Crypto hackers have taken $2.7 billion in 2026 and the losses are alarmingly concentrated

What it is

CertiK's 2026 incident data (658 incidents through September) and Elliptic's North Korea attribution analysis, as aggregated by CryptoSlate. The page adds the granular monthly breakdown and recovery figures behind the headline $2.7B number that the existing summary doesn't carry.

How it works

CertiK tracks gross losses vs. adjusted losses after frozen/returned funds: $420.4 million was frozen or returned in 2026, cutting the gross $2.68 billion figure to an adjusted $2.26 billion — average loss per incident is $4.1 million. September 2026 was the costliest month on record at $766.5 million (surpassing April's $651.3 million), driven almost entirely by Bitget ($387.5M) and Liquid Network ($318.7M), which together contributed roughly $706 million — over a quarter of the year's gross losses in two incidents. Liquid Network recovered a large portion of its stolen funds, which is a specific driver of the gross/adjusted gap the summary doesn't mention.

Elliptic's North Korea attribution for Bitget rests on stated indicators: laundering behavior patterns and infrastructure shared with earlier known DPRK attacks. Post-theft, Elliptic says DPRK operators launder via repeated cross-chain transfers, mixers, and less-monitored networks to break the transaction trail — the same playbook used after the $1.46B Bybit theft (Feb 2025), where funds moved through thousands of addresses and cross-chain services.

Preconditions / Affected

Multi-blockchain incidents generated the largest dollar losses industry-wide, while Ethereum had the highest incident count — relevant for prioritizing monitoring scope. Wrench attacks (physical coercion) rose from 39 to 52 incidents H1 2025→H1 2026, with average loss per incident jumping from ~$270,000 to ~$2.4 million, indicating attackers are now targeting higher-value individuals rather than just increasing attack frequency.

What to do

The page states no mitigation commands or technical remediation steps — it's a data-aggregation piece. The actionable signal is operational: exchanges/protocols should weight incident-response and fund-freezing speed, since the $420.4M recovered this year came from faster identification and restriction of stolen funds by exchanges, issuers, and analytics firms post-breach, not prevention.

Caveats

Elliptic's DPRK attribution for Bitget is qualified as "highly likely," not confirmed, based on circumstantial indicators (laundering behavior, shared infrastructure) rather than disclosed forensic proof. The $6 billion DPRK-since-2017 figure is Elliptic's own prior-year estimate, not independently verified in this piece.