September 2026 was the worst month for crypto hacks of the year so far, with industry tracking data putting total losses near $766 million. Five incidents each caused at least $5 million in gross losses. The Liquid Network hack (about $320 million) became the largest hack of 2026 on September 6, until Bitget (about $387.5 million) surpassed it on September 24. These, and the other top digital asset hacks of that month, demonstrate the diversity and danger of attack vectors.
The Biggest Hacks of September 2026
In total, five hacks involved gross losses of at least $5 million, including:
- Bitget: In September 2026, Bitget lost an estimated $387.5 million due to a supply chain attack. A breach of third-party security tooling gave the attacker access to the project’s infrastructure required to introduce fraudulent transaction messages into the wallet authorization process. This allowed the attacker to steal assets from hot and warm wallets without access to the keys.
- Liquid Network: Liquid Network suffered an estimated $320 million hack due to a range proof verification caching bug for Elements nodes. This flaw allowed the attacker to generate transactions that were validated without being backed by its inputs, creating about 4,000 unbacked L-BTC. The attacker then withdrew 4,000 BTC before returning 3,400 of it.
- Gnosis Safe Wallet User: The unknown owner of a Gnosis Safe wallet suffered an estimated $7.73 million in losses due to an authorization bypass in a Router multicall function. This bug allowed the attacker to use the target’s Safe module to perform a delegatecall and execute attacker-defined data. Next, they used a malicious Uniswap V4 hooked pool to exchange aEthrsETH for rsETH.
- Duelbits: The hot wallets of the crypto casino and sportsbook platform were drained of about $7 million in crypto across multiple blockchains. The cause of the incident was believed to be compromised private keys, and the platform relaunched after a few days while stating that user balances were unaffected.
- DCENT Wallet: DCENT, a South Korean wallet provider, suffered an estimated $20 million in unauthorized transfers from its mobile App Wallet. The attack vector is currently unknown, and the effects are limited to software wallets unless a mnemonic phrase was reused across app and hardware wallets.
Common Threads Across the Attacks
The biggest digital asset hacks of September 2026 had several different root causes, including supply chain incidents, logic bugs, authorization bypasses, compromised keys, and an unknown mobile app issue. They offer an informative cross-section of top security threats in the space.
Halborn’s Technical Due Diligence and Custody and Key Management Assessment services help organizations vet third-party providers and harden signing infrastructure, and its Smart Contract Assessment services review code for authorization and logic flaws before launch. To strengthen your defenses, get in touch with Halborn.