched.

The attacker moved quickly, swapping stolen Ether for Bitcoin through THORChain, a cross-chain swap protocol. Bitget restored withdrawals asset by asset over the following week: Bitcoin on Monday, Ether on Tuesday and USDT on Wednesday.

Chief executive Gracy Chen said there would be “no priority access for institutions, VIP customers or Bitget employees” during the restart, and called on THORChain to refuse service to addresses linked to the attack.

Liquid Network’s $320 Million Exploit Ended Very Differently

The month’s other giant loss had a far stranger arc. In early September, a group describing itself as white-hat hackers drained roughly 4,000 of the 4,200 BTC held in the federation wallet of Liquid Network, a Bitcoin sidechain run by Blockstream and used by exchanges for settlement. The haul was worth about $320 million at the time.

After Blockstream patched the bug, the group returned 3,400 BTC, leaving around 598 BTC, roughly $47 million, outstanding. Blockstream has refused to pay for the rest. “Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” the company said.

Readers following the Liquid Network exploit, which halted the sidechain, will note that most of the funds have been returned. PeckShield and CertiK still count the full $320 million in their gross totals, with recoveries tracked separately.

Hot Wallets, Cold Wallets and Why the Difference Matters

The Bitget breach turned on a distinction every crypto user should understand. A hot wallet is connected to the internet, allowing an exchange to process deposits and withdrawals instantly. A cold wallet keeps its private keys offline, typically on hardware that never touches the network.

Exchanges keep the bulk of customer funds in cold storage and only a working float in hot wallets, which is why Bitget could lose hundreds of millions and still say user balances were covered. The trade-off is between speed and exposure: whatever is online can be accessed by anyone who gets in.

For individuals, the same logic applies at a smaller scale. Funds held in a digital wallet for day-to-day use carry different risks from savings parked in cold storage, and spreading holdings across both is standard practice.

MetaMask Adds a Fresh Scare on Day One of the Fourth Quarter

The new quarter started with another warning. On Wednesday evening, MetaMask disclosed an “ongoing security incident” affecting part of its infrastructure and began withdrawing its Ethereum validators from the Lido staking protocol as a precaution, Cointelegraph reported.

The company said it had found “no immediate threat to MetaMask wallets.” Security researcher Kaden said on X that 18 of 19 MetaMask-run validators that produced blocks had sent their payments to an unexpected address, diverting an estimated 0.36 ETH, according to CoinDesk’s account of his findings. The last validators are due to exit by Oct. 7, and re-entering the staking queue could take about 45 days.

The sum is tiny. The signal is not: the incident shows attackers probing the infrastructure layer behind wallets rather than the wallets themselves. Anyone tracking crypto news today has now seen three major security disclosures in eight days.

Will the Fourth Quarter Break the Pattern?

CertiK’s data suggests attackers are becoming more selective, with incident counts rising modestly while the average loss per incident climbs sharply. If that trend holds, the fourth quarter may bring fewer headlines but larger numbers when they land.

The safety net is also thinning. On-chain crypto insurance capacity stood at $130.2 million, down 20.2% from $163 million a year earlier, according to a CoinDesk report, indicating a shrinking pool of cover against a growing pool of losses.

Analysts caution that recoveries like Liquid Network’s are the exception. Nicolai Sondergaard, senior research analyst at Nansen, told CoinDesk that “the reputational damage can still be larger than the losses themselves.”

Security Has Become the Price of Admission for Crypto’s Bull Run

The third quarter exposed an uncomfortable paradox. Prices rallied, institutional inflows returned, and the industry still handed hackers more than a billion dollars in ninety days.

Rising prices raise the stakes on both sides. Every exchange hot wallet is worth more, every unpatched bridge holds more, and every attacker’s payoff grows with the market. Bitget’s recovery and Liquid Network’s partial refund show the industry can absorb large shocks, but absorbing them is not the same as preventing them.

Whether 2026 ends as the worst year on record or merely one of the worst now depends less on what the market does and more on how quickly the plumbing beneath it is hardened.