September cryptocurrency hacking caused record losses of $766 million

Disclaimer: Content does not constitute investment advice. Trading involves risks—please invest with caution!

The cryptocurrency hacking attack in September caused more than US$766 million in losses, setting a record for the year.

According to preliminary estimates by PeckShield and Certik, the economic losses caused by cryptocurrency hacking in September exceeded US$766 million. This is the highest loss record this year. However, Certik subsequently revised the figure to $772.4 million, with Bitget Exchange and Liquid Networks suffering most of the losses.

Summary of Core Points

The September cryptocurrency hack resulted in approximately US$766 million in losses.
Bitget and Liquid Networks accounted for nearly 92% of the initial loss.
Bitget currently estimates that the funds affected are US$387.5 million.
Vulnerability in the Liquid network led to the fraudulent creation of L-BTC.

Two major incidents accounted for the vast majority of losses

PeckShield recorded 55 major incidents with an initial loss of US$766.49 million. CertiK, which uses a different methodology and covers more events, counted about 100 incidents and estimated losses of nearly US$768 million. In CertiK's data panel, the total was revised to $772.4 million. This revision explains the difficulty of directly determining the final amount of loss, especially when a new address or victim is discovered.

Key data shows a high concentration of losses:

Bitget: Affected funds reached US$387.5 million;
Liquid Network: Total losses reached US$331.87 million;
These two incidents accounted for nearly 92% of the initial losses;
The other 53 attacks tracked by PeckShield resulted in approximately $59 million in losses;
CertiK recorded losses related to exploits of $739.5 million.

As a result, if losses from Bitget and Liquid Networks are excluded, September losses will be less than half of the $136.3 million PeckShield recorded in August. This monthly record does not show a uniform outbreak of attacks.

Bitget lost nearly US$388 million in stolen losses

Bitget detected unauthorized transfers on September 24. The incident affected multiple wallets on Ethereum, other EVM-compatible networks, XRP Ledger, Zcash and Tron. The exchange initially estimated the funds affected at $351.6 million, but when new transactions were included, the estimate was revised up to $387.5 million. It is reported that his cold wallet and private key have not been infringed.

According to Bitget, hackers took advantage of vulnerabilities in third-party security products to obtain internal access credentials and then forged withdrawal instructions to bypass system controls. The platform claims that it is equipped with more than $464 million in protection funds that will fully cover these losses.

CEO Gracy Chen said: "We will not escape this situation and every penny will be liquidated." Although this is still a company's commitment, its implementation still needs to be continuously monitored.

Liquid exposes core vulnerability in Bitcoin protocol

Liquid网络的事件发生于9月6日。作为该比特币侧链所依赖软件的Elements存在一个漏洞，允许在没有相应比特币作为抵押的情况下创建约3,998.5个L-BTC。

该漏洞涉及负责验证机密加密交易系统的环节。黑客通过准备多项操作来欺骗验证缓存，然后利用恶意交易发行未经授权L-BTC。随后，这些资产通过网络退出机制转换为原生比特币。涉案价值在攻击发生时约为3.187亿美元。

肇事者自称是安全研究人员，并承诺在节点修复后归还资金。然而，这种“白帽”资格引发了怀疑，因为没有任何授权审计预见数千枚比特币的提取。PeckShield估计，最终约有2.85亿美元被归还。尽管如此，毛损失额仍被计入月度损失统计中，即在扣除追回资金之前。

加密货币黑客攻击拖累整个第三季度

在Bitget和Liquid之后，CertiK还记录了其他几起规模较小的事件。Safe Wallet用户损失约780万美元，D’CENT和Duelbits各遭受近600万美元的损失，NEAR Intents报告的损失接近390万美元。

因此，第三季度的总损失达到12.7亿美元，而上一个季度为8.194亿美元，增幅达54.4%。在考虑冻结或返还的资金后，CertiK将季度的调整后损失减少至约8.696亿美元。

Technical exploit accounted for 95.7% of damage in September. Although private key leaks, wallet theft and phishing activities still occur frequently, the financial impact is secondary compared to the two main attacks. The final total loss may continue to evolve as funds are recovered and new victims are discovered. The main revelation of September was that the impact of a single point of failure in central infrastructure could far exceed the combined effects of dozens of attacks.