Centralized Exchange And DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet Failures

Crypto hacks have produced roughly $2.35 billion in net losses so far in 2026 after freezes and returns, according to a report by Lightning.news shared with Bitcoin Magazine. A security researcher by the name of Stacy Muur posted on X compiled "a list of protocols that were hacked for more than $50,000 in 2026." 230 protocols year-to-date. "Crypto security is absolutely cooked." September alone accounted for about $768 million in Muur's tally, driven mainly by centralized exchanges and DeFi rather than pure Bitcoin self-custody hardware wallets, which got significant news coverage at the time.

The largest single loss was Bitget's September 24 drain of roughly $387.5 million from hot and warm wallets. The exchange and firms including Chainalysis, Elliptic, and TRM Labs have linked the incident to North Korea, citing IP patterns consistent with prior DPRK-linked VPN use, on-chain overlaps with wallets tied to earlier Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. Attackers used third-party security products to inject fraudulent withdrawal commands without taking private keys.

Liquid Network, Blockstream's Bitcoin sidechain, took the next-largest hit when attackers exploited an Elements software bug in early September to mint about 4,000 unbacked L-BTC and peg them out for roughly 4,000 real bitcoins, valued near $320 million at the time. The self-described white-hat actors returned 3,400 BTC after negotiations conducted on-chain via OP_RETURN messages and kept about 600 BTC. No federation keys were compromised. The loss came from a type of inflation bug on the Liquid network protocol.

Samson Mow later called the episode part of an "avalanche of AI-assisted attacks" that had already reached other Bitcoin-adjacent software before hitting Liquid. The network is back and running now, having covered the losses, presumably from investors.

DeFi platforms showed the same pattern of concentrated, high-value losses. Drift Protocol lost approximately $285--296 million in an April governance and multisig compromise that involved months of social engineering. An investigation commissioned by the project attributed the operation to North Korean actors.

KelpDAO's LayerZero-powered rsETH bridge was drained of roughly $292 million in unbacked tokens after a single-verifier design was subverted. LayerZero stated that preliminary indicators pointed to DPRK's Lazarus Group, specifically TraderTraitor.

Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August. Validators later rewound the chain and recovered the majority, though several million dollars that had already been bridged off-network were not restored.

Incidents involving Bitcoin hardware wallets were smaller in aggregate despite the wide news coverage. Galaxy Research placed the Coinkite RNG hack values in the range of roughly 1,596--1,789 BTC, on the order of $100--130 million, with higher upper-bound estimates near 2,055 BTC.

Ledger losses of roughly $86--102 million traced to devices sold through the authorized Southeast Asian reseller CryptoBilis, where an unauthorized hardware implant captured recovery phrases during setup, a supply chain attack. The company stated that confirmed cases were limited to that reseller's supply chain and that its own systems and direct sales were unaffected, though there are unconfirmed reports of such bugged devices making it to German markets. Combined, however, these hardware-adjacent events remain well below the single largest CEX and DeFi incidents.

The year has also coincided with the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development. Muur has stated that "AI is definitely making it much easier to find and exploit bugs. I think we're entering a pretty serious cybersecurity arms race."

Reports note that code-flaw exploits accelerated after the February release of models such as GPT-5.3-Codex and Claude Opus 4.6, which showed high success rates on smart-contract bug benchmarks at low cost.

OpenAI has disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls to complete tasks. Most of the year's largest heists still relied on traditional vectors such as key compromise, social engineering, and infrastructure flaws, but the lowered barrier for discovering and weaponizing bugs adds a new layer of risk, particularly for complex smart-contract systems and sidechains.

Bitcoin's base layer itself has not been the source of these losses. The bulk of the 2026 damage has concentrated in CEX hot-wallet infrastructure, DeFi governance, oracle designs, and Bitcoin sidechain code, while pure self-custody hardware wallets, even when imperfect, have accounted for a distinctly smaller share. Nevertheless, calls for an update to self custody recommendations have emerged from industry leaders, pushing forward multivendor multisig wallets as the future of niche industry.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.