Crypto Hacks Hit $1.18 Billion: Bitget, Liquid, Cronos, Coldcard
Hackers took $1.18 billion from crypto between July and September. How the Bitget, Liquid, Cronos and Coldcard attacks worked, who covered losses and what to check.
Key takeaways
- Security firm Hacken counted about $1.18 billion stolen from crypto between July and September 2026, and roughly 77% of it left through third-party tools, fixes and infrastructure that code audits do not cover.
- Bitget's protection fund of more than $464 million covered its roughly $387 million loss, so users' balances were not touched, but withdrawals were still frozen for days.
- For Coldcard MK3 owners affected by the weak-randomness bug, Coinkite recommends adding a strong BIP-39 passphrase and moving funds, or moving to a new seed phrase on an unaffected device; the video says a firmware update alone does not help.
- Cronos validators rolled back nearly 2 hours of blocks to recover stolen funds, which also erased unrelated users' transactions.
- About $384 million of the quarter's losses was never returned or covered, so where your coins sit and how your wallet was set up shape who absorbs a loss.
Hackers stole about $1.18 billion from crypto between July and September 2026, according to security firm Hacken’s third-quarter report. The four largest attacks hit the Bitget exchange, Blockstream’s Liquid network, the Tectonic lending app on Cronos and Coldcard MK3 hardware wallets. Most of the money left through outside tools, faulty fixes and flawed device software, not the code audits check.
That matters for ordinary holders because the victims included people who did what they had been told, such as keeping Bitcoin offline on a hardware wallet. The video’s point is that whether you see money again after a hack depends on where your coins sit and how carefully you set up your wallet. It also depends on whether you have spread your risk so that one exchange or one device is not a single point of failure.
Which were the biggest crypto hacks of the quarter?
The four biggest incidents were Bitget, Liquid, Tectonic on Cronos and Coldcard. Together they made up about 80% of the quarter’s losses.
| Incident | Date (2026) | Amount | Way in |
|---|---|---|---|
| Coldcard MK3 | July 30 (Coinkite warning) | About $116M by early August | Weak seed phrase generation |
| Tectonic on Cronos | August 30 | About $120M | Pumped low-volume collateral token |
| Liquid (Blockstream) | September 6 | About $320M | Flaw introduced by a patch |
| Bitget | September 24 | About $387M | Third-party security product flaw |
What happened in the Bitget hack?
The Bitget hack drained about $387 million from the exchange’s online wallets on September 24, 2026. That made it the largest loss of the quarter. It started with two tiny transfers, kept just below the size that triggers an alert. About half an hour later the real withdrawals began.
The biggest single chunk was about 103 million XRP, worth roughly $157 million at the time. Bitget CEO Gracy Chen later explained that the attacker exploited a flaw in a third-party security product to get high-level internal credentials. With those credentials, the attacker sent fraudulent withdrawal commands that bypassed Bitget’s risk controls. Chen said private keys were not compromised and cold wallets were not affected. In the clip shown in the video, she put the total at about 388 million USDT equivalent. Incident analyses give $387.5 million.
Bitget users’ balances were not touched. The exchange had a protection fund of more than $464 million at the time and used it to cover the losses. CNBC has since reported that the fund was refilled to about $300 million. Withdrawals were frozen, however. Bitget reopened them in phases from September 28, starting with Bitcoin.
Chen initially said the attack looked like the work of a North Korean hacking group. She later said that view was “based on preliminary indicators.” Blockchain analytics firm Elliptic separately assessed a North Korea link as highly likely. Bullrunners has covered the 103 million XRP taken from Bitget in more detail.
Why didn’t security audits stop these hacks?
Audits mostly look at a project’s own code, and that is not where the big money went. An audit is when a security firm reviews a project’s code line by line, usually before launch, looking for holes. Hacken counted 71 smart contract attacks, the kind an audit is meant to catch. Together they took about $228 million of the $1.18 billion.
