Main Takeaway: September 2026 crypto hacks totaled $766.49M across 55 major incidents, according to PeckShield, about 462% more than August. Two incidents made up most of it: an exchange wallet system and a Bitcoin sidechain peg. Self-custody keeps your coins outside the first kind of failure, and it does not change the second.
| Term | What it means in this report |
|---|---|
| Major hack | An incident large enough to enter PeckShield's monthly count. |
| Exchange wallet system | The hot wallets (keys held on internet-connected servers) and withdrawal logic an exchange uses to move customer funds. |
| Peg verification | The check a sidechain or bridge runs before it mints a token backed by assets locked elsewhere. |
| On-chain approval | A signed permission that lets a smart contract move a token from your address, up to a set limit. |
What happened in September 2026?
September 2026 crypto hacks cost $766.49M across 55 major incidents, based on PeckShield's September summary published on October 1. August's total was $136.3M, so the month-over-month jump is roughly 462%. Two incidents account for about $707M of the September figure.
- An exchange's wallet system was compromised on September 24, and forged withdrawals took about $387M.
- A Bitcoin sidechain had a flaw in its peg verification on September 6, which let about $320M in unbacked tokens be minted. About $285M has since been returned.
- The rest of the top ten includes MEV front-running (a bot reordering transactions to trade ahead of others) at $7.81M, which was returned, a casino platform at $7M, a payment-processing contract at $6.6M with $3.4M returned, several DeFi protocols and a BTC cross-chain bridge at $3.15M.
Which September losses could reach your own coins?
Self-custody changes exposure only where the failure sits with the key holder. The exchange incident hit coins held on that exchange, and coins in a user's own wallet were outside that system. The sidechain incident hit holders of the pegged token, wherever those tokens were stored.
| Type of failure | Whose funds it touches | What self-custody changes |
|---|---|---|
| Platform infrastructure, such as an exchange wallet system | Balances left on that platform | Coins in your own wallet sit outside that system |
| Protocol or bridge verification, such as a sidechain peg | Anyone holding the wrapped or pegged asset | Nothing, because the token's backing fails the same way in any wallet |
| Smart contract bugs in payment, casino or DeFi contracts | Funds deposited into that contract | Only the funds you keep out of the contract |
| Signing layer, such as on-chain approval phishing or malicious contract calls | The address that signed the request | A hardware wallet asks you to confirm each signature separately, then signs what you approve |
Self-custody decisions get distorted when $766.49M is read as one threat, which overstates what a user who withdraws regularly faces and understates what a holder of bridged tokens carries. Signing-layer losses are absent from September's largest incidents, yet they are the category that reaches self-custody wallets directly. Our guide to cross-chain bridge security explains how pegged assets are backed.
Which situation matches yours?
- You mostly keep coins on an exchange: September's largest incident is the relevant one.
- You hold wrapped or bridged assets: the sidechain and bridge incidents apply, and the wallet you use does not change that exposure.
- You connect to dApps often: the signing layer applies, so the on-chain approvals you have granted matter more than any monthly total.
- You hold native assets such as BTC or ETH in long-term cold storage: most of September's losses happened in systems your coins were not part of.
Three Steps Worth Taking This Month
- Use exchanges as a route in and out, and withdraw to your own wallet once a trade is done. See crypto wallets vs exchanges.
- Before holding a wrapped or bridged asset, find out what backs it and who verifies the peg.
- Read each signing request before you confirm it, checking the recipient, the amount and the spending limit on any on-chain approval, and revoke on-chain approvals you no longer use.
FAQ
Why do monthly crypto hack totals differ between trackers?
Trackers set different thresholds for a major hack, and some include scams or phishing while others count only exploits. PeckShield recorded 55 major hacks and $766.49M for September 2026. Other firms published different totals for the same month, with gaps of tens of millions of dollars. This report uses PeckShield throughout, since comparing months inside one tracker gives a consistent trend.
If an exchange is hacked, are the coins I hold on it affected?
An exchange hack affects the coins held in that exchange's wallet system, which includes customer balances stored there. This report does not assess any platform's response to a loss. Coins you have already withdrawn to a wallet where you hold the keys are outside that system and move only when you sign.
Can a hardware wallet protect wrapped tokens from a bridge flaw?
A hardware wallet protects the private keys for your address, while a wrapped or pegged token's value depends on the reserves behind it. When a peg check fails and unbacked tokens are minted, every holder of that token faces the same problem, whatever wallet they use. Holding the native asset avoids that dependency, at the cost of not using it on the other chain.
How do I check and revoke old on-chain approvals?
Block explorers list the on-chain approvals each address has granted, and Etherscan's Token Approval Checker is one example for Ethereum. Find the contracts you no longer use or recognize, revoke them, and sign each revocation from your hardware wallet. Each revocation is an on-chain transaction with a small network fee.
Does moving coins off an exchange cost anything?
Withdrawing from an exchange usually costs a network fee, and some exchanges add their own withdrawal fee on top. The amount depends on the chain and on network congestion at the time. One larger withdrawal usually costs less in total than several small ones. Receiving coins into a self-custody wallet adds no extra cost on the wallet side.
What happens to my coins if I lose my hardware wallet?
Your coins live on the blockchain, and the hardware wallet holds their keys. If the device is lost or damaged, the BIP39 seed phrase (the 12 or 24 word backup created with the wallet) restores those keys on a new device. See what to do after losing a hardware wallet.
About ELLIPAL
ELLIPAL has built self-custody hardware wallets since 2018 and serves 1 million+ users across 140+ countries. ELLIPAL wallets support 45+ chains and 10,000+ tokens and use BIP39 seed phrases, so your backup works with any BIP39 compatible wallet. ELLIPAL's security research is collected on the ELLIPAL Security Lab page.
If you want your coins held outside platform wallet systems, ELLIPAL Titan 2.0 and ELLIPAL X Card are two ways to do it. Titan 2.0 is a cold wallet that generates and stores keys offline and signs through QR codes, with no Bluetooth, WiFi or USB data connection. ELLIPAL X Card is an NFC cold wallet that keeps keys inside a secure chip and signs with a tap, with no battery, no USB port and no Bluetooth. Different tools. Same mission. Explore ELLIPAL wallets.