Crypto security incidents led to about $730 million in reported outflows in September 2026, according to a monthly report from Lingzhi Technology that cited data from multiple blockchain security monitoring platforms. The report said the month was defined by a clear shift in attacker focus toward exchange backends and lower-layer infrastructure. Two incidents alone accounted for more than 95% of the total: a Bitget hot-wallet backend manipulation attack that caused about $387.5 million in losses, and a Liquid Network validator software exploit that caused about $319 million.
The report added that the $730 million figure reflects incident-reporting and fund-outflow scale, not final unrecoverable net losses. In the Liquid Network case, the attacker returned about 85% of the stolen funds, or roughly $272 million, leaving about $47 million still outstanding.
Attack patterns moved beyond smart contracts
September’s cases showed a broader mix of methods at work. The report pointed to exchange backend manipulation, validator software flaws, governance proposal manipulation, oracle price manipulation, cross-chain bridge balance drains and DEX liquidity pool attacks. In its view, the target set is moving from smart-contract bugs toward infrastructure.
Six major hacking incidents
Bitget hot-wallet backend manipulation attack
Date: Sept. 25. Reported loss: about $387.5 million.
The report said attackers exploited a zero-day vulnerability in a third-party security product to obtain high-privilege internal credentials. They then forged withdrawal instructions and bypassed risk-control checks, moving about $387.5 million in assets from Bitget’s hot-wallet and warm-wallet infrastructure across Ethereum, XRP, BSC, Arbitrum and Avalanche.
Bitget said private keys were not compromised, cold wallets were unaffected and user balances were not impacted. The exchange said losses were covered by a user protection fund of more than $464 million. It also said it had isolated affected systems, reset internal credentials and started an investigation and on-chain tracing with multiple security firms.
Liquid Network validator software exploit
Date: Sept. 6. Reported loss: about $319 million.
According to the report, the attacker exploited a rangeproof cache collision bug in Elements, the validator software used by Liquid Network. That allowed the attacker to mint about 4,000 L-BTC without real asset backing and then redeem real bitcoin through SideSwap’s peg-out mechanism.
The attacker, who described themselves as a white hat, negotiated with Blockstream through on-chain messages and returned about 3,400 BTC after the flaw was fixed. That represented about 85% of the stolen amount. About 598.5 BTC, valued in the report at roughly $47 million, had not been returned.
Neutron governance proposal manipulation
Date: Sept. 22. Reported loss: about $4.4 million.
The attacker spent about 20,199 USDC to buy roughly 31.6 million NTRN and staked the tokens about 12 minutes before voting closed. A malicious governance proposal then passed with about 82% support. The attacker gained admin control over 11 contracts, migrated them to malicious code and stole about $4.4 million in assets.
Cosmos Hub validators later coordinated a network halt of about 25 hours and moved about 1.23 million ATOM from addresses linked to the attacker as part of asset recovery efforts.
Duelbits hot-wallet private key leak attack
Date: Sept. 24. Reported loss: about $7 million.
The report said the crypto gambling platform Duelbits was attacked through what appeared to be a hot-wallet private key leak rather than a smart-contract flaw. The attacker took direct control of the hot wallet and moved about 836 ETH, 1.62 million USDT, 97,000 USDC, 31,500 DAI, 12.4 billion SHIB and 8.1 BTC to a new address. Most of the assets were later swapped into ETH and consolidated into a single address.
A Duelbits co-founder confirmed losses of about $7 million, said user funds were safe and said the platform would remain offline until the investigation was complete and the hot wallet was replenished.
Nostra oracle price manipulation attack
Date: Sept. 17. Reported loss: about $3.5 million.
The attacker created a fake liquidity pool and paired it with wash trading to push the quoted price of NSTR from about $0.006 to about $49.5, a jump of nearly 8,000x. Because Nostra’s lending protocol relied on a third-party price source that read the pool’s quote, the attacker used the heavily inflated NSTR as collateral and borrowed about $3.5 million worth of ETH, STRK, USDC, USDT, WBTC and DAI from the Starknet money market.
The attacker later bridged about $1.92 million of the stolen assets to Ethereum, including 234.57 ETH and 1.3 million DAI. Nostra suspended lending, withdrawals and liquidations after the incident.