According to Hacken’s figures as reported by CoinDesk, about 77% of losses, roughly $906.8 million, went out through things audits rarely examine. That includes third-party tools, suppliers and software fixes. Hacken said checks need to reach further, into bridges between networks, the systems that hold customer coins and whoever signs off on withdrawals.
How was Blockstream’s Liquid network drained?
An attacker created about 4,000 unbacked LBTC on September 6 and redeemed it for real Bitcoin, emptying almost everything Liquid held, around $320 million. Liquid is a network that runs alongside Bitcoin, built by Blockstream. Users lock up Bitcoin and receive LBTC, a token backed one to one, so they can move value faster and more cheaply.
The flaw was a shortcut in the software Liquid runs on. Blockstream’s assessment places it in a verification cache. Once the network checked something, it remembered the answer so it would not check again. The attacker got something real approved, then submitted a fake made to look identical, and the network let it through.
The hole came from a fix. An older bug had sat in the code since April 2018. The video says it was reported in August. Blockstream patched it, and the patch opened a new hole. The code containing the new flaw became public when the fix was merged on September 1. It was exploited five days later. According to the video, the fix had been reviewed by Blockstream’s own team and by an AI scan. The video also quotes Blockstream as saying nobody inside or outside the company saw it coming.
LBTC holders were stuck while the network was paused. It restarted on September 10. The attackers called themselves white hats, the term for hackers who break in so problems get fixed. They told Blockstream to patch everything first. They then returned 3,400 Bitcoin and kept about 600 (598.5 BTC), worth roughly $47 million. The video says Ledger’s head of technology described the arrangement as looking more like extortion than a reward.
Why did Cronos roll back its blockchain?
Cronos validators halted and rewound the network to undo a $120 million theft from the Tectonic lending app on August 30. Tectonic lets users deposit coins as collateral and borrow against them, valuing that collateral by market price. Its own token, TONIC, barely traded, so a little buying could push its price sharply higher. Reports say the attacker spent about $600,000 to push TONIC up roughly 40 times.
The attacker used the pumped TONIC as collateral and borrowed $120 million of real coins. The video says the attack took about 11 minutes. Cronos validators are the companies whose computers run the network and approve transactions. They then switched the network off, for about 9 hours according to the video. They agreed to erase 10,961 blocks, about 1 hour and 54 minutes of activity, which recovered about $111 million. About $9.19 million that the attacker had already moved off Cronos is still gone.
The video argues this is why many in crypto dislike rollbacks. A blockchain is supposed to be final. Every transaction in that window disappeared, including ones from people with no link to the hack. According to the video, Cronos’ write-up offered those people nothing. If a network can be rewound once, it can be rewound again.
What went wrong with Coldcard MK3 wallets?
A software bug made some Coldcard MK3 hardware wallets generate seed phrases that were far easier to guess. A seed phrase is the list of words a wallet creates at setup, and anyone who has those words controls the coins. The device is supposed to pick them so randomly that no computer could guess them. The bug dates back to March 2021.
On July 30, Coldcard maker Coinkite warned MK3 owners that their funds might be at risk. About 594 Bitcoin had been swept from around 500 wallets. The first sweep took about 25 minutes, and more waves followed over the next four days. By early August the count had reached about $116 million from more than 5,200 addresses. The video calls it the largest hardware wallet hack of 2026. Nobody stole a device or found a piece of paper. Computers worked through the likely word combinations until they hit.
The video says updating the firmware does not help, because the weak seed phrases already exist. Coinkite’s advisory gives two options for affected wallets. The first is adding a strong BIP-39 passphrase, an extra password that creates a new wallet, and moving funds into it. The second is moving to a new seed phrase on an unaffected device. Coinkite says wallets that already used a passphrase face limited exposure. Coldcard Mk4, Q and Mk5 devices are not affected. For background, see how seed phrases work and how to store them.
Who paid for the $1.18 billion?
