Crypto Hacks Hit $2.7B in Nine Months as Q3 Topped First Half
Third-quarter crypto losses of $1.365 billion exceeded the first half's total. September alone saw $768 million drained, led by Bitget and Liquid Network.
Third-quarter crypto losses of $1.365 billion exceeded the first half's total. September alone saw $768 million drained, led by Bitget and Liquid Network.
Ledger described the CryptoBilis hardware implant attack as limited, but blockchain analysis shows $102 million drained from 324 wallets across six networks.
Core Lightning released security patch 26.06.8 on September 22. Attackers targeted unpatched nodes October 1. The alert came 10 days too late.
MetaMask is exiting 17,000 validators holding 523,000 ETH after an attacker diverted 0.36 ETH in block rewards funded through Tornado Cash on October 1.
September crypto hacks hit $766 million, but hackers returned $270 million from Liquid Network. Net losses: $496 million. Bitget and Liquid made up 92%.
Bitget's attacker sent test transfers worth $480 to probe security 27 minutes before stealing $388 million across five blockchains on September 24.
KelpDAO filed a lawsuit claiming LayerZero endorsed a vulnerable setup in 2024. LayerZero says it always recommended the opposite. The hack cost $292M.
Bitget's $351.6M breach on September 24 pushed monthly crypto losses past $684M, making it 2026's costliest month and reversing August's trend.
A double-spend on the Nomic bridge left 36% of Osmosis Alloyed BTC with no bitcoin behind it. Validators froze 22.65 BTC, and a real gap remains.
Trezor's hardware held, but a breached email vendor blasted a fake STM32 security alert to users on September 9, the second vendor data leak in a month.
Smart contract exploits were 60% of 2026 crypto hacks but just 17% of the losses. Keys, custody and signing systems took 76% of the stolen value.
The Liquid Network hack drained about 4,000 bitcoin, yet no keys were stolen. A patch meant to fix a 2019 flaw let the attacker mint unbacked coins.
Price-manipulation exploits hit a record 32 in DeFi lending in 2026. The Tectonic case shows why the attack is cheap, repeatable and tough to audit away.
Harmony will shut its Layer 1 on September 10 and migrate ONE to Ethereum, saying it can no longer defend the chain against state actors and AI agents.
Liquid Network lost 3,996 BTC, near 320 million dollars, to an Elements rangeproof bug on September 6. No key was stolen, and 197 BTC now back the peg.
A crypto oracle is how a blockchain reads a price it cannot see itself. Learn what oracles do, why attackers target them, and who runs the feeds today.
Crypto cybersecurity is no longer a side topic. It sits at the center of the biggest stories in the industry, from $285M smart contract exploits to state-sponsored DeFi infiltration traced back to North Korean operatives embedded in protocols since 2020. The threat surface keeps widening. Phishing campaigns target wallet owners with increasingly convincing fakes, exploit teams hunt zero-day vulnerabilities in audited contracts, social engineering attacks compromise key personnel at major protocols, and laundering routes flow through cross-chain bridges, mixers, and OTC desks faster than law enforcement can trace them. The defenders are evolving too. Audit firms add formal verification, protocols ship circuit breakers, stablecoin issuers debate when and how to freeze stolen funds, and chains like Arbitrum experiment with reaching directly into hacker wallets. Each case sets a precedent. Coinliva tracks the actual incidents and the response that follows: the post-mortems, the on-chain forensics from Chainalysis, TRM Labs, and Elliptic, the recovery efforts coordinated across protocols, the legal actions like the class action against Circle over Drift, and the security firms doing the analysis nobody else publishes. Real numbers, named protocols, traced wallets. Where crypto security actually stands, not where the marketing claims it does.