Bitget's $388M hack pushes Q3 crypto losses past $1B
Bitgets 388m hack pushes Q3 crypto security losses past $1 billion after attackers drained hot wallets on Sept. 24. CertiK data shows industry losses hit $1.26 billion across 247 incidents, up 53.9% from Q2, with Bitget alone driving about 31% of the quarter's total.
Key Takeaways
- Bitget lost about $387.5 million in a Sept. 24 hot-wallet breach, the largest Q3 2026 security incident per CertiK.
- Industry-wide crypto security losses reached $1.26 billion across 247 incidents in Q3, up 53.9% from $819.4 million in Q2.
- September alone saw roughly $769 million in losses across 99 incidents, with exploits making up nearly 96% of that month's damage.
- Attackers exploited a third-party security product flaw to obtain Bitget credentials and forge withdrawal commands.
- About $273 million of September's losses was frozen or returned, cutting adjusted monthly losses to $495.3 million.
What happened in the Bitget $388 million hack?
On Sept. 24, Bitget detected unauthorized transfers from some of its hot wallets and suspended withdrawals. According to Cointelegraph reporting on CertiK's findings, the exchange said attackers exploited a vulnerability in a third-party security product to obtain internal credentials and forge withdrawal commands.
CertiK put the Bitget loss at roughly $387.5 million. That single event accounted for about 31% of all Q3 crypto security losses under the firm's methodology, making it the quarter's largest recorded incident and the clearest reason bitgets 388m hack pushes the industry tally over the billion-dollar mark.
How bad were Q3 2026 crypto security losses overall?
CertiK tracked $1.26 billion in losses across 247 security incidents in the third quarter of 2026. That was a 53.9% jump from $819.4 million in Q2, while the incident count rose about 13%, from 219 to 247.
Other major Q3 hits included Liquid Network's $319 million exploit on Sept. 6, Tectonic at $120 million, and a $112.7 million Coldcard theft. For ongoing exchange and DeFi risk coverage, see our Fintech & Crypto Alerts hub.
Why did September dominate the quarter's damage?
September was the standout month: CertiK recorded roughly $769 million in losses across 99 security incidents. About $273 million was frozen or returned, leaving adjusted losses of $495.3 million.
Exploits drove nearly all of that pain. Across 58 incidents, exploits accounted for $734 million — nearly 96% of September's losses — underscoring how a handful of large breaches can redefine a quarter's risk picture for exchanges, wallets, and crypto users closely watching security trends.