2026 Crypto Theft Roundup: Total Losses Surpass $2.3 Billion, Bitget’s $351.6 Million Loss Tops the List Temporarily

As of press time, 86 major security incidents have occurred in the crypto market in 2026. Adding Bitget’s newly disclosed preliminary loss of approximately $351.6 million, total disclosed losses from major incidents this year exceed $2.3 billion. Key incidents include: - Bitget: ~$351.6 million. Attackers breached the key backend system of Bitget’s wallet service, forged transfer instructions, and siphoned dozens of assets across multiple blockchains. Bitget has suspended withdrawals, stating its Protection Fund will cover related losses. - Liquid Network: ~$319 million. Attackers exploited a cache vulnerability in Elements range proof verification to create ~4,000 uncollateralized LBTC, then converted them to BTC via the peg exit mechanism. The attackers later returned 3,400 BTC, leaving ~602 BTC unrecovered. - KelpDAO: ~$292 million. Attackers breached LayerZero-related infrastructure and forged cross-chain messages, minting 116,500 rsETH without underlying asset backing, then used these to borrow other real assets. - Drift Protocol: ~$285 million. Attackers gained control of the security committee via social engineering and pre-signed transactions, added worthless tokens as collateral, and siphoned assets including USDC, SOL, and ETH. - Individual wallet hack: ~$282 million. Attackers impersonated crypto hardware wallet customer support, tricked victims into disclosing their recovery phrases via social engineering, stole 1,459 BTC and 2.05 million LTC, and quickly converted part of the funds to XMR. - Coldcard wallet vulnerability: ~$114 million. Some firmware uses insufficient-strength random numbers when generating recovery phrases, allowing attackers to reconstruct private keys offline without physical access to the hardware, and bulk transfer BTC from related addresses.