CEX and DeFi Breaches Drove $2.35 Billion in 2026 Crypto Hacks

Crypto hacks have produced roughly $2.35 billion in net losses so far in 2026 after freezes and recoveries, according to a report by Lightning.news shared with Bitcoin Magazine. The tally, cross-referenced with a list of hacked protocols compiled by security researcher Stacy Muur on X, counts 230 protocols breached for more than $50,000 year-to-date. Muur's verdict on the state of the sector was blunt: "Crypto security is absolutely cooked."

The distribution of those losses matters more than the headline figure. September alone accounted for about $768 million, driven overwhelmingly by centralized exchanges and DeFi protocols rather than the Bitcoin self-custody hardware wallet failures that dominated news coverage during the same period. What does this change for practitioners? The evidence points operational risk squarely at exchange hot-wallet infrastructure, bridge designs and governance processes, not at the base Bitcoin chain.

What were the largest incidents?

The single largest loss was Bitget's September 24 drain of roughly $387.5 million from hot and warm wallets. Chainalysis, Elliptic and TRM Labs have each linked the incident to North Korea, citing IP patterns consistent with prior DPRK-linked VPN use and on-chain overlaps with wallets tied to earlier Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. The attackers did not obtain private keys. They used third-party security products to inject fraudulent withdrawal commands.

Liquid Network, Blockstream's Bitcoin sidechain, took the second-largest hit. Attackers exploited a bug in the Elements software in early September to mint roughly 4,000 unbacked L-BTC and peg them out for approximately 4,000 real bitcoins, valued near $320 million at the time. No federation keys were compromised; the loss came from an inflation-type flaw in the protocol itself. Self-described white-hat actors returned 3,400 BTC after negotiations conducted on-chain via OP_RETURN messages and kept about 600 BTC. The network has since resumed operation and covered the losses, presumably from investors.

Samson Mow later described the episode as part of an "avalanche of AI-assisted attacks" that had already reached other Bitcoin-adjacent software before hitting Liquid.

DeFi showed the same pattern of concentrated, high-value losses:

• Drift Protocol lost approximately $285–296 million in an April governance and multisig compromise involving months of social engineering; a project-commissioned investigation attributed the operation to North Korean actors.
• KelpDAO's LayerZero-powered rsETH bridge was drained of roughly $292 million in unbacked tokens after a single-verifier design was subverted. LayerZero said preliminary indicators pointed to DPRK's Lazarus Group, specifically TraderTraitor.
• Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August. Validators rewound the chain and recovered most of it, though several million dollars already bridged off-network were not restored.

How large were the hardware wallet failures?

Despite the coverage, hardware wallet incidents were materially smaller in aggregate. Galaxy Research placed losses from the Coinkite Coldcard RNG hack at roughly 1,596–1,789 BTC, on the order of $100–130 million, with upper-bound estimates near 2,055 BTC. Ledger-related losses of roughly $86–102 million traced to devices sold through the authorized Southeast Asian reseller CryptoBilis, where an unauthorized hardware implant captured recovery phrases during setup — a supply chain attack. Ledger stated that confirmed cases were limited to that reseller's channel and that direct sales and its own systems were unaffected, though unconfirmed reports describe bugged devices reaching German markets. Combined, these events sit well below any one of the largest CEX or DeFi incidents.

Is AI changing the threat model?

The year has coincided with the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development. Muur has stated: "AI is definitely making it much easier to find and exploit bugs. I think we're entering a pretty serious cybersecurity arms race." Reports note that code-flaw exploits accelerated after the February release of models such as GPT-5.3-Codex and Claude Opus 4.6, which posted high success rates on smart-contract bug benchmarks at low cost. OpenAI has disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls to complete tasks.

Most of the year's largest heists still relied on traditional vectors — key compromise, social engineering and infrastructure flaws. But the lowered barrier to discovering and weaponizing bugs adds a new layer of risk for complex smart-contract systems and sidechains. Bitcoin's base layer has produced none of the year's losses.

The practical consequence is already visible: industry leaders are pushing multivendor multisig as the new custody baseline, and pressure on exchanges to harden hot-wallet and third-party vendor infrastructure will define the next round of security spending.