Hacken’s figures show who absorbed the quarter’s losses:
| Outcome | Amount | Examples |
|---|---|---|
| Returned or reversed | About $387M | Liquid’s white-hat return, the Cronos rollback |
| Covered by companies | About $410M | Almost entirely Bitget’s protection fund (about $387.5M) |
| Not recovered | About $384M | Including Coldcard owners |
The video’s point is that Bitget could cover users only because it had a large fund already set aside. The video argues that most places that hold coins do not have one. The Coldcard owners kept their Bitcoin offline and never handed it to anyone, yet nobody covered their losses.
A self-check from the video
The video closes with questions it says every holder should be able to answer:
- Do you know where every coin you own is sitting?
- Is it all in one wallet or on one exchange?
- Who controls each place: you, an exchange or an app you lent coins to?
- If that place were hacked, is there a fund that could cover you, or would withdrawals simply freeze?
- Was your wallet created on a device or software version with a known flaw?
- How much of everything you own depends on a single point of failure?
The host also argues the answers will change over time, citing advances in AI and, in his view, future quantum computers. That is the host’s outlook, not an established fact. The concrete lesson from this quarter is narrower. The Coldcard flaw dated back to 2021, and Liquid’s hole appeared five days after a fix. If you keep coins on an exchange, it also helps to know what happens when an exchange freezes your account.
What to watch next
If you own a Coldcard MK3, read Coinkite’s advisory on which wallets are affected and what it recommends.
Watch the Canadian class action filed against Coinkite around October 22. It cites losses of more than $140 million and alleges that Coinkite was warned about the flaw in May 2025. Those claims have not been tested in court.
On Bitget, watch whether the exchange publishes a fuller account of its investigation, and whether the North Korea attribution firms up.
Follow whether the roughly 600 Bitcoin kept by the Liquid attackers is ever recovered. Also note whether other networks follow Cronos in treating rollbacks as an emergency option.
Frequently asked questions
How much crypto was stolen between July and September 2026?
Hacken's third-quarter report counted about $1.18 billion stolen across 107 incidents. About $387 million was returned or reversed, about $410 million was covered by the companies involved, and about $384 million was not recovered.
Did Bitget users lose their money in the hack?
No. Bitget's protection fund, which held more than $464 million at the time, covered the roughly $387 million taken, so user balances were not touched. Withdrawals were frozen, though, with Bitcoin reopening first about four days later and other assets returning in phases.
Does a firmware update fix the Coldcard MK3 seed phrase problem?
According to the video, no, because seed phrases already created with weak randomness stay weak. Coinkite's advisory recommends adding a strong BIP-39 passphrase and moving funds into that new wallet, or moving to a new seed phrase on an unaffected device. Coldcard Mk4, Q and Mk5 devices are not affected.
Why did Cronos roll back its blockchain?
An attacker borrowed about $120 million from the Tectonic lending app using the thinly traded TONIC token, after pushing its price up. Cronos validators halted the network and erased 10,961 blocks, recovering about $111 million. The rollback also erased unrelated users' transactions.
Do security audits stop crypto hacks?
Only partly. Hacken counted smart contract attacks, the kind an audit is meant to catch, at about $228 million of the $1.18 billion. Most losses came through outside tools, bridges, custody systems and software fixes.
Full video transcript
From the video's captions, lightly formatted. Captions can mishear names and numbers, so check figures against the article above.
Picture doing the one thing everybody in crypto tells you to do. [music] You take your Bitcoin off of the exchange, you put it on a hardware wallet offline where nobody can touch it. Then one day, you check that wallet and [music] your Bitcoin is gone. You never lost the device, you never shared your seed phrase anywhere, and it still got taken from you. That's not a what if scenario. At the end of July, it happened to people using a well-known hardware wallet, and it wasn't even the biggest theft of the last 3 months.
Between July and September of this year, $1.18 billion was stolen from crypto. So, thieves got into one of the biggest exchanges, a network [music] built on Bitcoin, a lending app, and wallets sitting in people's own homes. [music] And most of that money went straight past the security checks that were supposed to stop it. And after one of those hacks, the people [music] running a blockchain made a decision most of crypto says should never be made. And people who had nothing to do with the hack found the trades and payments they'd already made erased as if they never happened. And every one of these thieves found a different way in, and at least one of those ways could be sitting in your own setup [music] right now.
