Cryptocurrency firms and users have lost nearly $2.7 billion across 658 security incidents through September 2026, with state-linked hackers from North Korea accounting for over $1 billion of the stolen funds. According to data from blockchain security firm CertiK, gross losses stand at $2.68 billion, while $420.4 million in stolen digital assets has been frozen or returned, leaving an adjusted year-to-date loss of $2.26 billion and an average loss of $4.1 million per incident.
- Gross Losses: $2.68 billion lost across 658 incidents through September 2026.
- Adjusted Losses: $2.26 billion after $420.4 million was frozen or recovered.
- Top Hacks: The five largest breaches account for $1.57 billion—nearly 59% of total 2026 losses.
- North Korean Attribution: Elliptic estimates DPRK-linked hackers have stolen over $1 billion across 51 incidents this year.
Concentration of Mega-Hacks in 2026
September marked the costliest month of the year with $766.5 million in total losses, surpassing April's $651.3 million. The surge was overwhelmingly driven by two massive breaches: the $387.5 million attack on exchange Bitget and the $318.7 million incident at Liquid Network. Together, these two attacks generated $706 million, representing more than a quarter of all gross security losses in 2026.
CertiK's ranking shows extreme concentration at the top. Following Bitget and Liquid Network, the next largest security events involved KelpDAO at $291.3 million, Drift Protocol at $285.3 million, and an unidentified victim losing $284.8 million. Combined, these five mega-hacks total $1.57 billion, or almost 59% of all funds stolen this year. Meanwhile, multi-blockchain attacks accounted for the largest financial losses, whereas Ethereum recorded the highest frequency of individual incidents, similar to recent security breaches like the MetaMask infrastructure exploit and small-scale DeFi protocol exploits.
Physical security threats have also escalated. CertiK tracked 52 wrench attacks in the first half of 2026, up from 39 in H1 2025. Total exposure from physical coercion jumped from $10.5 million to $124.2 million, with the average loss per incident spiking from $270,000 to $2.4 million.
State-Sponsored North Korean Attacks Exceed $1 Billion
Blockchain analytics firm Elliptic confirmed that suspected Democratic People's Republic of Korea (DPRK) hackers have taken more than $1 billion in crypto across 51 incidents in 2026, representing over 37% of gross industry losses. Elliptic attributed the $387.5 million Bitget breach and the $286 million Drift Protocol attack directly to North Korea, citing laundering patterns and shared infrastructure tied to the state-backed Lazarus Group.
This continues a multi-year campaign where North Korea has stolen over $6 billion since 2017 to fund its weapons programs. US authorities previously linked Lazarus to the $620 million Ronin Bridge theft in 2022 and the $100 million Atomic Wallet hack, as enforcement agencies continue targeting illicit infrastructure like sanctioned wallet addresses. The escalation follows February 2025's record-breaking $1.46 billion breach of Bybit, which remains the largest crypto theft in history.
Why It Matters
The 2026 security data demonstrates that cryptocurrency market risk is no longer widely distributed across minor protocol vulnerabilities, but highly concentrated in systemic infrastructure and centralized targets. With state-sponsored adversaries like North Korea accounting for more than a third of all stolen assets, security protocols must shift from basic smart contract auditing to defending against advanced persistent threats and key management failures. Until major exchanges and cross-chain bridges dramatically enhance operational security, single exploit events will continue to threaten broader market stability.
