Crypto hacks: $2.81 billion stolen in 2026, October already at 116 million

“A small leak can sink a great ship,” warned Benjamin Franklin. The crypto sector is verifying it again this fall: tampered with Ledgers at a single reseller were enough to make nearly 90 million dollars disappear.

October, already 116 million. Hackers have taken $2.81 billion from the crypto sector since January, according to CertiK's dashboard updated as of October 12.

The current month already weighs $116.1 million, after $1.26 billion stolen in the third quarter. And without the Bybit hack alone, the entire year 2025 has already passed.

September 2026: the worst month of the year for hacks

September cost $773.4 million across 105 incidents, according to CertiK's updated tally. PeckShield comes in at 766.5 million over 55 major incidents. This is the worst month of 2026, ahead of April. The Bitget hack is worth $388 million and the Liquid Network hack is worth $320 million. More than 270 million have since been returned by Liquid Network hackers, which explains most of the 284.8 million frozen or returned during the month.

Safe Wallet (7.8 million), DCENT (6 million) and Duelbits (5.9 million) complete the list. On the method side, the observation is clear. Code and infrastructure flaws explain 95% of the month's losses ($733.8 million), compared to only $6.2 million for phishing, according to CertiK's monthly report.

Five hacks account for 59% of 2026 losses

The five biggest incidents of the year are worth around $1.57 billion, or nearly 59% of losses as of the end of September, according to CertiK data compiled by CryptoSlate. The fifth, an unidentified victim, lost $284.8 million.

All is not lost. $452.4 million has been frozen or returned since January, bringing the net loss to $2.35 billion. The North Korean trail remains. Elliptic attributes more than $1 billion in theft to Pyongyang in 2026, across more than 51 incidents, and deems North Korea's involvement in the Bitget hack "highly likely." LayerZero has also designated the Lazarus group for KelpDAO.

Crypto hacks: 2026 already exceeds 2025 excluding Bybit

CertiK had recorded losses of $3.35 billion over the whole of 2025. The figure still seems far away. But it was based on a single heist: the theft of Bybit in February 2025, around $1.45 billion attributed to Lazarus. Take it out and 2025 falls back to around 1.9 billion. As of mid-October, 2026 has already done much worse without any hacks of this size.

The threat has also changed face. In the first half, CertiK placed wallet compromises first ($444.5 million over 33 incidents), ahead of phishing ($366.3 million over 63 incidents). Code flaws remain the most numerous with 204 incidents. However, they only weigh 151.6 million dollars. Hackers strike less often, and much harder, by targeting platform infrastructure.

And physical violence follows the same path. CertiK counted 52 “wrench attacks” (attacks to force a victim to hand over their keys) in the first half of the year, compared to 39 a year earlier. The amounts involved increase from 10.5 to 124.2 million dollars, a trend that France knows well with its repeated crypto-kidnappings.

October: trapped hardware and DeFi exploit

October already shows $116.1 million in losses from 26 incidents as of the 12th of the month, according to CertiK. Most of it comes from tampered with Ledger devices. The rest comes largely from the 79thVault protocol exploit on BNB Chain, valued at $12.5 million in early estimates.

Ledger confirmed on October 10 the presence of an unauthorized hardware implant in a customer's device. All confirmed cases concern devices sold by the same reseller. The manufacturer assures that its own systems and direct sales channels have not been affected.

This reseller, CryptoBilis, operated in Indonesia, Malaysia and the Philippines. On-chain estimates range from $86 million to $93 million stolen from over 300 Bitcoin, Ethereum and Tron wallets. Tether has frozen almost $10 million in USDT. The dealer had changed ownership before the thefts, without any link with the attack being established at this stage.

For holders, Ledger's instructions can be summed up in a few words. Do not initialize a device purchased from this retailer within the last 90 days. If already set up, transfer the funds to a new recovery phrase, on a device purchased directly from the manufacturer. And keep in mind that no Ledger employee will ever ask you for your 24 words.