In parallel with Bitcoin’s record growth in September 2026, the cybersecurity landscape of the crypto market took a dark turn. According to a CoinDesk report citing CertiK, the crypto asset industry suffered losses of up to $1.27 billion from 247 security incidents in Q3 alone, bringing total stolen funds since the start of the year to $2.68 billion.
Notably, September set a new peak for loss scale in 2026, recording 99 attacks (the highest level since February 2025) with record losses of $768.5 million. The latest update as of October 2 from CertiK shows an even higher figure: Q3 saw up to 249 incidents causing $1.27 billion in losses, representing a 54.4% increase in damage value and a 13.7% increase in incident volume compared to Q2 ($819.4 million from 219 incidents). Discrepancies between reports stem from data systems being updated after publication; therefore, actual Q3 losses are determined to fall between $1.26 and $1.27 billion.
Most of the losses came from a single attack vector
Looking at the loss structure in September, the distribution was heavily skewed: smart contract exploits were the primary cause, accounting for up to 95.5% of total losses (equivalent to $737.6 million). Conversely, other vectors accounted for very modest shares: lost private keys represented just 1.8%, wallet risks 1.5%, and scams approximately 0.8%.
However, the picture shifts when evaluated by incident volume. Although smart contract vulnerabilities still led with 60 cases, phishing, wallet thefts, and private key compromises accounted for a much higher proportion of incident count relative to the damage value they caused. This situation reflects the reality that most incidents occurred sporadically at a small scale, while the overall picture was heavily driven by a few exceptionally large breaches.
Specifically, the two largest incidents of the month accounted for over 90% of total industry losses: the exploits at Bitget ($387.5 million) and Liquid Network ($318.7 million). Loss severity dropped sharply from third place onward, for example the incident involving a Safe wallet using rsETH recorded only about $7.8 million. This massive disparity reinforces CoinGecko’s observation: the top 10 most severe attacks accounted for 72.5% of all lost funds during the study period.
The Bitget case was mentioned previously, including details of the hot wallet drained of $387.5 million on September 25 and THORChain’s response declining to freeze funds on September 29. Nevertheless, CertiK’s latest report adds a noteworthy detail: Bitget officially took the top spot, while Liquid Network unexpectedly appeared in second place at nearly $318.7 million, an incident rarely mentioned in media cybersecurity coverage over the past week.
Insurance shrinks while risks grow
Beyond the scale of losses, post-incident financial response capability is an even more concerning aspect. According to an August 27 announcement in CoinGecko’s State of Crypto Security 2026 report, active on-chain insurance capacity shrank 20.2%, dropping from $163.2 million to $130.2 million.
This shortfall becomes evident when compared directly to total losses: the period from January 2025 to July 2026 recorded $3.63 billion lost across 245 incidents, yet actual insurance payouts totaled a modest figure of around $33 million. Insurance coverage stood at a mere 0.9% of losses. As a result, 5/9 on-chain insurance protocols in CoinGecko’s tracked portfolio were forced to cease operations or pivot to other sectors.
This situation stems from core reasons: high insurance premiums, a scarcity of capital providers willing to underwrite risk, and the challenge of protecting an asset class that is a primary target for hackers. Additionally, coverage scope is constrained by numerous exclusions: most crypto insurance contracts do not cover risks from scams, lost private keys, human operational errors, or price volatility.
Consequently, large-scale exchanges have built their own protective mechanisms. Notably, Binance maintains a self-insurance fund of about $1.16 billion, nearly 9 times the size of the entire on-chain insurance market. However, this self-coverage approach demands immense financial resources. For smaller exchanges, DeFi protocols, or newly established projects that lack billion-dollar reserves, the absence of a financial buffer leaves them with almost no support when facing major exploits.
AI is shortening the time window to patch bugs
Beyond the statistical figures, the most noteworthy aspect in CoinDesk’s report is the element of speed. According to Oliver Carding, Chief Marketing Officer at Tesseract Group, the greatest long-term concern lies in artificial intelligence tools automating the search for smart contract vulnerabilities. A process that once took an experienced expert several months is now significantly compressed, leaving teams with an extremely narrow window to fix issues before bad actors exploit them.
This threat was also highlighted by two independent organizations. CertiK noted that cybersecurity threat dynamics are evolving rapidly. Meanwhile, Blockaid suggested that attacks targeting AI agents via prompt injection will become the most common entry vector, as this technique can manipulate agents into taking actions against user interests.
From an outside perspective, this is the crucial focal point to monitor closely. Although Q3 2026 was still characterized by traditional attacks where losses were concentrated in a few large entities and contracts, the Q4 outlook faces a major potential shift. This comes at a time when asset recovery rates remain modest, attackers increasingly optimize AI to discover vulnerabilities, and the insurance shield has eroded to a level where it can hardly withstand new severe shocks.