September Crypto Hacks Total $766M, Led by Bitget and Liquid

What happened

Security firm PeckShield tracked 55 major crypto hacks across September, with combined losses reaching $766.49 million. This marks a 462% jump from August's $136.3 million in total thefts. Two incidents drove nearly the entire monthly total: a $387 million breach of exchange Bitget's hot wallets, and a $320 million theft from the Liquid Network, of which $285 million was later returned. The remaining 53 hacks that month summed to roughly $59 million, less than half of August's total loss figure.

Why it matters

The scale of the two leading hacks pushed them to the top of the largest single crypto thefts of the year to date, surpassing earlier exploits targeting Drift and KelpDAO/LayerZero. Bitget confirmed its security systems flagged unauthorized transfers from hot wallet segments at 18:31 UTC on September 24, with CEO Gracy Chen stating the attacker accessed a backend wallet infrastructure system, spoofed transaction data, and bypassed authorization protocols to release funds. Chen ruled out a private key compromise, noting cold wallets holding most of the exchange's assets were unaffected. The exchange will cover the full loss from its User Protection Fund, which holds more than $464 million, and Chen publicly committed to accounting for every stolen dollar.

The Liquid Network breach, which occurred on September 6, saw purported white-hat hackers withdraw roughly 4,000 BTC from the Liquid Federation wallet using the SideSwap peg-out authorization key. Liquid noted the key itself was not compromised. The hacker left on-chain messages promising to return the funds once every network node was patched, though Ledger CTO Charles Guillemet expressed skepticism, noting legitimate security researchers do not typically drain a bridge and request on-chain contact.

Blockchain security firm SlowMist reported in a September 29 update that North Korea-linked hackers are laundering the stolen Bitget funds by pairing CoW Protocol orders with Chainflip deposit addresses, converting proceeds to BTC and using CoinJoin to obscure transaction trails. SlowMist founder Cos argued anti-money laundering checks are lagging behind automated exploitation scripts. Chainflip has attempted to block the flows, rejecting at least one deposit but refunding the funds instead of freezing them.

What is still unclear

• The full scale of North Korea-linked laundering activity for the stolen Bitget funds remains unconfirmed, as Chainflip has only identified and refunded one blocked deposit so far, with no public timeline for broader fund recovery.

Questions readers ask