Bitcoin Magazine

Centralized Exchange and DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet Failures

Crypto hacks have produced roughly $2.35 billion in net losses so far in 2026 after freezes and returns, according to a report by Lightning.news shared with Bitcoin Magazine. A security researcher by the name of Stacy Muur posted on X compiled “a list of protocols that were hacked for more than $50,000 in 2026.” 230 protocols year-to-date. “Crypto security is absolutely cooked.” September alone accounted for about $768 million in Muur’s tally, driven mainly by centralized exchanges and DeFi rather than pure Bitcoin self-custody hardware wallets, which got significant news coverage at the time.

The largest single loss was Bitget’s September 24 drain of roughly $387.5 million from hot and warm wallets. The exchange and firms including Chainalysis, Elliptic, and TRM Labs have linked the incident to North Korea, citing IP patterns consistent with prior DPRK-linked VPN use, on-chain overlaps with wallets tied to earlier Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. Attackers used third-party security products to inject fraudulent withdrawal commands without taking private keys.

Liquid Network, Blockstream’s Bitcoin sidechain, took the next-largest hit when attackers exploited an Elements software bug in early September to mint about 4,000 unbacked L-BTC and peg them out for roughly 4,000 real bitcoins, valued near $320 million at the time. The self-described white-hat actors returned 3,400 BTC after negotiations conducted on-chain via OP_RETURN messages and kept about 600 BTC. No federation keys were compromised. The loss came from a type of inflation bug on the Liquid network protocol. 

Samson Mow later called the episode part of an “avalanche of AI-assisted attacks” that had already reached other Bitcoin-adjacent software before hitting Liquid. The network is back and running now, having covered the losses, presumably from investors. 

DeFi platforms showed the same pattern of concentrated, high-value losses. Drift Protocol lost approximately $285–296 million in an April governance and multisig compromise that involved months of social engineering. An investigation commissioned by the project attributed the operation to North Korean actors. 

KelpDAO’s LayerZero-powered rsETH bridge was drained of roughly $292 million in unbacked tokens after a single-verifier design was subverted. LayerZero stated that preliminary indicators pointed to DPRK’s Lazarus Group, specifically TraderTraitor. 

Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August. Validators later rewound the chain and recovered the majority, though several million dollars that had already been bridged off-network were not restored.

Incidents involving Bitcoin hardware wallets were smaller in aggregate despite the wide news coverage. Galaxy Research placed the Coinkite RNG hack values in the range of roughly 1,596–1,789 BTC, on the order of $100–130 million, with higher upper-bound estimates near 2,055 BTC. 

Ledger losses of roughly $86–102 million traced to devices sold through the authorized Southeast Asian reseller CryptoBilis, where an unauthorized hardware implant captured recovery phrases during setup, a supply chain attack. The company stated that confirmed cases were limited to that reseller’s supply chain and that its own systems and direct sales were unaffected, though there are unconfirmed reports of such bugged devices making it to German markets. Combined, however, these hardware-adjacent events remain well below the single largest CEX and DeFi incidents. 

The year has also coincided with the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development. Muur has stated that “AI is definitely making it much easier to find and exploit bugs. I think we’re entering a pretty serious cybersecurity arms race.” 

Reports note that code-flaw exploits accelerated after the February release of models such as GPT-5.3-Codex and Claude Opus 4.6, which showed high success rates on smart-contract bug benchmarks at low cost. 

OpenAI has disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls to complete tasks. Most of the year’s largest heists still relied on traditional vectors such as key compromise, social engineering, and infrastructure flaws, but the lowered barrier for discovering and weaponizing bugs adds a new layer of risk, particularly for complex smart-contract systems and sidechains.

Bitcoin’s base layer itself has not been the source of these losses. The bulk of the 2026 damage has concentrated in CEX hot-wallet infrastructure, DeFi governance, oracle designs, and Bitcoin sidechain code, while pure self-custody hardware wallets, even when imperfect, have accounted for a distinctly smaller share. Nevertheless, calls for an update to self custody recommendations have emerged from industry leaders, pushing forward multivendor multisig wallets as the future of niche industry.

