September Crypto Theft Tops $766M, the Worst Month of 2026

Crypto theft in September came to more than $766 million, the costliest month of 2026 on either of the two tallies now published. PeckShield put the month at $766.5 million across 55 major incidents. CertiK closed its own book higher, at $768.4 million, and counted 97. Two events account for most of it: the $388 million taken from Bitget on 24 September and roughly $320 million moved out of the Liquid sidechain on 6 September. August cost about a fifth as much.

Two books, a $1.9 million gap

The totals are closer than they were a month ago. August's two accounts sat about $79 million apart, which was the story then; September's sit under $2 million apart. The counts are where the firms diverge now. PeckShield names 55 major incidents. CertiK counts 97. PeckShield's list is of named hacks and CertiK's month takes in a wider set of categories, which is the likeliest reason for the spread, though neither firm addresses the other's number.

Timing separates them as well. The Crypto Times, writing on 30 September, cites a CertiK Alert post timed noon UTC that day, meaning the firm closed its book before the month had finished. PeckShield's figure reached the wires on Thursday. We could not establish whether the two tallies cover the same days.

A third figure, with the names swapped

There is a third number in circulation. The Crypto Times gives September $766.4 million and attributes it to CertiK. Cointelegraph and finwire, both publishing on Thursday, give CertiK $768.4 million and hand $766.5 million to PeckShield. Three figures sit inside a $2 million band with the labels attached differently, and they do not reconcile.

The incident lines move the same way. Bitget is $388 million on two accounts and $387.5 million on the third. Liquid is $320 million or $318.7 million, and Duelbits, hit the same day as Bitget, is $5.9 million or $5.97 million. The $7.8 million drained from Safe Wallet users in mid-September is the one line all three accounts render identically.

How much of it came back

Some of the money returned. CertiK counted $270.6 million recovered or frozen across the month, including 3,400 BTC from Liquid, on The Crypto Times's reading. Cointelegraph and finwire describe the Liquid return as more than $270 million without separating it from anything else recovered, so whether the two descriptions are of the same money is not established anywhere. The Crypto Times is alone in putting the net unrecovered figure near $495.8 million, and alone in saying the two largest incidents carried more than 92% of the month.

"September was a stark reminder of how quickly the threat landscape can shift," CertiK said.

What the next book will have to settle

CertiK's year-to-date line is 656 incidents and $2.68 billion, and the two accounts carrying it agree. No PeckShield equivalent was retrievable in this sweep. The Crypto Times also puts the first half of the year at $1.31 billion across 344 incidents; on that figure September alone would be worth well over a third of the preceding six months, and it stands on one outlet.

What neither firm publishes is a revision policy. August's totals were still moving weeks after that month closed, and September's two largest lines are both incidents where money has been going back. Bitget has since traced its loss to a vendor's software, and the Liquid federation got most of its bitcoin returned by the people who took it. The figure to watch is not the September total. It is what the September total reads as in November.