Centralized exchanges and decentralized finance protocols account for the largest share of reported 2026 crypto-hack losses, according to Bitcoin Magazine, which cited a net total of roughly
Centralized exchanges and decentralized finance protocols account for the largest share of reported 2026 crypto-hack losses, according to Bitcoin Magazine, which cited a net total of roughly $2.35 billion stolen after freezes and partial returns. Hardware wallet failures have drawn attention as a parallel risk, but the numbers show that platform-level security failures remain the dominant source of losses.
Reported net crypto-hack losses in 2026 $2.35 billion Reported after freezes and returns. Treat as a reported aggregate because a public itemized ledger was not located.September alone accounted for roughly $768 million of those losses, with centralized-exchange and DeFi incidents leading the monthly tally. Bitcoin traded at $80,906 with a market cap above $1.6 trillion as these incidents unfolded, making the loss figures a non-trivial fraction of the ecosystem's aggregate value. For related coverage, see Best Crypto Casinos for Halloween 2026: Live Events, Spooky Slots, and Real Bonuses.
The Bitget breach stands as one of the most consequential centralized-exchange incidents of the year. Galaxy Research reported that Bitget disclosed $387.5 million stolen from hot and warm wallets, with the exchange temporarily halting withdrawals in response.
Bitget theft disclosed $387.5 million Galaxy Research says the reported theft affected hot and warm wallets, illustrating the concentration of losses in centralized-exchange incidents.What distinguishes the Bitget attack from a simple key compromise is the mechanism. Galaxy Research's postmortem found that attackers inserted fraudulent withdrawal commands rather than stealing private keys or breaching cold wallet storage. The losses spanned 11 blockchains simultaneously, suggesting a coordinated operation targeting the exchange's transaction-authorization layer, not its key management.
Galaxy Research drew a pattern comparison to the Lazarus Group's earlier Bybit operation, noting structural similarities in how the withdrawal pipeline was manipulated. That attribution remains a forensic assessment rather than a legal finding, and Bitget and the forensic firms involved should be treated as the sources of the North Korea attribution claim, not as settled fact.
On the DeFi side, the Liquid Network exploit illustrated a different attack surface: sidechain infrastructure. Galaxy Research documented that attackers siphoned 4,000 BTC from Liquid Federation infrastructure by exploiting a sidechain code vulnerability that enabled the minting of unbacked L-BTC, the pegged token used on Blockstream's Bitcoin sidechain. The attacker later returned 3,400 BTC, leaving 600 BTC unreturned at the time of Galaxy's report.
The Liquid incident is technically distinct from the Bitget breach. Where Bitget's attacker manipulated a centralized exchange's control plane, the Liquid exploit targeted the cryptographic and consensus rules governing a federated Bitcoin sidechain. Both incidents represent control-plane and bridge risk, but in different custody architectures. For readers unfamiliar with the Liquid Network: it is a federated Bitcoin sidechain operated by Blockstream that allows faster settlement and confidential transactions, with L-BTC serving as the Bitcoin-pegged asset. A vulnerability in the peg mechanism allowed the attacker to mint L-BTC that had no corresponding BTC backing.
The Initia blockchain incident earlier in 2026, where a hacker printed $2.7 million in crypto before the chain halted, reflects the same category of minting exploit, though at a smaller scale. The recurring pattern across multiple chains suggests unbacked-mint vulnerabilities remain underweighted in protocol security audits.
Bitcoin Magazine reported hardware-wallet-related losses in the range of roughly 1,596 to 1,789 BTC, attributed to Coinkite RNG (random number generator) failures. At current prices near $80,906 per bitcoin, that range represents approximately $129 million to $145 million in affected value, according to a single source whose underlying incident universe was not independently audited for this article.
That figure is materially smaller than the hundreds of millions lost in individual centralized-exchange and DeFi incidents. But the comparison is not simply a matter of scale; it reflects different risk models. A hardware wallet failure typically affects individual holders whose private keys were generated with weak entropy. A centralized exchange breach can drain pooled custodial funds from thousands of users in a single operation.
Self-custody is often presented as the solution to exchange risk. The 2026 hardware wallet incidents complicate that framing without overturning it. The question is not whether hardware wallets are safe in absolute terms, but whether a given device's key-generation process can be trusted. RNG failures are a manufacturing or firmware flaw, not an inherent weakness of self-custody as a concept. Users who verified their device's entropy at setup and who generated keys on audited firmware would not have been affected by an RNG vulnerability in a different product line.
For users navigating custody decisions, the distinction matters. Platforms that manage both fiat and crypto in integrated accounts introduce a different risk profile than a standalone hardware wallet: custodial counterparty risk replaces device risk. Neither eliminates all attack surfaces.
The distribution of 2026 losses confirms a pattern that has held for several years: the largest single incidents consistently occur at centralized exchange and DeFi bridge layers, not at the individual key-management level. Custodial hot and warm wallets, withdrawal authorization systems, and sidechain peg contracts remain the highest-value targets because they concentrate assets and automate transactions at scale.
Platform security responsibilities and individual wallet-security responsibilities are separate domains. An exchange that routes transactions through a centralized withdrawal-authorization system carries a structurally different risk than a user holding keys on a hardware wallet. The Bitget breach's reliance on fraudulent withdrawal commands points to gaps in transaction signing verification, multi-party authorization, and anomaly detection at the infrastructure level, none of which an individual user can mitigate by choosing better self-custody.
DeFi bridge and sidechain security require a different remediation framework. The Liquid exploit's unbacked-mint vector is a smart-contract and federation-consensus problem, not a key-management problem. Protocol audits that focus narrowly on access control without modeling economic attack paths, such as artificially inflating the supply of a pegged asset, will miss this class of vulnerability.
The selection of a custody platform involves weighing these risk categories against each other. The 2026 data as reported suggests that centralized exchange and DeFi concentration risk remains the dominant loss driver, not the hardware failures that received significant attention in the same period. Users evaluating their security posture should weight platform-level risk accordingly, while treating hardware wallet selection as a separate, independently important decision.
The minting exploits observed across multiple chains in 2026 indicate that the attack surface for unbacked-asset creation is wider than most protocol teams have acknowledged. As Bitcoin sidechains, layer-2 networks, and wrapped-asset bridges proliferate, the Liquid incident offers a specific, documented example of what a federation or bridge compromise looks like at the protocol level. September's reported partial recovery of 3,400 BTC out of 4,000 BTC stolen is an unusual outcome in crypto security incidents; it does not indicate that sidechain infrastructure is reliable under attack, but rather that the specific attacker chose partial restitution, a behavior that cannot be assumed in future incidents.
Bitcoin's base layer remained uncompromised across all reported 2026 incidents. The losses occurred at custody, contract, and federation layers built on top of or alongside the base protocol, a distinction that matters for understanding what the Bitcoin network's security model actually guarantees versus what higher-layer applications must secure themselves.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Bitcoininfonews first published the article titled 2026 Crypto Hacks: CEX and DeFi Losses Dominate.
