Security breaches and exploits have cost cryptocurrency users and companies close to $2.7 billion thus far this year, with thefts tied to North Korea surpassing the $1 billion milestone.
Through September, blockchain security firm CertiK documented 658 security incidents. Approximately $420.4 million of the stolen funds have been successfully frozen or returned, leaving adjusted losses at roughly $2.26 billion and an average loss of $4.1 million per incident.
The financial damage escalated significantly in September. Total losses climbed to about $766.5 million—eclipsing April’s $651.3 million to become the most expensive month of 2026. This surge was largely driven by a $387.5 million breach at Bitget and a $318.7 million incident affecting the Liquid Network, which together accounted for upwards of $700 million in losses.
This wave of attacks has made the annual loss total heavily reliant on a handful of massive exploits. Furthermore, it elevates state-backed threats within the industry’s risk assessments, following an announcement from blockchain analytics firm Elliptic that suspected North Korean hackers have pilfered over $1 billion in digital assets this year.
Mega-hacks are reshaping the annual toll
Following September’s events, Bitget and the Liquid Network now lead CertiK’s ranking of 2026 security incidents, stretching the distance between these massive breaches and hundreds of smaller-scale attacks.
The Bitget hack alone accounts for roughly 14.4% of all losses tracked by CertiK year-to-date. The Liquid Network stands in second place, followed by KelpDAO with $291.3 million, Drift Protocol with $285.3 million, and an anonymous victim at $284.8 million.
Combined, these five events make up approximately $1.57 billion, or nearly 59% of the $2.68 billion documented throughout the year.
Because of this high concentration, a single security failure at a major infrastructure provider, protocol, or exchange can drastically alter the industry’s yearly financial damage report. To put this in perspective, Bitget and the Liquid Network combined accounted for roughly $706 million—amounting to over 25% of all gross security losses monitored by CertiK in 2026.
The skewed nature of September’s data further highlights this disparity. Excluding the two major attacks, the remainder of the month’s incidents contributed only a fraction of the $766.5 million aggregate.
At the same time, portions of the stolen funds have since been recovered. CertiK notes that $420.4 million in assets have been returned or frozen this year, bringing the adjusted loss total down to $2.26 billion. The Liquid Network managed to recover a significant amount of its impacted funds, and other breaches have similarly seen partial or complete asset recoveries.
Consequently, the gap between gross and adjusted figures continues to expand as blockchain operators, security companies, token issuers, and exchanges act with greater speed to flag and restrict stolen capital.
Even so, the ability to recover funds does not erase the immediate operational impact on impacted organizations. Major hacks can force companies to halt operations, restock customer funds, rebuild technical infrastructure, and deploy capital long before any stolen assets are ultimately retrieved.
Security incidents are also dispersing across various sectors of the crypto ecosystem. CertiK’s yearly figures indicate that multi-chain exploits resulted in the highest financial damage, whereas Ethereum experienced the highest volume of security events.
The threat landscape has expanded past digital vectors as well. CertiK tracked 52 physical “wrench attacks” during the first half of 2026, marking an increase from 39 during the corresponding period last year. Financial exposure stemming from these physical confrontations jumped from $10.5 million to $124.2 million, while the average sum involved grew from roughly $270,000 to approximately $2.4 million.
North Korea’s crypto theft machine crosses $1 billion in 2026
The expanding scale of individual hacks has magnified the influence of one of the cryptocurrency sector’s most persistent threat actors.
Elliptic reported that the Bitget exploit pushed the total value of thefts attributed to North Korea past $1 billion in 2026, encompassing more than 51 suspected attacks. The analytics firm concluded that the Bitget compromise bears a strong likelihood of ties to the Democratic People’s Republic of Korea, pointing to laundering patterns, overlapping infrastructure with historical attacks, and additional markers.
When evaluated against CertiK’s industrywide gross loss metric of $2.68 billion, North Korea’s total via Elliptic’s tracking constitutes over 37% of all security losses registered this year.
Previously, Elliptic connected the roughly $286 million Drift Protocol exploit to North Korean operators. Since Drift also ranks among CertiK’s top five incidents for 2026, suspected DPRK activity is linked to multiple major crypto heists this year alone.
This high concentration builds upon a multi-year campaign that has netted North Korea billions of dollars over the past decade.
Last year, Elliptic estimated that hackers linked to the DPRK had looted upward of $6 billion in digital assets since 2017. Governments and international bodies maintain that these funds are utilized to support the nation’s nuclear weapons and ballistic missile initiatives.
Historically, North Korean cyberattack units initially targeted traditional financial institutions and banks before shifting their focus toward cryptocurrency enterprises. The appeal of the crypto sector lies in its large reserves of liquid, transferable assets capable of crossing international borders without traditional banking intermediaries.
In 2019, the U.S. Treasury Department sanctioned the Lazarus Group and affiliated entities, classifying them as state-backed teams managed by North Korea’s Reconnaissance General Bureau.
Several of the largest historical exploits in crypto history have since been blamed on the nation. U.S. officials connected Lazarus to the approximately $620 million Ronin Bridge theft in 2022, and the Treasury noted that the network employed crypto mixers to launder funds from the $100 million Atomic Wallet breach alongside other attacks.
This escalation reached a high point in February 2025, when threat actors absconded with roughly $1.46 billion from Bybit, marking the largest verified crypto theft on record. The FBI officially attributed the exploit to North Korea, while Elliptic mapped the subsequent movement of those funds across thousands of distinct addresses, cross-chain platforms, and laundering services.
These money-laundering tactics have grown increasingly sophisticated as blockchain analytics providers, stablecoin issuers, and exchanges enhance their capabilities to trace and freeze stolen funds. According to Elliptic, North Korean operators frequently leverage repeated cross-chain transactions, mixing tools, and less-regulated networks to obscure the transaction trail.
Consequently, North Korea remains one of the most unpredictable variables affecting crypto security in 2026, as state-sponsored actors continually pose a significant danger to the developing ecosystem.