Crypto hacks have produced roughly $2.35 billion in net losses so far in 2026 after freezes and returns, according to a report by Lightning.news shared with Bitcoin Magazine. A security researcher by the name of Stacy Muur posted on X compiled “a list of protocols that were hacked for more than $50,000 in 2026.” 230 protocols year-to-date. “Crypto security is absolutely cooked.” September alone accounted for about $768 million in Muur’s tally, driven mainly by centralized exchanges and DeFi rather than pure Bitcoin self-custody hardware wallets, which got significant news coverage at the time.
The largest single loss was Bitget’s September 24 drain of roughly $387.5 million from hot and warm wallets. The exchange and firms including Chainalysis, Elliptic, and TRM Labs have linked the incident to North Korea, citing IP patterns consistent with prior DPRK-linked VPN use, on-chain overlaps with wallets tied to earlier Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. Attackers used third-party security products to inject fraudulent withdrawal commands without taking private keys.
Liquid Network, Blockstream’s Bitcoin sidechain, took the next-largest hit when attackers exploited an Elements software bug in early September to mint about 4,000 unbacked L-BTC and peg them out for roughly 4,000 real bitcoins, valued near $320 million at the time. The self-described white-hat actors returned 3,400 BTC after negotiations conducted on-chain via OP_RETURN messages and kept about 600 BTC. No federation keys were compromised. The loss came from a type of inflation bug on the Liquid network protocol.
Samson Mow later called the episode part of an “avalanche of AI-assisted attacks” that had already reached other Bitcoin-adjacent software before hitting Liquid. The network is back and running now, having covered the losses, presumably from investors.
DeFi platforms showed the same pattern of concentrated, high-value losses. Drift Protocol lost approximately $285–296 million in an April governance and multisig compromise that involved months of social engineering. An investigation commissioned by the project attributed the operation to North Korean actors.
KelpDAO’s LayerZero-powered rsETH bridge was drained of roughly $292 million in unbacked tokens after a single-verifier design was subverted. LayerZero stated that preliminary indicators pointed to DPRK’s Lazarus Group, specifically TraderTraitor.
Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August. Validators later rewound the chain and recovered the majority, though several million dollars that had already been bridged off-network were not restored.
Incidents involving Bitcoin hardware wallets were smaller in aggregate despite the wide news coverage. Galaxy Research placed the Coinkite RNG hack values in the range of roughly 1,596–1,789 BTC, on the order of $100–130 million, with higher upper-bound estimates near 2,055 BTC.
Ledger losses of roughly $86–102 million traced to devices sold through the authorized Southeast Asian reseller CryptoBilis, where an unauthorized hardware implant captured recovery phrases during setup, a supply chain attack. The company stated that confirmed cases were limited to that reseller’s supply chain and that its own systems and direct sales were unaffected, though there are unconfirmed reports of such bugged devices making it to German markets. Combined, however, these hardware-adjacent events remain well below the single largest CEX and DeFi incidents.
The year has also coincided with the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development. Muur has stated that “AI is definitely making it much easier to find and exploit bugs. I think we’re entering a pretty serious cybersecurity arms race.”
Reports note that code-flaw exploits accelerated after the February release of models such as GPT-5.3-Codex and Claude Opus 4.6, which showed high success rates on smart-contract bug benchmarks at low cost.
OpenAI has disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls to complete tasks. Most of the year’s largest heists still relied on traditional vectors such as key compromise, social engineering, and infrastructure flaws, but the lowered barrier for discovering and weaponizing bugs adds a new layer of risk, particularly for complex smart-contract systems and sidechains.
Bitcoin’s base layer itself has not been the source of these losses. The bulk of the 2026 damage has concentrated in CEX hot-wallet infrastructure, DeFi governance, oracle designs, and Bitcoin sidechain code, while pure self-custody hardware wallets, even when imperfect, have accounted for a distinctly smaller share. Nevertheless, calls for an update to self custody recommendations have emerged from industry leaders, pushing forward multivendor multisig wallets as the future of niche industry.
Hardware wallet manufacturer Keystone has confirmed that hackers stole a device authentication key and exposed personal information belonging to 25,964 customers, forcing the company to destroy 18,835 devices and suspend shipments. According to the company’s October 26 security announcement, attackers…
Vitalik Buterin supports Moonshot's limits on AI hacking capabilities, warning that unchecked cyber threats could lead to mandatory KYC and surveillance.
BloomTrading identifies a third-party RCE flaw behind the $947K Solana theft affecting nine users, rules out private key exposure and pledges full refunds.
CoinDCX confirms a 15.99 million USDT loss tied to compromised legacy wallets after initially denying another hack, while saying customer balances remain safe.
Electrum releases version 4.8.3 after malicious servers exploit a Bitcoin wallet flaw to redirect payments through fake fee bumps, causing confirmed losses.
