Core Summary

According to multiple blockchain security and research firms, the crypto industry lost $768 million to hacks in September 2026, the worst single-month figure of the year. NEAR Intents and the Bitget exchange both fell victim to major incidents, putting industry security back at the center of regulatory and institutional attention. The pattern underscores how on-chain financial complexity is outpacing security maturity and how institutional capital entry is raising the bar for custody and audit standards.

Event Details

According to Gadgets 360 and several independent blockchain security research firms, cumulative crypto industry losses from hacks in September 2026 reached $768 million, materially above other months of the year and the highest single-month figure of the year. The losses span multiple categories, including smart contract exploits in decentralized finance protocols, validator and key-management failures in cross-chain bridges, hot wallet and withdrawal pipeline attacks on centralized exchanges, and targeted attacks against early-stage projects in newer public chain ecosystems.

NEAR Intents suffered a roughly $3.8 million exploit late in the month. The project team quickly paused cross-chain services across eleven networks, deployed patches, and initiated a user compensation process. According to The Block, the NEAR team committed to fully compensating affected users and opened an independent technical audit into the root cause. NEAR Intents serves as the cross-chain asset routing backbone for the NEAR ecosystem, and its pause caused short-term friction for applications and users reliant on cross-chain liquidity.

Bitget exchange experienced a larger-scale incident, with Q3 cumulative crypto industry losses crossing the one-billion-dollar threshold after Bitget-related disclosures. The technical details are still being released; Bitget has stated that it is cooperating with security audit firms to publish a complete timeline, fund tracing, and compensation arrangement as quickly as possible. Multiple industry analysts have noted that centralized exchange hot wallets remain one of the industry’s most vulnerable attack surfaces.

The breakdown also shows that September losses were not driven by a single protocol design flaw. Instead, they reflect the compound failure of multiple mechanisms including cross-chain bridge validation logic, contract upgrade permissions, multi-signature governance, and liquidity routing edge cases. As on-chain financial complexity rises, attackers are shifting from single-vulnerability exploitation to more systematic attack chain design, and industry security research and defense must scale accordingly.

Panoramic Analysis

The September loss figure is essentially the concentrated expression of structural tension accumulated in on-chain financial infrastructure during a period of rapid expansion. Over the past several years, decentralized finance, cross-chain bridges, real-world asset tokenization, and institutional custody services have grown simultaneously. Many new protocols and features have been pushed to market without sufficient real-world testing. Attacker capabilities have also scaled meaningfully as industry capital has grown, with leading security labs and state-affiliated hacking groups now including crypto infrastructure among their targets.

From a technology evolution perspective, loss patterns are shifting from single-contract exploits toward systemic failures. Early DeFi attacks often targeted simple reentrancy logic or price oracle manipulation, while today’s major incidents more often involve the compound failure of cross-chain bridge validation logic, contract upgrade authority multi-signature governance, and edge cases in liquidity routing. This requires protocol teams to build in formal verification, fuzz testing, and continuous monitoring as core engineering practices from the architecture stage.

From an industry governance perspective, every major security event pushes standards forward. Over the past few years, security firms such as Certik, OpenZeppelin, and Trail of Bits have continued to grow in authority; more and more projects are now treating audit reports, bug bounties, and continuous monitoring as mandatory disclosure requirements; and major centralized exchanges have improved on proof of reserves, asset segregation, and hot-cold wallet layering. Compared with traditional finance, however, the crypto industry still has substantial ground to make up on security standards.

Deeper implications extend to regulatory posture. Regulators have repeatedly stated over the past year that major security events are an important trigger for bringing the crypto industry into the mainstream financial regulatory framework. The U.S. Securities and Exchange Commission, the European Securities and Markets Authority, and several Asian regulators are all evaluating whether custody, audit, vulnerability disclosure, and incident response should be made mandatory compliance requirements. The September statistics provide concrete material for that discussion and may accelerate more detailed rules in the months ahead.

Multi-Perspective Comparison

Industry security research firms broadly agree that the September loss data shows the crypto industry remains in the early stages of security maturity, and that top projects must treat security engineering as core research and development investment rather than an optional line item. Multiple security researchers have called for the creation of an industry-level vulnerability disclosure sharing platform to accelerate the spread of known vulnerability information and avoid the same flaw being exploited across multiple projects.

Some DeFi advocates emphasize that the defining characteristics of on-chain finance are openness and permissionlessness, which involves tradeoffs against fully controlled centralized systems. They argue that overemphasizing security may sacrifice protocol composability and innovation speed, and that the industry needs to find a sustainable balance between security and innovation.

