Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC The total amount of stolen crypto assets in September reached US$766 million. Bitget and Liquid incidents led the loss this month.
PeckShield statistics show that a total of 55 major cryptocurrency hacking incidents occurred in September, resulting in a total loss of approximately US$766.49 million. This figure surged by approximately 462% from $136.3 million in August. It is worth noting that two of these incidents constituted almost the entire loss for the month.
Two major vulnerabilities dominate the situation this month.
According to PeckShield, the Bitget incident involving approximately US$387 million and the Liquid Network theft involving approximately US$320 million (of which US$285 million has been recovered) has become the largest and second largest cryptocurrency theft so far this year, surpassing the previous exploit incidents suffered by Drift and KelpDAO/LayerZero. If these two incidents are excluded, the total losses caused by the remaining 53 hacking attacks are approximately US$59 million, which is only less than half of the total losses in August.
Previously reported that Bitget stated that its security system detected unauthorized transfers of some hot money packages at 18:31 UTC on September 24. CEO Gracy Chen explained that the attacker hacked into the backend system of the wallet infrastructure and forged transaction data, thereby deceiving the authorization process to release funds. Chen ruled out the possibility of private keys being leaked and stressed that cold wallets, which hold most of the exchange's assets, were not affected. The exchange plans to absorb the loss from its user protection fund, which holds more than $464 million. "We will not shirk our responsibilities and every penny will be properly settled," Chen wrote on social media X.
The loss of Liquid Network occurred earlier on September 6, when hackers calling themselves "white hats" extracted about 4000 BTC from Liquid Federation's wallet. This extraction used SideSwap's anchored withdrawal authorization key, although Liquid pointed out that the key itself had not been compromised. In an on-chain communication with Blockstream, the hacker promised to return the funds after patching all nodes. Ledger CTO Charles Guillemet is skeptical, pointing out that legitimate cybersecurity researchers typically do not clear out bridge funds first before requesting online contact.
Money Laundering Tracking and Smaller Losses
SlowMist pointed out in an update dated September 29 that North Korea-related hackers are laundering money by matching CoW Protocol orders with Chainflip deposit addresses, converting stolen Bitget funds into BTC, and then using CoinJoin technology to conceal the flow of funds. Cos, founder of SlowMist, believes that anti-money laundering inspections have fallen behind automated scripts. Chainflip is trying to block those flows and has rejected at least one deposit, but opted to refund the funds rather than freeze the funds.
The other eight incidents in PeckShield's top 10 list ranged from $3.15 million to $7.81 million in losses. The largest one involved a pre-transaction operation involving the MEV robot "yoink", and the relevant funds have been recovered. Payment processor V2 and the LimitBreak contract, which became the center of the September 25 White Hat Rescue incident, caused $6.6 million in losses, of which $3.4 million has been recovered. In the operation, security researcher Quit removed 23,155 NFTs worth nearly $6 million from exposed wallets, while another independent vulnerability path caused 660 WETH to fail to be recovered.
