Crypto hacks cost $2.7B in 2026; losses concentrated

Crypto firms and users lost about $2.68 billion to security incidents through September 2026, with a small number of large breaches making up most of the total, CertiK recorded.

Blockchain security firm CertiK logged 658 incidents through September, registering gross losses of roughly $2.68 billion and an average loss near $4.1 million per incident. After law enforcement actions, exchange freezes and other recoveries, CertiK counts $420.4 million of stolen assets as frozen or returned, producing an adjusted loss figure of about $2.26 billion. September was the costliest month of the year at $766.5 million, driven mainly by Bitget’s $387.5 million breach and the Liquid Network incident of $318.7 million.

Losses are heavily concentrated among a few large attacks. Bitget, Liquid Network, KelpDAO ($291.3 million), Drift Protocol ($285.3 million) and an unidentified victim ($284.8 million) together represent about $1.57 billion, or roughly 59% of the recorded gross losses. Bitget’s incident alone makes up about 14.4% of CertiK’s year-to-date total.

Blockchain analytics firm Elliptic attributes more than $1 billion of 2026 thefts to suspected North Korean actors across more than 51 incidents. Elliptic assessed the Bitget breach as highly likely linked to the Democratic People’s Republic of Korea based on laundering behavior and overlaps in infrastructure with earlier attacks. That total equals more than 37% of CertiK’s gross-loss figure. Elliptic previously linked the roughly $286 million Drift Protocol exploit to the same suspected operators.

Operators moving stolen funds have used repeated cross-chain transfers, crypto mixers and lesser-monitored networks to obscure transaction trails, according to analysts tracking the incidents. As tracing and freezing tools have improved, recoveries have increased; Liquid Network recovered a large portion of the assets involved in its incident, and other attacks have produced partial or full returns. Affected firms often must suspend services, replenish customer balances, rebuild infrastructure and commit capital before recovered funds are returned.

Security incidents have appeared across multiple parts of the market. CertiK’s data show the largest dollar losses occurred in incidents involving multiple blockchains, while Ethereum recorded the highest number of events. Physical coercion attacks known as wrench attacks rose to 52 incidents in the first half of 2026 from 39 in the same period a year earlier. Exposure from those attacks climbed to $124.2 million from $10.5 million, and the average amount at risk increased to about $2.4 million from roughly $270,000.

Analysts estimate DPRK-linked hacking groups have stolen billions of dollars in crypto since 2017, with some estimates exceeding $6 billion over the past decade. US authorities have tied several past large breaches, including Ronin Bridge and Bybit incidents, to DPRK-linked actors. The size of recent individual breaches and continued state-linked campaigns are factors cited by industry participants when assessing security risk in 2026.