In this article · 6 sections
Crypto platforms and users lost $1.32 billion to hacks, exploits and scams in the first half of 2026, according to CertiK, and September was the worst single month of the year at about $766 million. Two patterns stand out. Most of the money was taken through compromised wallets, credentials and people, not code bugs. And losses are extremely concentrated: a handful of incidents make up most of the total. This tracker lists each month with the firm that measured it. We never add up figures from different firms, because each one counts differently.
The short answer
First half of 2026: $1,315,676,432 lost across 344 incidents (CertiK), or about $1.20 billion net of the $115.3 million frozen or returned. Q1 accounted for $508.2 million and Q2 for $807.5 million. In the second half, July and August were moderate, then September became the worst month of the year, with Bitget's $387.5 million breach and the Liquid Network incident.
Sources: CertiK Hack3d H1 2026 report (6 Jul 2026) · Cointelegraph, 6 Jul 2026 (Q1 and Q2 figures)
Month by month
Figures are gross losses in US dollars at the time of each incident, as first published. Security firms revise their tallies, so we show the firm and, where two serious figures exist, both.
| Period | Reported losses | Counted by | Largest incident |
|---|---|---|---|
| Q1 (Jan–Mar) | $508.2M | CertiK | Mostly phishing, per CertiK |
| April | Over $630M | CertiK (via Cointelegraph) | Kelp DAO bridge (~$290M, 18 Apr) and Drift Protocol (~$285M, 1 Apr) |
| May | $81.7M | PeckShield | n/a |
| June | $75.9M, 40 incidents | PeckShield | Humanity Protocol (~$31M) |
| July | ~$242M, 28 major incidents (Nominis); ~$210M first tally (PeckShield) | Nominis; PeckShield | Coldcard firmware flaw (estimates vary, see below) |
| August | ~$215M to $220M | CertiK | Tectonic price manipulation (~$120.4M); $110.7M later returned or frozen |
| September | $766.4M gross (later $768.4M); $270.6M returned or frozen | CertiK; PeckShield $766.5M | Bitget ($387.5M, 24 Sep) and Liquid Network (~$318.7M, 6 Sep) |
Sources: Cointelegraph (CertiK Q1/Q2/April) · The Block, 1 Jul 2026 (PeckShield May/June) · Coin-Turk, 13 Aug 2026 (Nominis July) · The Crypto Times, 30 Sep 2026 (CertiK August and September) · crypto.news, 1 Oct 2026 (CertiK revision, PeckShield)
The incidents that shaped the year
Five incidents explain most of the money lost in 2026. Two of them, Drift and Kelp DAO, have been linked to North Korean groups by investigators (TRM Labs and LayerZero respectively); those attributions are preliminary.
| Incident | Date | Amount | How it happened |
|---|---|---|---|
| Bitget (exchange) | 24 Sep | ~$387.5M | Internal credentials obtained through third-party software, then fraudulent withdrawal orders |
| Liquid Network (bitcoin sidechain) | 6 Sep | ~$318.7M gross | About 4,000 unbacked L-BTC created; about 3,400 BTC returned the next day |
| Kelp DAO (restaking bridge) | 18 Apr | ~$290M | Compromised RPC nodes feeding a single verifier on its LayerZero bridge |
| Drift Protocol (Solana) | 1 Apr | ~$285M | Months of social engineering of contributors, pre-signed multisig transactions and fake collateral |
| Coldcard (hardware wallet) | July | ~$88.6M (1,367 BTC) firmly tracked; up to ~$114M with a suspected fourth wave | A firmware bug shipped in 2021 made some seeds guessable |
Sources: BleepingComputer (Bitget) · crypto.news (Liquid) · TRM Labs (Drift) · BTC-Echo (Kelp DAO) · The Defiant (Coldcard)
Get the Exchange Safety Checklist
Plus an alert whenever a top exchange changes its proof-of-reserves, licensing or security status. No spam, unsubscribe anytime.
We store only your email to send the checklist and safety alerts. See our privacy policy.
What the numbers say
People and keys, not code. In CertiK's first-half data, wallet compromise was the costliest category at $444.5 million across just 33 incidents, and phishing took $366.3 million across 63. Code vulnerabilities produced the most incidents, 204, but only $151.6 million. The expensive attacks go after access: credentials, signers, suppliers.
Concentration. Kelp DAO and Drift together made up nearly 44% of first-half losses, and Bitget alone about half of September. A quiet month can turn into a record with one breach.
Gross is not net. CertiK counted $115.3 million frozen or returned in the first half and $270.6 million in September alone, mostly the Liquid bitcoin. Headlines usually quote the gross figure.
Sources: CertiK Hack3d H1 2026 report
Updated hourly · as of · CoinGecko · Data provided by CoinGecko
How we build this tracker
We take monthly figures from established security firms (CertiK, PeckShield, Nominis) and incident details from the affected company or a named investigator, each with a date and a link. We do not add figures from different firms together, and we label estimates as estimates. Amounts are in US dollars at the time of the incident, so they do not move with today's prices. We update the table at the start of each month and log corrections publicly on our corrections page.
What it means for you
Most of these losses landed on platforms, not on individuals who kept their own keys. Exchanges that publish proof of reserves and hold a protection fund can absorb a hit, as Bitget did, but you depend on their choices. Keep on exchanges what you trade, and move the rest to a wallet you control, created from a seed you generated yourself on a device bought from the manufacturer.
Keep reading
Quick answers
How much crypto was stolen in 2026?
CertiK counted $1.32 billion in the first half of 2026 across 344 incidents. For the second half, firms publish monthly: September alone reached about $766 million in CertiK's first tally. We do not add figures from different firms together.
What was the biggest crypto hack of 2026?
So far, the Bitget exchange breach of 24 September 2026, at about $387.5 million, followed by the Liquid Network incident on 6 September (about $318.7 million gross, most of it returned).
Why do figures differ between security firms?
Each firm decides what counts as an incident, when to value the stolen assets and whether to subtract funds later returned. That is why we always name the firm behind a figure.