Regulatory voices argue that September events once again confirm that crypto asset markets need regulatory treatment analogous to traditional finance. Regulators note that major security incidents not only harm investors, but can also transmit to the broader financial system through market confidence channels. Some regulators are evaluating whether major security events should be incorporated into systemic risk reporting frameworks.

Institutional investors tend to treat security standards as a precondition for entry. Multiple institutional asset managers have publicly stated that only projects that meet traditional-finance grade custody, audit, insurance, and operational resilience standards enter their qualified investment universe. September events are expected to further accelerate the winner-take-most dynamic among institutional capital, driving industry concentration toward a smaller set of more professional and compliant top projects.

Editor: GoodInfo Global News Team

Core Summary Crypto exchange Bitget confirmed unauthorized access affecting multiple hot wallets, with roughly $352 million in assets moved to an unidentified address, according to CoinDesk and other industry outlets. Bitget said user funds are safe and that reserves fully cover the exposure, while suspending some withdrawal services. The incident ranks among the largest centralized-exchange security events of 2026, reigniting concerns about custodial trust in crypto markets.

Event Details

Scale and discovery: Blockchain analytics firms detected an unusually large outflow from a cluster of addresses associated with Bitget, totaling around $352 million. The funds were subsequently dispersed and moved to a set of newly created, unidentified addresses. Bitget’s security team later confirmed that the loss originated primarily from unauthorized control over private keys or operational access to a portion of the exchange’s hot wallets, with no direct compromise of cold wallets or user accounts themselves.

Platform response: In multiple statements following the incident, Bitget emphasized that the platform’s “100% user-fund coverage” promise remains intact and that its reserve pool is significantly larger than the exposed amount. Bitget announced a temporary suspension of certain ERC-20 and other chain-based withdrawal services, and said it is working with several blockchain forensic firms to trace the stolen funds. Independent on-chain investigators have begun clustering and tagging the related addresses using behavior patterns and labels.

User reaction and market impact: After details surfaced, parts of the crypto community pushed back on the exchange’s “user funds are safe” framing, citing long-standing concerns that “full reserve” claims often lack transparent, audited verification. Industry observers noted that the incident exposes structural weaknesses in centralized exchange key management, internal permissions segregation, and hot-wallet sizing, and could accelerate capital flows toward regulated custodians and decentralized infrastructure. In the short term, the market is likely to reprice a security premium on centralized exchanges, and regulators may cite this case when tightening custodial compliance requirements.

Big Picture The Bitget incident highlights a deep tension in the 2026 crypto custody landscape. On one hand, centralized exchanges remain the dominant on-ramp for both institutional and retail participants, thanks to fiat on-ramps, derivatives depth, and one-stop product coverage. On the other hand, the promise that “large-scale hot-wallet operations” and “100% user-fund safety” can coexist has been a long-standing technical contradiction. Even when reserves are theoretically large enough to absorb losses, the real measures of resilience are cross-chain liquidity capability, operational redundancy, and mature incident-response processes.

From an industry-evolution perspective, the incident is likely to accelerate two trends. First, regulators in major jurisdictions will tighten specific requirements on centralized exchanges, including mandatory independent audits, transparent reserve composition disclosure, and explicit caps on hot-wallet sizing. Second, demand for decentralized custody, self-custody wallets, and regulated qualified custodians will continue to rise, creating openings for traditional finance custody brands to enter the crypto space.

At a macro level, the event is again a reminder that security costs in crypto do not naturally decrease as market size grows. Attacker tooling and strategies continue to evolve, and exchanges must treat security as a continuous capital and labor investment rather than a one-off compliance expense. The remediation and compensation process following Bitget’s incident will be an important benchmark for the industry’s overall security maturity.

Multiple Viewpoints Platform view: In multiple statements Bitget stressed that “user funds are safe” and “reserves fully cover the exposure,” and said it is cooperating with forensic firms to track the stolen funds, hoping to rebuild market confidence through rapid response and transparency. User community: Some in the crypto community welcomed the “full coverage” framing, while others demanded independent audit evidence and a clear timeline for fund recovery, noting that similar pledges in past industry cases have sometimes faltered.

Industry and regulatory voices: Multiple industry commentators and regulatory representatives pointed out that the incident highlights the need for exchanges to publish proof-of-reserves, increase disclosure frequency, and make cold/hot wallet structures public. Critics focused on accountability and compensation timelines, arguing that current “user funds are safe” language across the industry lacks standardized, enforceable detail, and called on regulators to issue concrete rules on custody transparency and remediation deadlines.

Edited by GoodInfo Global News Desk