Key Highlights
- CertiK recorded $2.68 billion in gross crypto security losses in 2026, with five incidents accounting for almost 59% of the total.
- Bitget’s $387.5 million breach was the year’s largest reported crypto incident, while Bitget and Liquid Network together contributed about $706 million in losses.
- Elliptic said suspected North Korean hackers stole more than $1 billion in crypto across more than 51 incidents during 2026.
Mega-Hacks Are Reshaping Crypto’s 2026 Losses
Crypto security losses in 2026 have become increasingly dependent on a small number of exceptionally large attacks. CertiK recorded $2.68 billion in gross losses, but five incidents accounted for about $1.57 billion, or almost 59% of the year-to-date total.
Bitget’s $387.5 million breach ranked as the largest reported crypto incident of the year, followed by the Liquid Network attack. KelpDAO ranked third at $291.3 million, Drift Protocol fourth at $285.3 million, and an unidentified victim fifth at $284.8 million. Bitget alone represented approximately 14.4% of CertiK’s year-to-date losses.
The concentration of losses means that a single compromise involving a major exchange, protocol or infrastructure provider can significantly alter the industry’s annual security profile. Bitget and Liquid Network together generated roughly $706 million in losses, equivalent to more than one-quarter of CertiK’s gross total for 2026.
September highlighted that imbalance. The month recorded $766.5 million in total losses, but the Bitget and Liquid Network incidents accounted for most of that amount. The remaining attacks during the month contributed only a fraction of the monthly total.
Asset Recoveries Reduce Adjusted Losses but Not Immediate Damage
Some stolen assets have since been frozen or returned. CertiK said $420.4 million had been recovered or restricted during 2026, reducing its adjusted loss figure to $2.26 billion. Liquid Network recovered a substantial portion of the assets involved in its breach, while other incidents also produced partial or full returns.
The widening difference between gross and adjusted losses reflects faster action by exchanges, issuers, security companies and blockchain operators to identify suspicious transactions and restrict stolen funds. However, recoveries do not remove the immediate financial and operational burden on affected businesses.
Large breaches can force companies to suspend services, restore customer balances, rebuild infrastructure and commit additional capital before any recovered assets become available. The attacks are also affecting multiple parts of the crypto market. CertiK’s annual data indicates that incidents spanning multiple blockchains produced the largest dollar losses, while Ethereum recorded the highest number of security events.
Physical Crypto Attacks Are Also Increasing
The threat has expanded beyond software vulnerabilities and on-chain exploits. CertiK recorded 52 so-called “wrench attacks” during the first half of 2026, compared with 39 during the same period a year earlier.
Losses linked to those physical attacks rose to $124.2 million from $10.5 million. The average value involved increased to approximately $2.4 million, up from about $270,000 in the comparable period last year.
North Korean Crypto Theft Surpasses $1 Billion
The growing size of individual breaches has increased the impact of one of the crypto industry’s most persistent adversaries. Blockchain analytics firm Elliptic said the Bitget incident pushed the value stolen in attacks attributed to North Korea above $1 billion in 2026. The total covers more than 51 suspected incidents.
Elliptic assessed the Bitget breach as highly likely to be connected to the Democratic People’s Republic of Korea, citing laundering patterns, infrastructure shared with earlier attacks and other indicators. Compared with CertiK’s $2.68 billion gross-loss figure for the entire industry, Elliptic’s North Korea tally represents more than 37% of recorded security losses this year.
Elliptic had previously linked the approximately $286 million Drift Protocol exploit to North Korean actors. Drift Protocol is also one of CertiK’s five largest incidents of 2026, indicating that suspected Democratic People’s Republic of Korea operations are connected to more than one of the year’s biggest crypto thefts.
The 2026 total extends a campaign that has generated billions of dollars for North Korea over the past decade. Elliptic estimated last year that hackers linked to the Democratic People’s Republic of Korea had stolen more than $6 billion in crypto since 2017. Governments and international organizations have said the proceeds help finance North Korea’s nuclear weapons and ballistic-missile programs.
How North Korean Hacking Operations Target Crypto
North Korean hacking groups initially became known for attacks on banks and traditional financial infrastructure. They increasingly shifted toward cryptocurrency businesses, where large pools of transferable assets can move across borders without depending on the conventional banking system.
The US Treasury designated Lazarus Group and related organizations in 2019, describing them as state-sponsored operations controlled by North Korea’s Reconnaissance General Bureau. US authorities later linked Lazarus to the approximately $620 million Ronin Bridge theft in 2022. The Treasury also said the group used crypto mixers to launder proceeds from the $100 million Atomic Wallet attack and other hacks.
The escalation reached a peak in February 2025, when attackers stole about $1.46 billion from Bybit in the largest confirmed crypto theft on record. The FBI formally attributed the breach to North Korea. Elliptic subsequently tracked the movement of the stolen funds through thousands of addresses, cross-chain services and laundering platforms.
As exchanges, stablecoin issuers and blockchain analytics firms improve their ability to freeze and trace stolen assets, the laundering methods used by North Korean operators have become more complex. Elliptic said those operators increasingly rely on repeated cross-chain transfers, mixers and less-monitored networks to make transaction trails more difficult to follow.
Why This Matters
The 2026 security figures show that headline crypto losses can be driven by a handful of major breaches rather than a uniform increase across hundreds of incidents. This concentration raises the financial stakes for exchanges, protocols and infrastructure providers whose compromise can shift the industry’s annual loss profile almost immediately.
The data also underscores the growing role of state-linked cyber operations in crypto security planning. North Korean actors account for more than $1 billion in suspected thefts during 2026 alone, while physical attacks, multi-chain incidents and increasingly sophisticated laundering methods are broadening the risks faced by the industry.
Although faster freezing and recovery efforts have reduced adjusted losses, businesses still face service interruptions, balance replenishment costs and infrastructure rebuilding after a breach. North Korea’s activity therefore remains one of the largest variables in the crypto industry’s security losses for 2026.
Frequently Asked Questions
What was the largest crypto breach recorded in 2026?
Bitget’s $387.5 million breach was the largest reported crypto security incident in CertiK’s 2026 ranking, ahead of Liquid Network and KelpDAO.
How much crypto did suspected North Korean hackers steal in 2026?
Elliptic said suspected North Korean hackers stole more than $1 billion across more than 51 incidents during 2026.
How much of the industry’s 2026 crypto loss has been recovered?
CertiK counted $420.4 million in assets as frozen or returned, reducing its adjusted loss estimate from $2.68 billion in gross losses to $2.26 billion.