CertiK Reports
Crypto Markets, October 2, 2026 — September was the costliest month of 2026 for crypto security incidents. A CertiK tally cited in existing coverage estimated $768.4 million in losses across 97 incidents, while PeckShield counted 55 major incidents totaling $766.49 million. The figures are approximately the same in value but use different tracking methods.
Summary
- CertiK’s September approximate calculation was $768.4 million across 97 incidents.
- According to Gadgets 360, PeckShield counted 55 major incidents and $766.49 million in losses.
- CertiK’s live dashboard, accessed October 2, later displayed a revised September total of $772.4 million.
- CertiK’s dashboard ranked the Bitget incident first at $387.5 million and the Liquid Network incident second at $318.7 million.
- Liquid Network’s official assessment says 3,400 BTC was returned after the September 6 incident.
What the CertiK September 2026 Report Shows
CertiK’s live dashboard lists exploits as the main source of September losses. It shows $739.5 million, or 95.7% of the dashboard’s revised total, attributed to exploits.
The dashboard also warns that its incident rankings exclude phishing attacks and that chain categories can overlap. This means individual categories should not be added together to create a new overall total.
Why the Totals Do Not Match
| Tracker | September Incidents | Reported Losses | Important Note |
|---|---|---|---|
| CertiK, live dashboard | Dashboard view varies by section | $772.4M | Revised figure visible October 2 |
| PeckShield | 55 major incidents | $766.49M | Different incident-tracking method |
The safest reading is that security firms identified roughly $766 million to $772 million in gross losses during September. These are not identical measures, and the CertiK dashboard revision should be disclosed rather than hidden.
The Two Incidents That Drove the Month
Bitget
Bitget’s September 24 violation was the largest incident in CertiK’s dashboard. Bitget’s official notice confirmed unauthorized transfers from some hot wallets which are actively present on the internet. Later reporting put the revised amount sent to attacker-controlled addresses at about $387.5 million.
Bitget said its cold wallets and private keys were not affected.
Liquid Network
Liquid Network was the second-largest incident. Liquid Network’s official assessment says an Elements software vulnerability involving the rangeproof verification cache allowed an attacker to increase the L-BTC supply and withdraw close to 4,000 BTC through the normal peg-out process.
The assessment records the return of 3,400 BTC on September 7. Therefore, the monthly totals should be understood as gross incident value, not necessarily the amount still missing.
September Losses in One View
| Incident | Reported Loss | Details |
|---|---|---|
| Bitget | $387.5M | The largest incident listed on CertiK’s September dashboard. |
| Liquid Network | $318.7M | The second-largest incident listed on CertiK’s September dashboard. |
| Safe Wallet | $7.8M | Listed among the largest September incidents in CertiK’s dashboard ranking. |
| D’CENT App Wallet | $6M | Listed in CertiK’s September dashboard ranking. |
What the Incident Types Tell Readers
- Exploit: CertiK uses this category for losses connected to a software or protocol weakness. It accounted for most of the dashboard’s September loss value.
- Wallet compromise: This describes unauthorized access to a wallet environment or signing system. It is distinct from a flaw in a smart contract or consensus rule.
- Phishing: CertiK’s dashboard says its top-incident ranking excludes phishing, so readers should not treat that ranking as a complete list of every type of security event.
- Gross loss: A tracker may count the value moved or affected when the incident occurred, even if some funds are later frozen, returned, or recovered.
Frequently Asked Questions
Was September 2026 really the worst month of the year?
Yes, according to the CertiK and PeckShield figures cited in the reviewed reports. September’s reported losses were far above PeckShield’s August comparison of about $136.3 million.
Does $768.4 million mean that amount is still missing?
No. The figure is a gross incident estimate. Liquid’s official assessment records the return of 3,400 BTC, so the amount originally affected and the amount still outstanding are different measures.
Why does CertiK’s dashboard show $772.4 million?
The live dashboard accessed on October 2 displayed a revised September total. The article keeps the original $768.4 million figure because it is the figure cited in the contemporary report, but it also discloses the later dashboard revision.
Which two incidents had the largest impact?
CertiK’s September dashboard ranked Bitget first at $387.5 million and Liquid Network second at $318.7 million.
Bottom Line
September 2026 stands out due to two very large incidents dominating the month, while the trackers’ different methods produced different incident counts. The headline figure is best reported with its source and date, but CertiK Research’s live dashboard later showed $772.4 million.
That distinction keeps the report accurate and prevents a revised dashboard figure from being mistaken for the original estimate.
