September Crypto Hacks Caused A Record $766M In Losses

Crypto hacks triggered over 766 million dollars in losses during the month of September, according to initial estimates from PeckShield and Certik. This is the heaviest toll of the year. However, it was revised to 772.4 million dollars by Certik, with Bitget and Liquid Network suffering the bulk of the damage.

In brief

• Crypto hacks caused 766 million dollars in losses in September.
• Bitget and Liquid Network concentrate nearly 92% of the initial toll.
• Bitget now estimates the affected funds at 387.5 million dollars.
• Liquid Network suffered a flaw that allowed the fraudulent creation of L-BTC.

Two crypto hacks concentrate 92% of the losses

Fifty-five major incidents were recorded by PeckShield for an initial amount of 766.49 million dollars. CertiK, whose methodology gathers more events, counted about a hundred and estimated losses at nearly 768 million dollars.

Your 1st cryptos with BitgetThis link uses an affiliate program.

Now, this total is raised to 772.4 million dollars on the CertiK dashboard. This revision explains the difficulty of directly establishing a definitive toll, especially when new addresses or victims are identified. The key figures show the concentration of losses :

• Bitget represents 387.5 million dollars of affected funds ;
• Liquid Network totals 318.7 million dollars ;
• These two incidents concentrate nearly 92% of the initial toll ;
• The other 53 attacks followed by PeckShield represent about 59 million dollars ;
• CertiK ranks 739.5 million dollars among the losses related to exploits.

September’s losses would therefore remain less than half of the 136.3 million dollars recorded by PeckShield in August, excluding the toll from Bitget and Liquid Network. This monthly record does not indicate a uniform explosion of attacks.

The Bitget hack costs nearly 388 million dollars

Bitget detected unauthorized transfers on September 24. The incident affected several wallets on Ethereum, other EVM-compatible networks, XRP Ledger, Zcash, and Tron.

The exchange initially estimated the affected funds at 351.6 million dollars. It then raised this estimate to 387.5 million after including new transactions. Its cold wallets and private keys are said not to have been compromised.

According to Bitget, hackers exploited a flaw in a third-party security product to obtain internal access credentials. They then allegedly falsified withdrawal orders to bypass system controls.

The platform claims that its protection fund, equipped with over 464 million dollars, will fully cover the losses. “We will not flee this situation, and every dollar will be accounted for,” said its CEO, Gracy Chen. This coverage remains, however, a company commitment, the execution of which will need to be monitored.

Liquid reveals a flaw at the heart of the Bitcoin protocol

The Liquid Network incident occurred on September 6. A vulnerability in Elements, the software on which this Bitcoin sidechain relies, allowed about 3,998.5 L-BTC to be created without corresponding bitcoins as collateral.

The flaw concerned the system responsible for verifying confidential crypto transactions. Thus, the hacker prepared several operations to deceive the validation cache, then used a malicious transaction to issue unauthorized L-BTC. The assets were then converted into native bitcoins by the network’s exit mechanism.

The value involved reached about 318.7 million dollars at the time of the attack. The author presented themselves as a security researcher and promised to return the funds after node corrections. This “white hat” qualification, however, raised doubts, as no authorized audit foresaw the withdrawal of several thousand bitcoins.

PeckShield estimates that about 285 million dollars were ultimately returned. The gross amount of the incident is nonetheless recorded among the monthly losses, before deduction of recovered funds.

Crypto hacks weigh on the entire third quarter

Behind Bitget and Liquid, CertiK records several more limited incidents. Safe Wallet users lost about 7.8 million dollars. D’CENT and Duelbits each suffered nearly 6 million dollars in damages, while NEAR Intents reported a loss close to 3.9 million.

The third quarter thus totals 1.27 billion dollars in losses, compared to 819.4 million in the previous quarter. The increase reaches 54.4%. After accounting for frozen or returned sums, CertiK reduces the quarter’s adjusted losses to about 869.6 million dollars.

Technical exploits represent 95.7% of September’s damages. Compromises of private keys, wallets, and phishing campaigns remain numerous, but their financial weight appears secondary compared to the two main attacks.

The final toll may still evolve in line with recoveries and new victims identified. September mainly shows that a single failure in a central infrastructure can weigh more than several dozen attacks combined.