Crypto firms and users have lost nearly $2.7 billion to security incidents this year, with North Korea-linked thefts exceeding $1 billion.

Blockchain security firm CertiK recorded 658 incidents through September , with about $420.4 million of stolen assets frozen or returned. That leaves adjusted losses of roughly $2.26 billion and an average loss of $4.1 million per incident.

September sharply altered the year's tally. Losses reached about $766.5 million, surpassing April's $651.3 million and making it the costliest month of 2026. Bitget's $387.5 million breach and the $318.7 million Liquid Network incident accounted for more than $700 million of the damage.

The surge has left the annual total increasingly dependent on a small number of outsized attacks. It has also brought state-linked theft deeper into the industry's security calculations after blockchain analytics firm Elliptic said suspected North Korean hackers have taken more than $1 billion in crypto this year.

September propelled Bitget and Liquid Network to the top of CertiK's 2026 incident ranking, widening the gap between the largest breaches and hundreds of smaller attacks.

Bitget alone represents about 14.4% of CertiK's year-to-date losses. Liquid Network ranks second, followed by KelpDAO at $291.3 million , Drift Protocol at $285.3 million , and an unidentified victim at $284.8 million.

Those five incidents account for about $1.57 billion, or almost 59% of the $2.68 billion recorded so far this year.

That concentration means a single compromise at a large exchange, protocol, or infrastructure provider can materially change the industry's annual loss profile. For context, Bitget and Liquid Network together contributed roughly $706 million, equivalent to more than a quarter of all gross security losses tracked by CertiK in 2026.