Strip out Bitget and Liquid, and the other 53 September hacks total about $59 million, less than half of the $136.3 million lost in August.
PeckShield counted 55 major crypto hacks in September, totaling $766.49 million in losses.
That is about 462% above August’s $136.3 million, and two incidents account for nearly all of it.
Two Breaches Dominate the Month
The Bitget incident, at about $387 million, and the Liquid Network theft of about $320 million, of which $285 million was returned, are now the largest and second-largest crypto thefts of the year to date, PeckShield noted. They moved past the Drift and KelpDAO/LayerZero exploits. But take them out and the other 53 hacks add up to about $59 million, under half of August’s total.
As CryptoPotato reported earlier, Bitget stated that its security systems flagged unauthorized transfers from parts of its hot wallets at 18:31 UTC on September 24. CEO Gracy Chen explained that the attacker got into a backend system in the wallet infrastructure, spoofed transaction data, and tricked the authorization process into releasing funds.
The CEO ruled out a private key compromise and noted that cold wallets, which hold most of the exchange’s assets, were not touched. The exchange plans to cover the loss from its User Protection Fund, which holds more than $464 million.
“We will not run away from this, and every dollar will be accounted for,” Chen wrote on X.
The Liquid Network loss came earlier, on September 6, when purported white-hat hackers withdrew roughly 4,000 BTC from the Liquid Federation wallet. The withdrawal used the SideSwap peg-out authorization key, though Liquid noted that the key itself was not compromised.
In on-chain messages to Blockstream, the hacker promised to send the money back once every node was patched. Ledger CTO Charles Guillemet was skeptical, pointing out that legitimate security researchers would not typically drain a bridge and then ask to be contacted on-chain.
You may also like:
Laundering Trail and Smaller Losses
SlowMist wrote in a September 29 update that North Korea-linked hackers are laundering the stolen Bitget funds by pairing CoW Protocol orders with Chainflip deposit addresses, converting the proceeds to BTC and then using CoinJoin to obscure the movements.
Cos, SlowMist’s founder, argued that anti-money laundering checks are falling behind automated scripts. Chainflip is trying to block the flows and has rejected at least one deposit but refunded the money instead of freezing it.
The other eight entries in PeckShield’s top 10 ran from $3.15 million to $7.81 million. The largest was a front-run involving the MEV bot “yoink,” which was returned.
Payment Processor V2, the LimitBreak contract at the center of a September 25 white-hat rescue, accounted for $6.6 million, with $3.4 million returned. In that operation, security researcher Quit moved 23,155 NFTs worth nearly $6 million out of exposed wallets, while a separate exploit path left 660WETH unrecovered.