September: the worst month for crypto hacks in 2026

Book a call

$742.5M lost in September, per DefiLlama

306 hacks in 2026, up from 118

192 of them in contract code

$2.35B lost in 2026 so far

Research01/ 04September

What happened in September

DefiLlama tracked $742.5M lost across 35 incidents in September, the worst month of 2026. Two incidents made up 95% of it, and they are the two largest hacks of the year. Bitget, an exchange, lost about $388M through stolen credentials. Liquid Network lost about 4,000 BTC (about $320M) through a flaw in its node software, and the self-styled white hat kept 598.5 BTC.

The other 33 took $35.5M, including about $3.5M borrowed from Nostra, a Starknet lending market, against a manipulated oracle price.

Research02/ 04The year

The year so far

DefiLlama has logged 306 hacks in 2026, 2.6 times as many as by this point in 2025.

The median loss fell from $1.07M to $0.50M. Our read: attackers are spreading out, and smaller protocols are now in range.

Research03/ 04By class

Most hacks start in the code

Class (DefiLlama)HacksLost

Token and share accounting56$247M

Access control53$370M

Oracle manipulation42$75M

Protocol logic41$26M

Flaws in contract code192$717M

Key compromise33$705M

Bridge and cross-chain32$700M

Book a call

Research04/ 04Lessons

What teams can learn from it

Treat every collateral listing and oracle change as a code change.
Oracle manipulation caused 42 hacks this year. A new asset or price source needs review before it holds deposits.
Keep reviewing the accounting math, old and new.
Accounting bugs were the most common way in, including Tectonic's $124.5M loss. On Immunefi's lending programs, 1 in 3 criticals came a year or more after launch.
Put the control paths in scope.
Access control and key compromise caused 86 hacks and $1.08B in losses. Review who and what can move funds, upgrade contracts or change admin rights.

Audited code can still hold a critical bug. On Immunefi, 94% of bug bounty programs running five years or more have found one.

End of file2026 breakdownResearch · Hacks

Curious how our clients protected themselves in the worst month of the year?

While $742.5M was lost to hacks in September, protocols on Immunefi paid $801,562 to find critical bugs before attackers could.

Path A
Bug bounty
For code that's live. Researchers keep looking long after the audit's done.
Explore bug bounties
Path B
Audit competition
For code that's about to ship. A crowd of researchers on it before launch.
Explore audit competitions
Path C
PR reviews
For code as you write it. Send changes over as you go, and we'll review them.
Explore PR reviews