Why did cryptocurrency hacking break out in September? Losses reached US$766 million

September's crypto market attacks caused heavy losses: two major events dominated the data, and the remaining 53 losses were less than US$60 million.

September's crypto market attacks caused heavy losses. According to PeckShield statistics, a total of 55 major hacking incidents occurred throughout September, resulting in $766.49 million in financial losses. Compared with the total loss of $136.3 million in August, this figure was a significant increase of approximately 462%.

However, it is worth noting that the vast majority of the losses were caused by only two single attacks: the attack on the Bitget exchange caused approximately $387 million in losses, and the Liquid Network incident caused approximately $320 million in losses. In the Liquid incident,$285 million of stolen assets were subsequently returned.

Two major attacks dominated the total losses in September

According to PeckShield, two attacks on Bitget and Liquid Network accounted for almost all losses in September. If these two incidents are excluded, the total damage caused by the remaining 53 attacks is only approximately $59 million. That was even less than half of the total loss of $136.3 million recorded in August.

Details of the attack on Bitget and payment commitments

The attack on Bitget occurred on September 24. The exchange's security system detected an abnormal transfer in the hot wallet section at 18:31 UTC time. CEO Gracy Chen pointed out that the attacker accessed back-end systems in the wallet infrastructure and diverted funds by bypassing the authorization process by forging transaction data.

Chen emphasized that the private key was not compromised and that the cold wallet, which stores most of the exchange's assets, was not affected by the attack. Bitget announced that it will absorb the loss through its user protection fund of more than $464 million. Chen said on Platform X (formerly Twitter) that the losses will be fully compensated and all fund accounts will be frozen.

Liquid Network partially recovered 4000 BTC stolen from 4000 BTC

The attack on Liquid Network occurred on September 6. The attackers removed approximately 4000 BTC from Liquid Federation's wallet. This operation uses SideSwap's peg-out authorization key. Liquid stated that the key had not been disclosed.

The attacker stated in an on-chain message sent to Blockstream that the funds would be returned after all nodes were updated. However, Ledger's CTO Charles Guillemet expressed doubts. He pointed out that real security researchers usually do not communicate online after clearing bridge funds, which is inconsistent with regular behavioral patterns.

In the end, US$285 million of the approximately US$320 million lost in the Liquid incident has been recovered.

Tracking the flow of stolen Bitget funds and money laundering attempts

After the hack, the movement of funds continues to be monitored. SlowMist noted in a September 29 update that hackers believed to have ties to North Korea were trying to launder funds stolen from Bitget. According to SlowMist analysis, the attacker used CoW Protocol orders to match Chainflip's recharge address, then converted assets into Bitcoin, and used CoinJoin technology to confuse on-chain trajectories to increase the difficulty of tracking.

SlowMist founder Cos believes that current anti-money laundering controls lag behind automated attack tools. Chainflip, which is trying to stop the flow of these funds, has rejected at least one top-up transaction but opted to return the funds rather than freeze them directly.

Review of other major security incidents

Among the top ten major incidents listed by PeckShield, the remaining eight attacks caused losses ranging from US$3.15 million to US$7.81 million. The largest of these involved a Front-run attack triggered by a MEV robot called "yoink", and stolen assets have been recovered.

In addition, the Payment Processor V2 white-hat action related to the LimitBreak contract is also included. The September 25 incident affected assets worth $6.6 million, of which $3.4 million has been returned. Security researcher Quit extracted 23,155 NFTs worth approximately $6 million from the exposed wallet. On another attack path, 660 WETH pieces could not be recovered.

Summary

Although the total loss data for September may appear to be a huge jump at first glance, in fact approximately $707 million of the $766.49 million loss came from only two incidents, Bitget and Liquid. Total losses from the remaining 53 attacks remained at around $59 million, indicating that the sharp rise in monthly bills was mainly due to these two major attacks.

This content is based on general market data and does not constitute investment advice. Readers are advised to conduct their own research.