Keystone confirms a website breach that exposed customer names, shipping addresses and orders, raising phishing and physical security concerns for wallet users.
The Bitget hacker has moved $19.48 million in 52 transfers, almost entirely in Bitcoin, as Arkham tracks fresh outflows from wallets linked to the exchange’s September breach. Arkham put the transfers between 10:02 UTC on Oct. 21 and 02:48 UTC…
Ledger has said it is working with authorities after users last week reported losing funds and one received a tampered device. But the company reassured customers that the number of impacted products was “limited.”
The hardware wallet manufacturer added in an announcement on Sunday that it had reached out to affected customers.
Paris-based Ledger on Friday said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from a reseller.
Then, on Saturday, Ledger said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant.
Ledger would not confirm the amount of money lost but blockchain investigator Specter said $86 million had been drained from devices.
“As the investigation continues, we are working with relevant authorities,” Ledger wrote on Sunday.
It added: “Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.
“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.”
Customers in South East Asia last week reported losing funds after buying from Kuala Lumpur, Malaysia-based vendor CryptoBilis.
Ledger then advised customers who’d bought from CryptoBilis to not set up their devices.
CryptoBilis has since stopped selling its hardware wallets, Ledger said on Sunday.
People on social media posted picture evidence of devices implanted into Ledger products, claiming it could get users’ private keys. It isn’t clear how many of Ledger’s signing devices contained the implant.
Neither Ledger nor CryptoBilis immediately responded to questions from Bitcoin Magazine.
Hardware wallet security has been a hot topic ever since hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.
The products, made by Canadian company Coinkite, contained a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases.
In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen.
Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.
Hardware wallet manufacturer Ledger has said that it is investigating loss of user funds after customers in South East Asia reported issues with devices bought from a reseller.
The Paris-based company on Friday advised customers who’d bought from vendor CryptoBilis within the last 90 days to not set up their devices.
Ledger did not reveal how much money users had lost but one blockchain investigator, Specter, wrote on X that he’d traced theft addresses following social media posts and that over $86 million had been lost.
BREAKING: Ledger reports loss of funds from users in South East Asia who purchased products from the reseller "CryptoBillis".
The situation is ongoing and users are urged to review Ledger's official updates. pic.twitter.com/0GT3cthQtD
The issue comes following a number of data breaches this year in the crypto world and a huge hack of popular Coldcard hardware wallet devices in July.
“Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBilis,” Ledger said via its support X account.
Ledger added that it had asked CryptoBilis to pause all sales and shipments of Ledger devices.
“If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses,” the company said.
In a statement to Bitcoin Magazine, Ledger said that based on the information to date, the incident is isolated specifically to this reseller in this specific market.
“No reports were made of products purchased directly from Ledger, and Ledger’s infrastructure, systems and services were not compromised,” the company added.
CryptoBilis is a Kuala Lumpur, Malaysia-based hardware wallet vendor, according to its website. The company did not immediately respond to questions from Bitcoin Magazine.
The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.
The products, made by Canadian company Coinkite, had a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases.
Galaxy Research said in the months following the attack various attackers were able to exploit the bug independently.
In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen.
Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.
Investors withdrew over 4,000 bitcoins worth over $334 million at today’s prices in one hour after hacked Bitget resumed customer withdrawals, the company’s CEO has said.
Bitget CEO Gracy Chen told Bloomberg Television Tuesday that withdrawals from the exchange had since stabilized following the immediate bitcoin transactions.
Hackers last week made away with $388 million in crypto after targeting the Victoria, Seychelles-based exchange’s hot wallets.
“The withdrawals actually stabilized a lot today,” Chen said. “Those hundreds of millions [in bitcoin withdrawals] actually most of them happen on the first hour of the withdrawal restart.”
In a Monday X post, Chen said that 9,585 orders of 4,098 bitcoins were processed. The exchange is allowing customers to withdraw funds in phases.
Bitget froze withdrawals after blockchain experts flagged that money was leaving the exchange. Bitget later said the attack method in the incident was “highly consistent with known patterns of North Korean hacker organizations.”
Chen said that no cold storage funds were touched but rather attackers had “exploited vulnerabilities from third-party products to steal internal credentials, then used those credentials to send fraudulent withdrawal commands that bypassed our risk controls.”
She added that the company was using its own money to top up its protection fund after it dropped in size. Bloomberg reported that it was below $200 million after standing at $464 million before the hack.
Bitget said that it was the first “security incident of this nature in eight years.”
“The incident remains contained, and no further unauthorized transfers are possible,” the exchange noted.
Bitget is the sixth biggest by trading volume, according to CoinGecko, processing in the past 24 hours $811 million in transactions. The exchange’s customers are mostly based in Asia.
Attackers linked to North Korea’s government have long targeted crypto exchanges and are some of the most sophisticated cyber criminals out there.
Login
