BlockThreat - September, 2026

September 2026 saw a massive $780M stolen, the worst month of the year so far driven by just two incidents. The overall numbers of incidents stayed high as well as two mega hacks landed alongside ecosystem-wide pillaging driven by LLM-enhanced threat actors chipping away at anything they can get their hands on.

This month's statistics include multiple CeFi compromises in addition to the usual DeFi coverage. These hacks often spill over into the rest of the ecosystem, but the main reason is to document the largest hack of the year - Bitget. The $387.5M hack, attributed to DPRK, marks the dreadfully expected annual super hack of an exchange. It's certainly not as bad as last year's record-setting $1.5B Bybit hack; however, between Bitget, KelpDAO/LayerZero ($292M), Drift ($285M), Humanity ($36.4M), AFX ($24.1M), Ostium ($23.7M), and others, North Korea already got their $1b+ this year and more.

While, Bitget and Liquid Network account for 91% of month's stolen funds, the remaining 74 incidents account demonstrate continued increase in the number of incidents month to month: August (62), July (50), June (61), May (60), Bloody April (67), March (60), February (20), January (31).

In the rest of this edition, we break down the up to date Top 10 DeFi Attack Vectors that auditors and defenders should focus on to stay ahead of attackers. We then cover the four trends you must pay attention to which account for both the most critical incidents and the continued growth in incident count. Finally, we close with this month's outlook, so you can start preparing not only for today's attacks but also for tomorrow's emerging threats.

BlockThreat Enterprise - org-specific threat intel, monthly private briefings, and tailored feeds for security teams. Learn more.