Payy Network cross-chain bridge exploit
Date: Sept. 24 at 4:21 UTC. Reported loss: about $1.83 million.
Payy Network’s Ethereum bridge was attacked and its entire balance, about $1.8 million in USDC, was drained. The report said the attacker used the privacy protocol Railgun to obscure funding flows and then swapped the USDC into ETH.
Payy Network, described in the report as a rollup project offering on-chain payroll and treasury services, said the lost funds were non-custodial assets deposited by users. It had not disclosed the exact cause of the flaw. The project suspended all operations after the attack.
Phishing and rug-pull cases
The report also listed five representative phishing and rug-pull incidents.
- On Sept. 16, a victim using an Ethereum address beginning with 0xe268 lost $565,768 in sUSDat after signing a phishing signature.
- On Sept. 25, a user on Ethereum lost $67,572 in USDT in an address-poisoning attack. The report listed the correct address as 0xca16b299700674dda6941baa1bdeeff6d90fd94b and the wrong address as 0xca166632d25ea74baa93a5303aa73f61e80fd94b.
- On Sept. 26, a user on XRP Ledger signed a phishing transaction and lost $37,927 in XRP. The victim address was listed as rGtghKcmYY8gdUQwQerY5Ruww2LvdbgWVh.
- In the DYORSWAP fake-mainnet phishing case disclosed on Sept. 27, scammers set up a fake GIWA mainnet and integrated a fake cross-chain RPC into DYORSWAP, inducing users to send ETH to a fake bridge contract. The report said about $2 million was stolen. GIWA said its mainnet had not launched, and the DEX project started compensation for affected funds.
- In September, email service provider Brevo, used by Trezor, was attacked. After obtaining some customer contact data, the attackers sent phishing emails disguised as official security warnings to about 347,000 Trezor users, urging them to download malicious software and enter wallet backup passwords. The report said the case stood out because the attackers did not hit the wallet directly. They first compromised an upstream service provider and then used the stolen user data for targeted phishing.
Robinhood Chain meme-coin rug pulls
This case covered the period from July 10 to Sept. 21 and was disclosed on Sept. 27. Reported losses were at least $18.43 million.
On-chain analysis cited in the report said the same operator group was likely linked to at least 53 meme-coin launches on one chain. The group used a large number of related wallets to accumulate more than 70% of token supply early in trading, drew in retail participation through project momentum and then sold into that demand. In some projects, internal wallets controlled 82% to 86% of supply.
The report said proceeds from one project were used to launch the next, creating a repeating cycle of issuance, concentrated control, buyer attraction, dumping and relaunch. Total extracted funds were estimated at no less than $18.43 million.
What changed in September
The report’s conclusion was that the move from smart-contract exploits to lower-layer infrastructure became more explicit in September 2026. Beyond the Bitget and Liquid Network cases, it also pointed to a FastSwap liquidity pool flash attack, the 8,000x false quote used in the Nostra oracle manipulation, the drained Payy Network bridge balance and the Duelbits hot-wallet key leak as part of the same pattern.
Its central point was that attackers are systematically looking for weak spots in infrastructure rather than confronting contract code head-on. In the Bitget case, the attacker obtained internal credentials through a zero-day flaw in a third-party security product, forged withdrawal instructions and bypassed risk controls without touching private keys. In the Liquid Network case, a flaw in validator software was enough to put hundreds of millions of dollars at risk.
Security recommendations from Lingzhi Technology
The security team offered recommendations for users, projects and the wider industry.
- For individuals: be cautious with crypto links recommended by AI tools, always use official channels, avoid signing unlimited approvals and review token approvals regularly.
- For projects: raise governance thresholds and add delayed execution mechanisms; conduct dedicated audits of validator software and cache mechanisms; exchanges should closely review data-integrity checks in backend authorization systems; DEXs should strengthen monitoring for abnormal liquidity-pool trading.
- For the industry: establish backend security standards for exchanges, improve monitoring of supply-chain risk tied to third-party security products and keep tracking how state-level APT groups such as North Korea’s Lazarus evolve their methods.