Centralized exchanges and DeFi drove 2026 crypto losses, report finds

What happened

A report from Lightning.news shared with Bitcoin Magazine estimates that crypto hacks generated about $2.35 billion in net losses in 2026 after freezes and returned funds are counted. The total draws on a list compiled by security researcher Stacy Muur of protocols hacked for more than $50,000, which reached 230 projects year-to-date. September was the heaviest month in Muur's tally at roughly $768 million, with centralized exchanges and DeFi accounting for most of the damage rather than Bitcoin self-custody hardware wallets.

The biggest single incident was a September 24 drain at Bitget that took about $387.5 million from hot and warm wallets. Bitget and firms including Chainalysis, Elliptic and TRM Labs attributed the theft to North Korea, pointing to IP patterns consistent with earlier DPRK-linked VPN use and on-chain links to wallets tied to Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. Attackers injected fraudulent withdrawal commands through third-party security products without obtaining private keys, according to the report.

Liquid Network, Blockstream's Bitcoin sidechain, recorded the next-largest loss. An Elements software bug exploited in early September allowed attackers to mint about 4,000 unbacked L-BTC and redeem them for roughly 4,000 real bitcoin, valued near $320 million at the time. Self-described white-hat actors returned 3,400 BTC after negotiations conducted on-chain with OP_RETURN messages and kept about 600 BTC. No federation keys were compromised; the report describes the incident as an inflation bug. Liquid is running again and has covered the losses, presumably from investors.

DeFi losses followed a similar pattern. Drift Protocol lost approximately $285 million to $296 million in an April governance and multisig compromise that involved months of social engineering, and an investigation commissioned by the project blamed North Korean actors. KelpDAO's LayerZero-powered rsETH bridge lost roughly $292 million in unbacked tokens after a single-verifier design was subverted; LayerZero said preliminary indicators pointed to DPRK's Lazarus Group, specifically TraderTraitor. Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August, with validators later rewinding the chain and recovering most funds, though several million dollars bridged off-network were not restored. Hardware wallet incidents, while widely covered, were smaller in aggregate: Galaxy Research placed the Coinkite RNG hack at roughly 1,596 to 1,789 BTC, or about $100 million to $130 million, with higher upper-bound estimates near 2,055 BTC, while Ledger losses of roughly $86 million to $102 million were traced to devices sold through Southeast Asian reseller CryptoBilis.

Why it matters

The distribution of losses matters because it points to where risk has concentrated: exchange hot-wallet infrastructure, DeFi governance and oracle designs, and Bitcoin sidechain code. Bitcoin's base layer has not been the source of the losses, according to the report. Hardware wallet flaws are serious and have prompted calls from industry leaders to update self-custody recommendations toward multivendor multisig setups, but they do not account for the bulk of 2026 damage. The figures also complicate the simple custody debate: keeping coins on an exchange shifts responsibility to a third party, while self-custody moves operational and security duties to the user.

What the data shows

Key figures from the reports: $2.35 billion in net 2026 losses; 230 protocols hacked for more than $50,000; $768 million in September alone; $387.5 million at Bitget; about $320 million at Liquid Network; $285 million to $296 million at Drift Protocol; about $292 million at KelpDAO; $120.4 million at Tectonic; $100 million to $130 million in the Coinkite RNG incident; and $86 million to $102 million in Ledger losses tied to CryptoBilis. Chainalysis' 2025 estimate was $3.4 billion stolen, including about $713 million from personal wallet compromises.

Background

Chainalysis estimated that about $3.4 billion in crypto was stolen in 2025, with personal wallet compromises accounting for roughly 20% of the value, or about $713 million, according to Blockonomi. The outlet also cited a 2025 case in which attackers drained about $33 million to $35 million from a hot wallet at a major South Korean exchange in roughly 15 minutes. Exchanges typically hold private keys for customers and can pool assets across hot and cold wallets, while self-custody wallets put key control in the user's hands. Hardware wallets can improve security, but supply-chain compromises and poor backup habits can undermine them. The 2022 crypto failures also illustrated counterparty risk when assets remain with a platform.

What to watch

AI coding agents are a growing concern. The report says the year coincided with practical deployment of tools that can scan codebases for vulnerabilities and automate exploit development, and Muur said AI is making it easier to find and exploit bugs. Reports noted that code-flaw exploits accelerated after February releases of models such as GPT-5.3-Codex and model 4.6, which showed high success rates on smart-contract bug benchmarks at low cost. OpenAI disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls. Most of the largest heists still used key compromise, social engineering or infrastructure flaws, but the lower barrier for discovering bugs adds risk for complex smart contracts and sidechains. Unconfirmed reports also suggest some bugged Ledger devices may have reached German markets.

Questions readers ask