DefiLlama tallies 250 crypto hacks in 2026 as losses top $1B by September

Crypto hackers are working more shifts this year. They just aren’t bringing home the same paychecks.

DefiLlama data shows 250 hacking incidents in 2026 through early September, with roughly $1.4B drained. That is already far more attacks than the 146 recorded across 2025, even though last year’s losses were bigger at about $2.7B.

The numbers behind the surge

The count kept rising after that early-September snapshot. By late September, DefiLlama’s tracker showed as many as 277 incidents for the year, with losses near $1.84B.

For comparison, the full 2025 tally landed at 148 incidents and roughly $2.715B in losses. So 2026 has nearly doubled last year’s incident count with a quarter of the calendar still left.

Frequency ramped up early. More than 100 incidents were logged in the first half of 2026 alone.

Then the third quarter hit. Q3 2026 became the worst quarter of the year so far, with over $1.25B lost across 116 separate incidents.

Two events did much of the damage. On September 6, Liquid Network lost $320M because of a flaw in how it verified its peg, meaning the system that confirms assets are properly backed failed to do its job.

Then on September 24, centralized exchange Bitget took a $387M hit, the largest single incident of 2026. Bitget isn’t a DeFi protocol, which shows the tracker’s scope reaches beyond smart contracts to custodial platforms too.

More attacks, smaller bites

The pattern in the data looks like a market that has fragmented. Individual median loss sizes appear to be shrinking even as the incident count climbs.

Old-fashioned smart contract bugs haven’t gone away. But a growing share of recent attacks come from operational mistakes, social engineering, and messy interactions between different protocol components.

Earlier in the year, major exploits hit Kelp DAO and Drift Protocol. Those incidents helped set the tone well before the Q3 spike arrived.

A long history of losses

DefiLlama’s historical records show cumulative losses exceeding $21B across more than 1,200 incidents since around 2020.

What this means for users, protocols, and regulators

For protocols, security is becoming a competitive differentiator. The shift toward operational and social engineering attacks also means audits alone won’t cut it. Key management, employee training, internal access controls, and monitoring of cross-chain components all need attention.

What to watch next: whether Q4 continues the Q3 pace, and whether 2026’s total losses end up approaching or surpassing 2025’s figure. The incident count has already blown past last year’s.

Also worth tracking is how the affected platforms respond. Recovery efforts, reimbursement plans, and post-mortem disclosures from Bitget and Liquid Network will signal how seriously the industry takes accountability.