Overview
- Security trackers published September tallies on Oct. 1 that put gross losses at roughly $766–$768 million, a monthly spike driven mainly by two large incidents.
- Liquid Network was hit on Sept. 6 by a rangeproof verification cache bug that let an attacker create about 4,000 unbacked L‑BTC and peg out roughly 3,998.5 BTC, of which about 3,400 BTC were returned after on‑chain negotiations.
- Bitget disclosed a hot/warm wallet breach on Sept. 24 in which about $387.5 million reached attacker addresses after investigators found compromised third‑party security software gave unauthorized access to its wallet environment.
- Bitget has restarted key withdrawals, published a proof‑of‑reserves showing a 131% reserve ratio, replenished a Protection Fund above $300 million, offered bounties for recoveries, and scheduled remaining withdrawals to resume on Oct. 2 under a phased plan.
- The gap between gross and net losses matters: much of Liquid’s BTC was returned and CertiK’s data put 2026 year‑to‑date losses at about $2.68 billion across 656 incidents, highlighting risks from third‑party tools, wallet infrastructure and software validation that will keep audits, patches and fund‑tracing central to industry recovery.