Overview
- Liquid Network suffered a software validation flaw that let about 4,000 unbacked L‑BTC be created and peg‑out nearly 4,000 BTC, with the attacker returning roughly 3,400 BTC after onchain negotiations in early September.
- Bitget confirmed on Sept. 24 that a hot‑wallet compromise tied to a third‑party security product sent about $387.5 million to attacker addresses and that investigators from firms including Mandiant and SlowMist are tracing the flows.
- Security trackers recorded roughly $766–$768 million in gross losses for September, making it the costliest month of 2026 so far and driven mostly by the two incidents at Bitget and Liquid.
- CertiK reports Q3 losses of $1.26 billion across 247 incidents and year‑to‑date gross losses near $2.68 billion, with forensic work and freezes already accounting for about $420 million of assets frozen or returned.
- Blockchain analysts say suspected DPRK-linked groups have taken more than $1 billion in 2026, on‑chain insurance capacity is small at about $130.2 million, and faster exploit discovery via AI and cross‑chain complexity raise regulatory, custody, and recovery pressures for users and firms.