The Daily Ledger: 1 October 2026

Subject: September cost crypto $768 million, and two incidents were 92 percent of it
Preview: Two independent trackers agree on the worst month of 2026 to within $2 million. Net of the bitcoin an attacker handed back, the real figure is closer to $497 million.

THE DAILY LEDGER

1 October 2026
September closes as 2026's costliest month for crypto theft, almost entirely because of two custodial failures, while bitcoin recovers above $84,500 to open the fourth quarter

Editor's note: prices checked at 18:31 UTC on 1 October 2026 (20:31 Europe/Stockholm). Monthly loss totals are tracker estimates published at month end, not audited figures, and the net calculation below is our own arithmetic on their components.

September 2026 was the worst month for crypto theft this year, with CertiK counting about $768.4 million across 97 incidents and PeckShield about $766.5 million across 55. Two events produced roughly 92 percent of that: the Bitget exchange breach on 24 September and the Liquid Network incident on 6 September. September 2026 was the worst month for crypto hacks because of where money was pooled, not because attacks became more frequent or more sophisticated.

1. The Day in Numbers

• Bitcoin: $84,800 at 18:31 UTC, up about 1.1 percent over a rolling 24 hours, having opened the quarter at $83,576.
• Ether: $2,701 at 18:31 UTC, up about 0.9 percent over the same window.
• Fear and Greed Index: 74, Greed, up three points from Wednesday's 71.
• Total crypto market value: $2.90 trillion, down 2.28 percent on the day, with bitcoin dominance at 58.7 percent and ether at 11.3 percent.
• September theft losses: about $768.4 million on CertiK's count, against about $220.3 million in August. Tracker estimates, published at month end.

2. Why September 2026 was the worst month for crypto hacks

The honest answer is concentration. Of CertiK's $768.4 million, the Bitget breach accounts for about $387.5 million and the Liquid Network incident about $318.7 million. Every other incident in the month, all 95 of them on that count, adds up to roughly $62.2 million. A month like this is not a security trend. It is two large pools failing in the same four weeks.

The gross number also overstates the damage. The Liquid Network attacker returned 3,400 of the roughly 4,000 bitcoin taken, around 85 percent, which leaves about $47.8 million unrecovered from that incident. Add the Bitget loss and the long tail and the month's unrecovered cost comes to roughly $497 million. A headline that counts gross losses counts money that came back.

Two details are worth keeping. First, the trackers disagree about what counts as an incident, 55 against 97, and still land within $2 million on the money, which is the strongest signal either of them produces. Second, both of the month's large events happened at custodians rather than at individual wallets. The Bitget breach reached an exchange's automated wallet layers and the Liquid incident exploited a flaw in the Elements codebase that let unbacked tokens be created on a federated sidechain.

What we still do not know is the entry route at Bitget. The company has pointed at compromised third-party security software and engaged Mandiant and SlowMist. Until that work is published, attribution reported elsewhere remains an allegation.

3. Today's Headlines

Bitget's last withdrawal window is tomorrow

Remaining tokens and fiat are scheduled to reopen on 2 October, completing a four stage restart that began with bitcoin on 28 September. Tuesday's net outflow of roughly $463 million was the largest single day the exchange has recorded.

A quarter that ended better than it started

Bitcoin rose about 42.7 percent between the opening of 1 July and the opening of 1 October, and ether about 71.0 percent, on CoinGecko snapshots. Those are completed returns for a closed period and say nothing about the quarter now beginning.

No verified international development today

The first of October produced no confirmed policy or market development outside the United States worth reporting. The month's European items, the ECB's Pontes launch and ESMA's new supervisory priority, were covered when they happened.

4. Security Note

The month's own data is the note. If 92 percent of September's losses came from two custodial failures, then the single decision that most affects an individual's exposure is how much they leave in somebody else's custody, and for how long.

The rule: size each custodial balance to the job it is doing. Money you are actively trading this week belongs on an exchange. Money you are holding does not, and the gap between those two states is where almost all of this year's $2.68 billion was lost. Set a figure you are willing to have on any one venue, write it down, and sweep anything above it to cold storage on a schedule rather than when the news scares you into it. Our running list of this year's incidents is on the crypto exploit tracker.

5. From the Academy Library

What a reserve snapshot proves is in proof of reserves, what recovery actually looks like in can stolen crypto be traced and recovered, and bridge and sidechain risk in cross-chain bridges. New readers can start at Academy School.

A record month that is 92 percent two incidents is a story about custody concentration, not about attackers getting better. The fourth quarter starts with the same pools still pooled.

Disclaimer: This publication is for education and information only. It is not financial, investment, legal, tax, or security advice.

Sources and further reading

• crypto.news: crypto loses $768 million in the worst hack month of 2026
• The Cryptonomist: September 2026 crypto hacks cause $766 million in losses
• CoinDesk: the $320 million Liquid Network exploit
• CoinDesk: Bitget loses $352 million and says user funds are safe
• The Crypto Times: the record outflow and the 131 percent reserve snapshot
• CoinGecko: global market data used for the figures above
• Alternative.me: Fear and Greed Index