So, whether you have a Ledger or a Trezor, you need to watch this video. And whether that's the centralized exchange you trade on or the hardware wallet in your drawer or an app you've lent your coins [music] to, this is going to be the most important video that you watch all year long for security. Let's run it. All right, bull runners, welcome back to the channel. So, Bitget is one of the largest crypto exchanges in the world, and it lost more than anyone else in this whole story.
It all began with two transfers so small that nobody noticed. On September 24th, someone sent two tiny amounts out of Bitget's wallets, kept just under the size that sets off an alarm, and nothing happened. Half an hour later, the real withdrawals begin, and by the time anybody stopped them, about $387 million was gone. And if you hold XRP, this part stings because the biggest chunk was about 103 million XRP, roughly $157 million of it taken in one go. And it all came out of the wallets an exchange keeps online, so your withdrawals go through fast.
The only good news there is that the coins Bitget keeps offline, they were locked away in cold storage. They stayed safe the whole time. What's scary though is that the attacker never had to steal a single key to pull this off. They found a flaw nobody knew existed in a security product that Bitget was using from another company and it gave them high-level access right inside the exchange. From there, they slipped in fake withdrawal orders.
They made it look like routine admin work and Bitget's own system paid them out like it was any normal day. So, the very tool that Bitget brought in to keep hackers out is what let them walk right in through the front door. So, how does something like that get past a whole entire exchange? That's the real question because a few days after the hack, Bitget CEO Gracie Chen sat down and walked through exactly how it happened.
Uh beginning at 6:31 p.m. UTC on September 24, 2026, uh there were some unauthorized transfers that involved certain assets that were made across multiple blockchains from Bitget's hot and warm wallet infrastructure. And basically, the investigation has found that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. Then the attacker used these credentials to send fraudulent withdrawal commands to the wallet system causing it to execute abnormal transfers that bypassed our risk control system. Well, along the way, private keys were not compromised, cold wallets were not affected.
Uh and where we are now, so we have already confirmed that approximately 388 million equivalent USDT equivalent of cryptocurrencies in assets were transferred out.
If your coins were on Bitget, you didn't lose them. You see, Bitget had a protection fund of more than 464 million dollars set aside for a day like this, and it covered every single dollar. But, imagine logging in and not being able to touch your own money. Imagine it being more than a few hundred million dollars. Imagine it being a few billion dollars and them not being able to cover all of it.
You see, withdrawals were frozen. Bitcoin only came back four days later, and everything else came back bit by bit after that. Chen had said it looks like the work of a North Korean hacking group. As they always generally say, it's North Korea or some other country, though that hasn't been confirmed. And Bitget wasn't just unlucky here.
Most of the money stolen in those three months went out the same way, through outside tools, suppliers, and fixes that hadn't been put in place yet. Before crypto project launches, it usually pays a security firm to go through its code line by line, looking for holes, looking for things that hackers can exploit. That's called an audit, and it's the badge that projects show you to show you they're legit. Now, most of these hacks were the kind of code an audit is meant to catch, but those were the small ones. All of them put together took 228 million out of 1.18 billion dollars.
And that's what's so frustrating there. You're told to look for the audit, and the big money went out through everything the audit never looks at. Even the firm that counted all of this says the checks need to go a lot further there, into the bridges between networks, the systems holding people's coins, and whoever signs off on withdrawals. And sometimes the hole is the fix itself, if that makes sense. You see, Liquid is a network that runs alongside Bitcoin, built by a company called Blockstream.
You lock up real Bitcoin, and in return, you get a token called LBTC, backed one to one, so you can move it faster and cheaper. And on September 6th, someone created about 4,000 LBTC out of thin air and cashed it out for real Bitcoin. They emptied almost everything Liquid was holding, around $320 million. And if you were holding LBTC, you were stuck because the whole network was paused. And for days, you couldn't turn it back into Bitcoin.
