preferred on
Points of Focus
- Five mega-hacks account for more than 58% of the $2.69 billion in 2026 crypto thefts tracked by CertiK.
- Bitget, Liquid Network, KelpDAO, and Drift were targeted through infrastructure, authorization, or configuration weaknesses rather than typical code bugs.
- The five incidents highlight how attackers increasingly target security infrastructure, with recovery efforts still ongoing at Bitget and Liquid Network.
Five incidents account for over 58% of the $2.69 billion in 2026 crypto thefts, CertiK’s dashboard showed on Oct. 2. They total about $1.57 billion, led by September’s Bitget ($387.5 million) and Liquid Network ($318.7 million) attacks.
PeckShield counted 55 major incidents totaling $766.49 million in September. It put Bitget at about $387 million and Liquid at about $320 million.
CertiK CEO Ronghui Gu reportedly said in July that attackers earn more by targeting key management and infrastructure than by hunting code bugs. Four of the five fit that description; only Liquid was traced to a flaw in its own protocol code.
Bitget: $387.5 million through a third-party security product
Bitget detected unauthorized hot- and warm-wallet transfers at 18:31 UTC on Sept. 24. It said attackers exploited a zero-day in a third-party security product and forged withdrawal commands, without compromising private keys. Its onchain tracing puts the transferred assets at about $387.5 million.
𝗜𝗠𝗣𝗢𝗥𝗧𝗔𝗡𝗧 𝗨𝗣𝗗𝗔𝗧𝗘𝗦: The withdrawal plan will be announced by September 26th, 4:00 AM UTC. We appreciate your patience on this matter.
Based on the latest onchain tracing and classification of transactions, assets equivalent to approximately $387.5 million were… https://t.co/BmKK67kK8n
— Bitget (@bitget) September 25, 2026
SlowMist found the earliest malicious activity in available logs on Aug. 31, 24 days before the theft. Elliptic rated a North Korean link highly likely on Sept. 25, noting Bitget had not published its attribution basis.
Liquid Network: $318.7 million from a cache-key flaw
An attacker exploited a range-proof cache bug in Liquid’s Elements software on Sept. 6, creating about 4,000 unbacked L-BTC. The flaw came from an Aug. 3 fix for an earlier bug; that fix went public on Sept. 1.
SideSwap, which processed the peg-out, said its online authorization key and lack of order limits enabled the loss. The attacker returned 3,400 Bitcoin (BTC) on Sept. 7, leaving about 602 BTC outstanding as of Sept. 17.
Kelp DAO: $291.3 million through a single-verifier bridge setup
On April 18, attackers compromised two RPC nodes feeding LayerZero Labs’ verifier and overloaded external providers. Tampered responses let a forged attestation clear the sole verifier, releasing 116,500 rsETH.
LayerZero’s report said Mandiant and CrowdStrike attributed the attack to North Korea with high confidence. It also said the app owner changed a 2-of-2 setup to 1-of-1. Kelp said 1-of-1 was the default configuration for new deployments.
Drift Protocol: $285.3 million and a Mandiant attribution
Drift Protocol suffered an attack on April 2, wherein the attackers used compromised multisig approvals and Solana’s durable nonce feature to gain administrative control and drain the protocol. It later linked the incident to the actors behind Radiant Capital’s 2024 hack with medium-high confidence.
Drift’s June 4 update said Mandiant attributed the April attack to UNC6862, another North Korean threat group. Its April 16 update had put withdrawn user assets at $295.7 million, above CertiK’s $285.3-million estimate.
Unnamed victim: $284.8 million in a January hardware-wallet scam
A victim lost over $282 million in Litecoin (LTC) and BTC to a hardware-wallet scam on Jan. 10, ZachXBT reported. CertiK’s dashboard lists the loss at $284.8 million, and its January tally counted the theft as phishing.
ZachXBT listed 2.05 million LTC and 1,459 BTC in the theft addresses.
On January 10, 2026 at around 11 pm UTC a victim lost $282M+ worth of LTC & BTC due to a hardware wallet social engineering scam.
The attacker began converting the stolen LTC & BTC to Monero via multiple instant exchanges causing the XMR price to sharply increase.
BTC was also…
— ZachXBT (@zachxbt) January 16, 2026
This is a developing story, as recovery efforts at Bitget and Liquid Network remain ongoing.
Share
Most read articles
