September Crypto Hacks Hit $766 Million, Worst of 2026
Hacks took $766 million in September, the worst month of 2026. Bybit and Bitget then published reserve reports. What Indian users should check now.
Crypto platforms and users lost about $766.4 million (around ₹7,360 crore) to hacks, exploits and phishing in September 2026, the highest monthly total of the year, blockchain security firm CertiK said on Wednesday 30 September. About $270.6 million has been returned or frozen, which leaves a net loss of roughly $495.8 million. On the same day Bybit and Bitget, two large offshore exchanges, published fresh proof-of-reserves reports showing that they hold more of each covered coin than their customers have on deposit.
Key takeaways
- September's losses were about 3.5 times August's $215 million, and two incidents made up more than 92% of the total.
- Bitget lost $387.5 million from its hot and warm wallets on 24 September; the Liquid Network, a Bitcoin sidechain built by Blockstream, lost about $318.7 million on 6 September and got most of it back.
- Bybit's 40th reserve report shows all 50 covered tokens at or above 100%, including bitcoin at 104% and USDT at 110%.
- Bitget's 47th report shows an overall 131% across 19 assets, taken five days after the hack.
- A reserve report is a snapshot, not insurance. For Indian users the first check is still FIU-IND registration.
What went wrong in September
Two very different incidents drove the month. At Bitget, attackers used a weakness in a third-party security product to obtain access credentials and forge withdrawal commands on 24 September, the exchange said; its cold wallets were not touched. On the Liquid Network, an attacker used a bug in how nodes cached proof checks to create unbacked Liquid bitcoin on 6 September and take nearly 4,000 BTC. Some 3,400 BTC came back the next day; about 598.5 BTC stayed with the attackers.
| How the money was lost | Amount in September |
|---|---|
| Weakness in a third-party service (Bitget) | $387.5 million |
| Faulty signature or proof checks (mainly Liquid) | $324.7 million |
| Compromised personal wallets | $20.1 million |
| Permission errors in DeFi apps | $13.3 million |
| Reentrancy bugs | $2.2 million |
The figures are CertiK's. For comparison, it counted $1.32 billion in losses across 344 incidents in the whole first half of 2026. Our earlier report covers the Bitget hack and its revised losses.
Bitget: withdrawals and a 131% reserve report
Bitget has reopened withdrawals in stages: bitcoin on 28 September, ether on 29 September and USDT at 08:00 UTC on 30 September on the Ethereum, BNB Smart Chain, Solana and Tron networks. Other tokens, fiat and P2P withdrawals are due to reopen at 08:00 UTC (1:30 PM IST) on Friday 2 October. Chief executive Gracy Chen has said the loss will be covered by the exchange's User Protection Fund, and on 30 September she said the fund was back above $300 million.
Its 47th monthly reserve report, based on a snapshot on 29 September, puts the overall ratio at 131% across 19 assets, up from four assets in earlier reports. Bitcoin is covered 142%, ether 110%, USDT 107% and USDC 154%. Bitget has published these reports every month since December 2022.
Bybit's 40th reserve report
Bybit, which lost about $1.5 billion to hackers in February 2025, released its 40th report from Dubai on 30 September. Based on a 23 September snapshot and checked by the auditor Hacken, it values mainstream assets at $19.6 billion, up from $18.1 billion a month earlier, and adds 10 tokens to the list. All 50 tokens covered were at or above 100%: bitcoin 104%, ether 103%, USDT 110% and USDC 223%.
Bybit matters to Indian users because it serves India. FIU-IND fined it ₹9.27 crore on 31 January 2025 for operating without registration and had its website blocked; Bybit then registered and restored full access for Indian users by September 2025. Our guide on whether Bybit is legal in India explains its status in detail.
What a reserve report does and does not prove
A proof of reserves shows that, at one moment, an exchange held at least as much of each listed coin as it owed customers. Both exchanges let you check that your own balance is included, using a Merkle tree, without seeing anyone else's. It does not show debts outside the report, what happened after the snapshot, or whether the hot wallets are secure. It is not deposit insurance either, and crypto balances in India have none. Read what happens to your crypto if an exchange shuts down before you keep a large balance on any platform.
What Indian users should do now
- Check registration first. Use platforms on our FIU-registered exchanges list. For the big offshore names, see whether Binance is legal in India.
- Keep only trading money on an exchange. Move long-term holdings to a wallet you control, and store the seed phrase offline. Fake browser extensions and seed-phrase phishing are the usual traps; our guide on MetaMask in India shows how to avoid them.
- Cash out through a registered exchange, not P2P. Our guide on withdrawing from Trust Wallet to a bank account walks through the safe route.
- Act fast if you are hit. Call the 1930 cybercrime helpline and file a complaint on the national cybercrime portal; our guide on how to report a crypto scam in India lists the steps.
FAQ
How much crypto was stolen in September 2026?
About $766.4 million, the highest monthly total of 2026, according to CertiK. Around $270.6 million was returned or frozen, so the net loss was about $495.8 million.
Is Bybit legal in India?
Yes. Bybit paid a ₹9.27 crore FIU-IND penalty in 2025, registered as a reporting entity and restored full access for Indian users by September 2025. It was not among the 15 platforms FIU-IND targeted in September 2026.
Does a proof of reserves mean my funds are safe?
Not fully. It shows the exchange held enough of each listed coin at the snapshot date, but it does not cover later losses, hidden debts or hacks after that moment.
This article is AI-assisted, educational and general in nature. It is not financial advice and never a guarantee of profit. Every trade is at your own risk on your own exchange. See our risk disclosure and editorial policy.
