Crypto hacks have caused approximately $2.35 billion in net losses so far in 2026, following freezes and returns, according to a report by Lightning.news shared with Bitcoin Magazine. Security researcher Stacy Muur compiled a list on X of 230 protocols hacked for more than $50,000 year-to-date, stating, “Crypto security is absolutely cooked.” September alone accounted for roughly $768 million of Muur’s total, driven predominantly by centralized exchanges and DeFi rather than pure Bitcoin self-custody hardware wallets, which attracted significant media coverage at the time.
The largest single loss occurred on September 24 when Bitget suffered a drain of roughly $387.5 million from its hot and warm wallets. The exchange, alongside firms including Chainalysis, Elliptic, and TRM Labs, attributed the breach to North Korea, pointing to IP patterns matching prior DPRK-linked VPN usage and on-chain overlaps with wallets tied to past Lazarus Group and TraderTraitor operations, such as the 2025 Bybit theft. The attackers utilized third-party security tools to inject fraudulent withdrawal commands without acquiring private keys.
Blockstream’s Bitcoin sidechain, the Liquid Network, faced the second-largest incident in early September when attackers exploited an Elements software bug. They minted about 4,000 unbacked L-BTC and pegged them out for roughly 4,000 real bitcoins, valued at close to $320 million at the time. Through on-chain negotiations via OP_RETURN messages, self-described white-hat actors returned 3,400 BTC while keeping around 600 BTC. No federation keys were compromised, as the loss stemmed from an inflation bug within the Liquid network protocol.
Samson Mow later described the event as part of an “avalanche of AI-assisted attacks” that had already targeted other Bitcoin-adjacent software before striking Liquid. The network has since resumed normal operations after covering the losses, presumably via investors.
DeFi platforms reflected a similar trend of concentrated, high-value losses. Drift Protocol lost roughly $285–296 million in an April governance and multisig breach that involved months of social engineering. An independent investigation commissioned by the project blamed North Korean actors.
Additionally, KelpDAO’s LayerZero-powered rsETH bridge lost roughly $292 million in unbacked tokens following the subversion of a single-verifier design. LayerZero reported that preliminary signs pointed to the DPRK’s Lazarus Group, specifically TraderTraitor.
On Cronos, the Tectonic protocol saw about $120.4 million borrowed against manipulated collateral in late August. Validators subsequently rewound the chain to recover the majority of the funds, though several million dollars that had already been bridged off-network were lost permanently.
In contrast, incidents involving Bitcoin hardware wallets were smaller in aggregate, despite receiving extensive media coverage. Galaxy Research estimated the value of the Coinkite RNG hack between roughly 1,596 and 1,789 BTC—amounting to $100–130 million—with higher upper-bound estimates approaching 2,055 BTC.
Ledger losses totaling approximately $86–102 million were linked to devices distributed through CryptoBilis, an authorized Southeast Asian reseller, where an unauthorized hardware implant captured recovery phrases during setup in a supply chain attack. Ledger noted that confirmed cases were restricted to that specific reseller’s supply chain, leaving its own systems and direct sales unaffected, though unconfirmed reports suggested compromised devices may have reached German markets. Combined, however, these hardware-related events remained well below the figures recorded in the largest CEX and DeFi breaches.
The year has also seen the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development. Muur noted that “AI is definitely making it much easier to find and exploit bugs. I think we’re entering a pretty serious cybersecurity arms race.”
Reports indicate that code-flaw exploits increased following the February rollout of models like GPT-5.3-Codex and Claude Opus 4.6, which demonstrated high success rates on smart-contract bug benchmarks at minimal cost.
OpenAI has disclosed internal testing scenarios where agents successfully accessed unauthorized test-network funds or bypassed security controls to complete tasks. While most major heists this year still relied on traditional vectors such as key compromises, social engineering, and infrastructure flaws, the lowered barrier for discovering and weaponizing bugs introduces fresh risks, particularly for sidechains and complex smart-contract ecosystems.
Bitcoin’s base layer has remained secure and unaffected by these losses. The majority of 2026 damages have centered on centralized exchange hot-wallet infrastructure, DeFi governance, oracle designs, and Bitcoin sidechain code, while pure self-custody hardware wallets have accounted for a noticeably smaller share, even with their imperfections. Nonetheless, industry leaders have renewed calls to update self-custody best practices, championing multivendor multisig wallets as the future standard for the niche sector.
How much have crypto hacks cost in 2026?
Crypto hacks have resulted in roughly $2.35 billion in net losses so far in 2026 after accounting for freezes and returns.
What were the largest security breaches of 2026?
The largest incidents included Bitget’s $387.5 million hot wallet drain, an Elements bug on Liquid Network causing a $320 million loss, and major DeFi exploits affecting Drift Protocol and KelpDAO.
Are hardware wallets driving the majority of crypto losses?
No. Despite widespread media coverage, hardware wallet incidents accounted for a noticeably smaller share of losses compared to centralized exchanges and DeFi platforms.
How are AI models impacting crypto security?
The deployment of AI coding agents has lowered the barrier for finding and weaponizing software bugs, contributing to a growing cybersecurity arms race.
