Crypto hackers had their biggest month of 2026 in September, but the staggering numbers hide an even more striking detail: two massive breaches accounted for almost all of the month’s reported losses.

Blockchain security firms estimated that crypto suffered between $766.5 million and $768.4 million in losses during September, making it the worst month of the year for hacks and exploits. The damage was driven overwhelmingly by a $388 million Bitget breach and a $320 million Liquid Network exploit, showing how a small number of catastrophic attacks can reshape the industry's entire security picture in a matter of weeks.

Two Breaches Turned September Into Crypto’s Worst Month

The scale of September’s losses represents a sharp increase from August, according to both PeckShield and CertiK, although the firms counted incidents differently.

PeckShield recorded 55 major security incidents resulting in approximately $766.5 million in stolen funds. CertiK reported 97 incidents and estimated total losses of $768.4 million. Despite the difference in methodology, both firms reached the same broader conclusion: September was an exceptionally damaging month for crypto security.

The numbers become even more striking when the two largest attacks are taken out of the equation. The $388 million Bitget breach and the $320 million Liquid Network exploit together represent roughly $708 million — more than 90% of CertiK’s estimated monthly losses.

That means September’s record-breaking figure was not simply the result of hackers launching an unusually large number of successful attacks. Instead, two enormous incidents were enough to dominate the industry's entire monthly security tally.

CertiK described September as “a stark reminder of how quickly the threat landscape can shift,” underscoring how rapidly a single major compromise can turn into an industry-wide security shock.

Hundreds of Millions Were Recovered — But the Damage Remains

The headline figures also require an important caveat: not every dollar counted as a loss remained permanently in the hands of attackers.

More than $270 million from the Liquid Network incident was reportedly returned, substantially reducing the amount ultimately lost from that attack. The recovery nevertheless does little to change the significance of the initial exploit, which ranked among the largest crypto thefts recorded this year.

The two incidents also illustrate the concentration of risk across the digital-asset industry. Major exchanges, networks and infrastructure providers can hold or facilitate enormous amounts of value, meaning a successful compromise can produce losses on a scale that dozens of smaller attacks cannot match.

Other September incidents included a $7.8 million loss involving Safe Wallet, a $6 million attack on DCENT and a $5.9 million loss at Duelbits. Those attacks added to the month's damage, but they were dwarfed by the two largest breaches.

The contrast is important. Crypto security threats remain widespread, but the industry's financial exposure can be transformed almost overnight when attackers find a weakness in a major target.

September Was One Month. 2026 Has Already Lost $2.68 Billion

The September figures become even more concerning when placed against the wider security picture for 2026.

CertiK's security dashboard shows 656 security incidents across the crypto industry this year, with cumulative losses reaching approximately $2.68 billion. September's record therefore represents another major addition to an already multibillion-dollar security bill.

The lesson from the month is not simply that crypto suffered hundreds of attacks. It is that the industry's biggest vulnerabilities can be concentrated in a handful of high-value targets — and when one of them falls, the consequences can immediately run into the hundreds of millions of dollars.

September proved that hackers do not need to compromise the entire crypto industry to cause extraordinary damage. Sometimes, two breaches are enough.