$766M Crypto Hacks: What It Means for Your Custody

The security firm CertiK published its monthly tally on September 30, 2026, and it reads worse than any month before it this year: crypto platforms and their users lost around $766.4 million in September through exploits and phishing. That is roughly three and a half times the August figure of $215 million, and it is at the same time the month with the highest number of individual incidents in 2026.

For an investor in Europe the sum is at first a number from another world. It gets interesting once you take it apart. The $766 million did not accumulate out of hundreds of small fraud cases but came, to more than 92 percent, from exactly two events. And both of them hit a place where your balance could be sitting too.

CertiK counts $766.4 million in damage for September 2026

CertiK puts the total damage at $766,451,111. Of that, around $270.6 million counts as returned or frozen, which leaves roughly $495.8 million actually lost. For comparison: in the first half of 2026 CertiK counted $1.32 billion across 344 incidents, a figure that was 46.8 percent below the first half of 2025. September has caught up with that calmer trend in a single month.

Exploit here means the abuse of a technical weakness in software or infrastructure, as distinct from phishing, where a user is talked into granting approval. The large sums almost always arise in the first case, the number of incidents grows in the second.