# How Crypto Lost Billions in 2026: A Breakdown of the Year’s Biggest Hacks
The cryptocurrency world has faced a brutal year in 2026, with attackers siphoning off billions of dollars across exchanges, decentralized platforms, and Bitcoin-related infrastructure. A staggering 230 protocols have fallen victim to exploits valued above $50,000, and experts are warning that the current state of crypto security demands urgent attention.
Here’s a clear look at what happened, who was affected, and what it means for the future of digital assets.
—
## The Big Picture
By the end of September, the combined losses from crypto hacks had reached approximately $2.35 billion — and that figure includes funds frozen or recovered. A single month, September alone, accounted for roughly $768 million in losses, with centralized exchanges and decentralized finance platforms taking the hardest hits.
Security analysts have pointed to a troubling trend: the tools used in these attacks are becoming more sophisticated, faster, and cheaper to deploy.
—
## The Largest Heist: Bitget Exchange
The single biggest incident of the year struck Bitget on September 24, when attackers drained approximately $387.5 million from its hot and warm wallets. Investigators traced the attack to North Korean hacking groups by identifying IP patterns linked to previous state-sponsored operations. The attackers didn’t steal private keys directly. Instead, they manipulated third-party security software to issue fraudulent withdrawal instructions.
This incident has drawn comparisons to the infamous 2025 Bybit theft, with forensic firms noting overlapping wallet behavior and infrastructure signatures.
—
## Bitcoin Sidechain Under Siege: Liquid Network
Blockstream’s Liquid Network, a Bitcoin sidechain, suffered a major exploit in early September. Attackers found a software vulnerability in the Elements codebase that allowed them to create around 4,000 unbacked tokens and convert them into real Bitcoin — worth roughly $320 million at the time.
In a rare turn of events, the attackers identified themselves as white-hat actors and negotiated their return directly on the blockchain. About 3,400 of the 4,000 stolen Bitcoins were eventually returned, with the attackers keeping roughly 600 BTC. Notably, the attack exploited a protocol-level inflation bug, not a compromise of the network’s federation keys.
The sidechain has since resumed normal operations, with losses covered through existing reserves.
—
## DeFi Platforms Hit Hard
Decentralized finance platforms continued to face concentrated, multi-million-dollar losses throughout the year.
– **Drift Protocol** lost between $285 and $296 million in an attack that exploited its governance and multisig systems. The breach involved months of careful social engineering before the final exploit was executed. Investigators concluded that North Korean actors were responsible.
– **KelpDAO** saw approximately $292 million drained from its LayerZero-powered rsETH bridge. The attack targeted a flaw in the bridge’s single-verifier design, making it easy for hackers to bypass the system’s security checks. LayerZero has publicly linked the incident to North Korea’s Lazarus Group and a specific entity known as TraderTraitor.
– **Tectonic**, a platform operating on the Cronos blockchain, lost about $120.4 million in a late August incident where attackers manipulated collateral to borrow funds illegitimately. Validators managed to reverse the affected chain, recovering most of the stolen funds — though several million dollars that had already been moved off the network could not be retrieved.
—
## Hardware Wallet Vulnerabilities: Smaller but Notable
Despite dominating headlines, incidents involving Bitcoin hardware wallets resulted in comparatively smaller losses.
– **Coinkite** devices were affected by a random number generator flaw, with estimated losses ranging from roughly 1,596 to 2,055 BTC — between $100 million and $130 million depending on the estimate.
– **Ledger** faced losses of approximately $86 to $102 million, traced to devices sold through an authorized reseller in Southeast Asia called CryptoBilis. Attackers had physically modified the devices with unauthorized hardware implants designed to capture recovery phrases during the initial setup process. Ledger emphasized that its own systems and direct sales channels were not compromised.
While these hardware wallet incidents made headlines, they collectively accounted for a much smaller share of total losses compared to the centralized exchange and DeFi breaches.
—
## The Role of AI in Crypto Attacks
One of the most talked-about developments of 2026 is the role artificial intelligence plays in hacking. AI coding agents capable of scanning software for vulnerabilities and automating the creation of exploits have been deployed practically throughout the year.
