September crypto hacks totaled $766 million across 55 major incidents, according to PeckShield. But the month's net loss landed at approximately $496 million after hackers returned $270 million from the Liquid Network exploit. That recovery, disclosed on September 7, is absent from most headlines reporting September crypto losses.
Two attacks accounted for 92% of the total. Bitget lost $388 million on September 24 when an attacker tested risk controls with small transfers before exploiting a third-party security flaw to obtain admin credentials and inject fraudulent withdrawal commands. Liquid Network lost $320 million on September 6 after a breach in its bridge infrastructure.
Liquid Hackers Returned 3,400 BTC, Kept $46 Million
The Liquid Network attackers returned 3,400 BTC, worth roughly $270 million, one day after Blockstream verified security patches had been deployed. The hackers communicated through blockchain-encoded messages, identifying themselves as ethical actors who would "repatriate funds once network nodes received security patches."
They kept 598 BTC, about $46 million. No formal bounty arrangement has been disclosed. Ledger's CTO disputed the white-hat classification, calling the retention "extortion rather than a legitimate security bounty."
Two Firms Counted Differently, Arrived at the Same Total
CertiK and PeckShield published nearly identical loss figures despite counting incidents differently. CertiK documented 97 incidents totaling $768.4 million. PeckShield tracked 55 major incidents at $766.5 million. The $2 million gap suggests the firms used different thresholds for what qualifies as a major breach, but both converged on the gross monthly total.
CertiK's figure included smaller exploits that PeckShield filtered out. The variation reflects methodology, not a data conflict.
September Was 3.5 Times Worse Than August
August recorded $215 million in crypto losses. September's $766 million represents more than a 250% spike. The two largest September crypto hacks, Bitget and Liquid, landed within 18 days of each other, concentrating the damage into a narrow window.
According to CertiK's 2026 dashboard, the year has seen 656 security incidents with $2.68 billion in total losses. September alone represents 28% of the year's dollar losses despite comprising roughly 15% of tracked incidents. Smart contract bugs accounted for 60% of all hacks this year, though larger losses typically stem from compromised credentials.
Bitget's CEO Gracy Chen said the exchange absorbed the loss from its user protection fund, which held $465 million on September 25. The exchange pledged to replenish reserves to at least $300 million within one week from corporate holdings exceeding $1.4 billion. Bitcoin withdrawals resumed on September 26. Ethereum withdrawals opened September 29. XRP made up $157 million of the stolen assets, while stablecoin issuers froze only $318,000.