Bitget hack drives Q3 crypto security losses to $1.26 billion

What happened

Crypto security losses reached $1.26 billion in the third quarter of 2026, according to CertiK. The largest single incident was the hack of the exchange Bitget, where attackers stole $387.5 million.

Bitget detected unauthorized transfers from some of its hot wallets on Sept. 24 and suspended withdrawals. The company said attackers exploited a vulnerability in a third-party security product to obtain internal credentials and forge withdrawal commands.

Other large incidents followed. Liquid Network lost $319 million in a Sept. 6 exploit. Tectonic lost $120 million, and Coldcard suffered a theft of $112.7 million.

Why it matters

Losses rose 53.9% from $819.4 million in the second quarter. The number of incidents rose from 219 to 247, a smaller increase than the jump in value.

September was the worst month of the year so far. CertiK recorded roughly $769 million in losses across 99 incidents that month. About $273 million was frozen or returned, which left adjusted losses of $495.3 million. Exploits accounted for $734 million, or nearly 96% of the month's losses, across 58 incidents.

Security experts warn the pattern raises questions. Repeated exploits can affect how regulators and custodians view the industry.

What the data shows

The Bitget hack accounted for about 31% of all third-quarter losses, making it the quarter's largest recorded incident under CertiK's methodology.

PeckShield counted $766 million stolen in September, up about 462% from August's $136.3 MILLION, across 55 major hacks.

Losses for all of 2026 have reached $2.68 billion so far, according to CertiK's tracking.

Background

The industry's safety net for these losses remains small. CoinGecko's State of Crypto Security Report, released in late August, put total on-chain insurance coverage at $130.2 million. That figure is down 20.2% from $163 million a year earlier.

Bitcoin still had a strong quarter. The price closed Q3 up 40%, and investors poured billions of dollars into exchange-traded funds tied to bitcoin and other tokens.

What is still unclear

• PeckShield put September losses at $766 million across 55 major hacks, while CertiK recorded roughly $769 million across 99 incidents.
• Security firm Blockaid expects more incidents involving AI agents going forward. Prompt injection is seen as the most likely method.
• Neither report states whether any of the $387.5 million taken from Bitget was recovered.

Questions readers ask