DeFi hacks, September 2026: the worst month of the year, read through the post-mortems

The month in numbers

September 2026 was the worst month for crypto hacks this year, according to the two firms that count them.

• PeckShield: 55 major incidents and $766.5 million stolen.
• CertiK: 97 incidents and $768.4 million lost. CertiK's dashboard puts the 2026 total so far at 656 incidents and $2.68 billion.

Both firms say September was a large step up from August. Two events account for most of it: the roughly $388 million breach at the exchange Bitget, which is a centralised exchange and outside this site's DeFi scope, and the roughly $320 million Liquid Network exploit. More than $270 million of the Liquid amount was later returned, according to reports. Net of that, the month's losses are closer to half a billion dollars.

The firms also list Safe Wallet, DCENT and Duelbits at about $7.8 million, $6 million and $5.9 million. We have not written those up. One caveat on the $7.8 million: the label "Safe Wallet" is the firms' shorthand, while independent analysis of the incident describes a third-party helper contract used from a Safe wallet, not a flaw in Safe's own contracts. We cover that kind of failure in our FlashLoopAdapter article, which is a different incident from 1 October.

The incidents we covered

Dates are UTC. Figures come from the project's own account unless noted, and different projects count loss differently. Do not treat the list as a clean total.

• 3 September, Notional V1. About 1.65 million USDC and 69,000 DAI taken from a deprecated escrow contract after an integer overflow. Nothing recovered, according to Notional. Article.
• 4 September, Pragma and Vesu. A faulty USDT conversion halved major prices on Starknet and triggered 47 liquidations. Vesu reports 95% of assets recovered at 11 September prices. Article.
• 6 September, Liquid Network. About 4,000 BTC of unbacked L-BTC after a proof-cache flaw. 3,400 BTC returned, about 602 BTC outstanding. Article.
• 7 September, Hemi Genesis Drop. About 124.5 million unclaimed HEMI drained through a reentrancy flaw, sold for about $255,000. Article.
• 11 September, Symbiosis Bitcoin Bridge. A 330-satoshi deposit became 46.1 billion unbacked syBTC. Real losses estimated at 9.97 BTC, about $770,000. Article.
• 17 September, Nostra Finance. About $3.5 million borrowed against NSTR, whose price was manipulated. Article.
• 22 September, Astroport and Drop on Neutron. A $20,199 stake purchase passed a vote that handed over contract admin. About $6.24 million taken, about $4.01 million secured, per Neutron's post-mortem. Article.
• 23 September, Meter Passport. About $2.3 million of unbacked wrapped tokens, per Blockaid. No full post-mortem. Article.
• 24 September, Payy. A forged proof was accepted and the bridge paid about 1.92 million USDC. Article.
• 24 September, Limit Break Payment Processor V2. About $2.8 million in confirmed losses through a forged sender, and about 23,000 NFTs rescued by whitehats. Article.
• 29 September to 1 October, NEAR Intents. About $3.8 million in "ghost funds", reported returned. The incident straddles into October. Article.

Leaving Liquid aside, the ten others add up to roughly $25 million on the figures above. That is a mix of exact amounts, estimates and different definitions, so use it only as a sense of scale. It is about 3% of the monthly totals the two firms report. The big money was elsewhere.

What repeated

Four patterns show up more than once.

Money created from nothing. Liquid, Symbiosis, Meter and Payy each let something look like a claim on real assets when nothing backed it, and NEAR Intents did it with an internal ledger. We look at this pattern in Unbacked mints: five incidents, one question.

Cheap inputs, large outcomes. Neutron's vote, Nostra's price and Vesu's conversion are examined in The $20,000 problem.

Old code with live money. Notional's deprecated V1 escrow, Hemi's legacy claim contract and Limit Break's immutable V2 all sat in production long after their owners had moved on. Two of the three could not be paused or patched.

Trust in the caller. Limit Break's forged sender is the clearest example. The same idea reappears in the October FlashLoopAdapter incident.

What is still unresolved on 19 October

• Liquid. Peg-outs were reported suspended as of 17 October, with a gap of about 600 BTC. No date for a restart.
• Neutron. Cosmos Hub's vote to move the recovered ATOM passed on 12 October. Neutron's own vote to return funds to the contracts was still open.
• Pragma and Vesu. Curator refunds were still in progress according to Pragma's latest update.
• Payy. The network was paused and the claims process had not been published when we last checked.
• Meter. No technical post-mortem.
• Nostra. Final loss and recovery not published.

Method and limits

ThreatWire chose incidents for which a project post-mortem or at least two independent sources exist. We did not copy data from DefiLlama or similar dashboards, and we do not link third-party analyses; we name them in the text. Totals from PeckShield and CertiK are theirs. Our incident figures come from the sources named in each article, and we have not verified them on chain. The live list is on the DeFi Incident Tracker.