This post Centralized Exchange and DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet Failures first appeared on Bitcoin Magazine and is written by Juan Galt.

Bitcoin Magazine

Ecash Ecosystem Rises to Challenge in the Defense of Decentralized Custody

BTC++, Berlin, and breakthroughs in advancing Bitcoin custody

A few weeks ago, I argued that the Bitcoin ecosystem kept asking the wrong question, tending to frame everything as “trusted” or “trustless.” Instead, I urged people to ask “How many independent things have to go wrong before you lose your money?”

This is a guest post by Obi Nwosu, Co-Founder of Fedi and Fedimint. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc. or Bitcoin Magazine.

Look at Liquid or, weeks before that, Coldcard. Matt Corallo expressed the issue in the most succinct terms: run the same software, suffer the same bugs.

That critique applied to Fedimint, too, and I’m the first to say it. We built it to remove single people and single institutions as points of failure. But there was just one implementation of the protocol — a software monoculture below federations of humans. Not secure enough. 

And so I’m happy to say that Fedimint developers have already responded.

At Ecash Hackday in Berlin, the Fedimint team got a single federation running across three independent implementations, with Cashu’s thesimplekid building one of them.

Had a great time at Ecash Hackday in Berlin, got a Fedimint running with 3 different implementations by @thesimplekid, me and the Fedimint team!

Already got 3 Fedimint implementations now, who will build the 4th one? https://t.co/TnttZYOBKR pic.twitter.com/2MPdtlaJqt

— elsirion (@EricSirion) September 30, 2026

Three separate codebases, one federation, holding funds together. Developers have begun to create a solution to the monoculture I called out a few weeks ago. And the team’s response was to ask who builds the fourth, which is exactly the spirit I was hoping for.

Calle took the same principle and ran with it in his own direction. At bitcoin++ he unveiled Federated Cashu, which is designed in a way that no single operator stands alone behind a user’s funds. Any four or five keep the federation going, on a new blind signature scheme.

. @callebtc unveils “Federated Cashu” at @btcplusplus

“You don’t need to trust the operator with your privacy, but you do need to trust the operator with your security”

“Any combination of 4/5 continues the federation”

A new Blind BLS signature scheme is involved. pic.twitter.com/S8iL9Qaa9u

— Matthew Vuk (@matthewvuk2) October 1, 2026

Two teams. Two approaches. One shared goal: ecosystem resilience, advanced within weeks.

Fault tolerance does not come from trustworthiness alone, however good your audits, formal verifications, and your security culture are. It comes from independent failure domains. No single bug, no single vendor, no single jurisdiction able to take everything at once.

I’ll be clear about the layers, because the distinction matters. Fedimint is the open-source protocol. Fedi is what we build on top of it. When the protocol grows a second and a third implementation, every federation gets more resilient and no member has to change a thing about how they use their wallet. Guardians can run different software while serving the same people.

I laid out five layers where independence has to hold, and I’ll hold myself to them:

• Multiple implementations of every protocol that holds funds. 
• Multiple wallet implementations. 
• Keys generated on hardware from different vendors. 
• Multiple independent, trustworthy people, whose privacy is protected, behind every system that holds money.
• Distribution across geographies and jurisdictions, because a jurisdiction’s rules can change overnight. 

The developers who worked on this in Berlin moved those five closer to reality.

Thank you to everyone who continues to focus on building and sharing their proof-of-work. And to the rest of us, myself included: we are not done. Our ecosystem needs to start demanding independence at every layer. Software, hardware, humans, jurisdictions — all the way down.

That is how we maintain users’ confidence in Bitcoin as we enter this new age of AI-assisted threats to our ecosystem.

This post Ecash Ecosystem Rises to Challenge in the Defense of Decentralized Custody first appeared on Bitcoin Magazine and is written by Obi Nwosu.