Crypto's Worst Month: Web3 Hacks Hit $766M in September 2026
Oct 1, 2026
CertiK data shows Web3 losses hit $766.4 million in September 2026, the worst month of the year, driven mainly by the Bitget and Liquid Network exploits.
A Record-Breaking Bad Month
According to CertiK's latest numbers, Web3 lost roughly $766.4 million to hacks and exploits in September 2026 — by far the worst month of the year and more than 3.5x August's total of $215 million. About $270 million was later returned or frozen, bringing net losses down to around $496 million, but the headline number still stings.
Two Hacks Did Most of the Damage
Exchange Bitget lost $387.5 million after attackers exploited a vulnerability in a third-party security product to forge withdrawal commands, with the breach traced back to late August. Separately, Blockstream's Liquid Network sidechain lost $318.7 million in unbacked L-BTC due to a flaw in how its nodes cache range proof verifications. A self-described white-hat actor later returned most of the funds.
Smaller Incidents Added Up Too
Wallet drains and governance exploits rounded out the month, hitting Safe Wallet, D'CENT, and a few DeFi protocols for a few million each. The takeaway: infrastructure risk, not just smart contract bugs, is now the biggest threat facing crypto users.