CertiK counts 658 incidents through September
According to CertiK, digital asset firms and users lost nearly $2.7 billion in security incidents during the first nine months of 2026. The company recorded 658 incidents through September and reported $420.4 million in frozen or returned assets, reducing adjusted losses to about $2.26 billion.
The five largest incidents accounted for about $1.57 billion: Bitget at $387.5 million, Liquid Network at $318.7 million, KelpDAO at $291.3 million, Drift Protocol at $285.3 million, and an unidentified victim at $284.8 million. Losses reached $766.5 million in September, mainly due to the Bitget and Liquid Network cases.
Elliptic says operators suspected of links to North Korea stole more than $1 billion in digital assets in 2026 across more than 51 suspected incidents. The company assessed a North Korean connection as highly likely in the Bitget case and had also linked the theft of about $286 million from Drift Protocol to these operators.
CertiK also reported 52 physical attacks in the first half of 2026, with total exposure of $124.2 million.
