Exploits Account For 95% Of September’s $766.4M In Web3 Losses As Quarterly Theft Rises 54%
In Brief
CertiK reports $766.4M in Web3 losses for September 2026, a yearly record driven by the Bitget and Liquid Network exploits, with Q3 theft up 54%.
Crypto security incidents in September 2026 resulted in approximately $766.4 million in losses, according to report published by blockchain security firm CertiK. The figure sets a new record for the highest monthly losses this year and coincides with the largest number of confirmed incidents recorded in any month of 2026.
The month’s losses were heavily concentrated. Cryptocurrency exchange Bitget accounted for the largest single event at $387.5 million, followed by the Liquid Network incident at approximately $318.6 million. Together, the two events represent more than 90% of all losses in September, dwarfing the third-largest incident, which came in at $7.8 million. Roughly $270.6 million of the month’s total has since been recovered or frozen, softening — but far from eliminating — the net impact on the industry.
The concentration of losses reflects a familiar dynamic in Web3 security: while incident counts are distributed widely across protocols and chains, a small number of large-scale breaches against centralized targets continue to account for the bulk of stolen funds.
Exploits Dominate as Quarterly Losses Climb 54%
CertiK’s breakdown of attack vectors shows a striking asymmetry. Exploits — attacks that abuse vulnerabilities in code, infrastructure, or operational processes — were responsible for $733.8 million, or roughly 95.5% of September’s losses. Private key compromises accounted for $14.2 million, wallet compromises for $11.9 million, and phishing just $6.2 million. The incident count tells a different story: of the month’s approximately 99 confirmed incidents, 58 were categorized as exploits, but 13 were phishing attacks and 11 involved private key compromises — meaning the most frequent attack types were far from the most damaging.
By category, losses were highest across multiple chains, while Ethereum recorded the most individual incidents, underscoring that the largest exposures now span cross-chain infrastructure rather than any single network. Consistent with the month’s figures, centralized exchanges suffered the largest share of losses, followed by mainnet-related incidents.
The September surge also shaped a bleak quarterly picture. Total losses in Q3 2026 reached $1.26 billion, up 53.9% from $819.4 million in Q2, while the number of incidents rose 12.8% to 247. Adjusted losses — which exclude recovered or frozen funds — climbed 10% quarter-over-quarter to $869.6 million, indicating that the increase is not merely the result of a few outsized events but part of a broader deterioration in the security environment.
Taken together, the data points to a widening gap between incident frequency and incident severity. For developers and security teams, the implication is that hardening application-layer code remains necessary but insufficient: as September demonstrated, a single vulnerability in an exchange backend or cross-chain infrastructure can expose more value in one event than hundreds of smaller exploits combined.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