Security researcher Stacy Muur, who has been tracking the year’s incidents closely, has described the situation as a “serious cybersecurity arms race,” stating that AI is making it significantly easier to both find and exploit software bugs.
The release of advanced AI coding models — including GPT-5.3-Codex and Claude Opus 4.6 in February — accelerated the pace of code flaw exploitation. These models demonstrated high success rates on smart contract vulnerability benchmarks at minimal cost.
OpenAI has acknowledged internal cases where AI agents accessed unauthorized test funds or bypassed platform controls during testing. While most major hacks this year still relied on traditional methods such as key theft, social engineering, and infrastructure weaknesses, the lowered technical barrier introduced by AI adds a concerning new dimension to the threat landscape.
—
## The Silver Lining: Bitcoin’s Base Layer Remains Strong
It is important to note that Bitcoin’s core blockchain has not been compromised in any of these incidents. The vast majority of the $2.35 billion in losses came from centralized exchanges, DeFi protocols, oracle systems, and Bitcoin sidechain software — not from Bitcoin’s fundamental network.
This distinction matters because it shows that while the broader crypto ecosystem faces serious security challenges, Bitcoin’s base layer remains fundamentally resilient.
—
## FAQ
**Q: What is a “hot wallet” and why is it a target?**
A: A hot wallet is a cryptocurrency wallet that is connected to the internet, used for quick transactions. Because it is online, it is more vulnerable to remote attacks compared to cold wallets, which are kept offline. Exchanges typically store the majority of user funds in hot wallets to facilitate fast withdrawals and trading.
**Q: What is a sidechain?**
A: A sidechain is a separate blockchain that runs parallel to a main blockchain, like Bitcoin. It allows assets to move between the two chains, often enabling faster or more flexible transactions. Sidechains use their own software and security models, which can introduce unique vulnerabilities.
**Q: What does “unbacked tokens” mean?**
A: Unbacked tokens are digital assets created without having a corresponding reserve of real cryptocurrency held in reserve. In the Liquid Network incident, attackers minted tokens that claimed to represent Bitcoin but were not actually supported by real BTC — allowing them to effectively create value out of nothing.
**Q: What is the Lazarus Group?**
A: The Lazarus Group is a well-known North Korean state-sponsored hacking collective that has been linked to numerous high-profile cyberattacks, including cryptocurrency thefts and ransomware operations over the past several years.
**Q: Are hardware wallets still safe to use?**
A: Yes, but with caveats. Hardware wallets remain one of the most secure ways to store cryptocurrency, especially when purchased directly from manufacturers rather than third-party resellers. Supply chain attacks, like the one affecting Ledger, highlight the importance of buying from trusted sources and verifying device integrity before use.
**Q: What is AI making easier for hackers?**
A: AI coding agents can automatically scan software for bugs, generate exploit code, and identify weaknesses in smart contracts much faster than a human could. This dramatically reduces the time and technical skill required to launch sophisticated attacks.
**Q: Has any of the stolen money been recovered?**
A: Yes. Significant portions of stolen funds have been recovered through various means, including white-hat negotiations (as in the Liquid Network case), chain reversals (as in the Tectonic case), and law enforcement tracking. However, billions of dollars remain unrecovered.
—
## Conclusion
The year 2026 has been a stark reminder that the cryptocurrency ecosystem, while revolutionary in its potential, still carries serious security risks. From massive centralized exchange breaches to sophisticated DeFi protocol exploits and the emerging threat of AI-powered attacks, the landscape of digital asset security is evolving rapidly.
The good news is that Bitcoin’s base layer has held strong, and the industry is actively responding. Calls for improved self-custody practices, multivendor multisig wallets, and stronger infrastructure security are gaining momentum. As the ecosystem matures, so too must its defenses.
For users, the lessons are clear: diversify storage methods, buy hardware from trusted sources, and stay informed about the risks before committing funds to any platform.
Thank you for reading
