Crypto platforms and protocols recorded approximately $1.26 billion in losses from security incidents during the third quarter of 2026, according to data compiled by security firm CertiK. The total marked a 53.9% rise from the $819.4 million lost in the second quarter and involved 247 incidents, a 12.8% increase from the prior three-month period.

Year-to-date losses through September reached $2.68 billion across 656 incidents. September stood out as the costliest month of the year, with estimates ranging from $766.5 million to $768.5 million depending on the tracking methodology used by different firms.

September Figures Show Sharp Rise

PeckShield identified 55 major security incidents in September that resulted in about $766.5 million in stolen funds. That represented a roughly 462% jump from the $136.3 million recorded in August. CertiK counted a higher number of incidents—97 to 99—and placed total losses at approximately $768.4 million to $768.5 million.

The two largest events dominated the monthly total. On September 24, exchange Bitget suffered a breach that allowed attackers to transfer roughly $387.5 million to $388 million from hot and warm wallet systems. The compromise affected infrastructure on Ethereum and other EVM-compatible networks, the XRP Ledger, Zcash, and Tron. Assets taken included ETH, XRP, USDT, USDC, ZEC, BNB, AVAX, and TRX. Bitget stated that cold wallets and private keys remained secure.

Investigators later determined that compromised third-party security software enabled unauthorized access. Bitget has restored withdrawals for BTC, ETH, and USDT, replenished its protection fund above $300 million, and is offering a 5% bounty for information leading to the freezing or recovery of stolen assets. Remaining token, fiat, and peer-to-peer withdrawals were scheduled to resume in early October under a phased plan.

Liquid Network Exploit and Partial Recovery

Earlier in the month, on September 6, the Liquid Network experienced an exploit linked to a vulnerability in its Elements codebase. An error in the rangeproof verification cache allowed an attacker to create approximately 4,000 unbacked L-BTC tokens. The attacker then used the network’s peg-out process to withdraw nearly 4,000 real bitcoin, valued at around $319 million to $320 million at the time, reducing the federation’s bitcoin reserve from about 4,205 BTC to 197 BTC.

Most of the funds were returned quickly. After on-chain communication and negotiations, the attacker sent back 3,400 BTC on September 7, leaving roughly 602 BTC still outstanding. The recovered amount was valued at approximately $269 million to $270 million when returned. Liquid halted the network, deployed an emergency patch, and later released an updated version of Elements. Block production resumed, though peg-out operations remained suspended into late September pending further audits and authorization updates.

Security researchers note that the September totals represent gross value affected by incidents rather than permanent net losses, given the substantial recovery from the Liquid event.

Smaller Incidents and Broader Context

Additional losses in September included an estimated $7.8 million from Safe Wallet, about $6 million from DCENT, and $5.9 million from Duelbits. These smaller events added to the overall monthly figure but were dwarfed by the two largest breaches.

The rise in losses occurred against a backdrop of strong market performance. Bitcoin closed the third quarter up 40%, outperforming major traditional assets even as Treasury yields climbed. Investors continued allocating capital to exchange-traded funds linked to bitcoin and other tokens.

On-chain crypto insurance capacity stood at $130.2 million as of late August, down 20.2% from $163 million a year earlier, according to industry research. Analysts have pointed to the growing role of artificial intelligence tools that can accelerate the discovery of smart-contract vulnerabilities, potentially reducing the window for fixes before exploits occur.

Bitget continues active tracing efforts with support from external firms, while Liquid works toward restoring full functionality. The combined data from the quarter illustrate the persistent scale of security challenges facing the sector even as market activity expands.