So, the trick was a shortcut in the software. Once the network checked something, it remembered the answer, so it wouldn't have to check again. So, the attacker got something real approved, then sent a fake made to look exactly the same, and the network just let it through. And that hole only existed because somebody tried to fix things. You see, an older bug had been sitting in that code since 2018.
It got reported in August this year, and Blockstream patched it, and the patch opened a brand new hole. The fix went public on September 1st, and only 5 days later, somebody used it, and it had been checked by Blockstream's own team, and by an artificial intelligence scan. And Blockstream admits, "Nobody inside the company or outside saw it coming." Now, that's pretty alarming, and it even got stranger because the attackers called themselves white hats, the name for hackers who break in so problems get fixed. And they told Blockstream to patch everything before they'd send anything back. Once it did, they returned 3,400 Bitcoin and kept about 600, worth roughly $47 million for themselves.
Now, that's pretty crazy that they would do that. They'd return a chunk, and they'd keep a chunk. It's kind of like they're doing a good thing but a bad thing at the same time. And the head of technology at Ledger, the hardware wallet company, said a deal like that looked a lot more like extortion than a reward there. And Liquid only got its Bitcoin back because the attackers chose to send it.
And on Cronos, the people running the network weren't going to sit there and just hope that they were all right. Now, Tectonic is a lending app on Cronos, the blockchain started by crypto.com, where you put coins in as collateral and you borrow against them. And the app judges what your collateral is worth by its price. You see, Tectonic's own token, TONIC, barely traded. So, a little buying could send its price flying.
And on August 30th, somebody did exactly that. They pumped TONIC, used it as collateral, and they borrowed $120 million of real coins against a price that they pushed up themselves. And the whole thing took only 11 minutes. Then, the people running Cronos made their move. The validators, the companies whose computers keep Cronos running and approve every payment on it, switched the whole network off.
And for about 9 hours, nobody could move a single coin. And while it sat frozen, they agreed to turn the clock back to before the hack. So, they erased about 10,961 blocks, almost 2 hours of trades, transfers, and payments that had already gone through as if they never happened. And that pulled back around $111 million of what was stolen. Then, $9.19 million dollars the attacker had already moved off Cronos, it's still gone.
And this is why so many people in crypto hate the idea. You see, a blockchain is supposed to be final. It's supposed to be secure. Once your transaction goes through, nobody gets to take it back. Not a bank, not a government.
That's the whole promise here of blockchain. On Cronos, a small group of people took it back anyways. Every transaction in those 2 hours disappeared with it, including ones from people who had nothing to do with the hack at all. And Cronos' own write-up doesn't offer them anything. You see, it stopped a thief this time, but if a network can be rewound once, it can be rewound again.
So, Cronos could rewind, Bitget could pay, the people with the hardware wallets had nobody coming in to help them. And Coldcard is a hardware wallet made by a company called Coinkite, the kind of device that you buy precisely because you don't want to trust a centralized exchange. And on July 30th, Coinkite warned owners of its MK3 that their funds may be at risk after about 594 Bitcoin was swept out of around 500 wallets. And when you set up a wallet like that, it gives you a list of words called a seed phrase. Your whole wallet comes from those words, and whoever has them basically has your coins because they can access them from any wallet that they get.
The device is supposed to pick them so randomly that no computer on Earth could ever guess them. But, a mistake in its software, going back to March of 2021, meant some Coldcard were picking words that were far easier to guess. And it turned into the largest hardware wallet hack of 2026. About $116 million was drained from more than 5,200 addresses. Nobody broke into anybody's house or found the pieces of paper where the seed phrase was written down.
Computers just ran through the probabilities until they hit the right words. The first sweep took under half an hour, and more waves kept coming over the next 4 days. And updating the device doesn't save you because the weak words that were easy to guess, well, they already exist. They were already created. The only way out is a brand new set of words and moving every single coin.
And honestly, this is the one that got to me because it's exactly the setup that a lot of you have right now for your wallet. You might have set this up years ago and you think you're safe. So, if you add it all up, $1.18 billion, and you ask the question that actually matters to you, who paid for it? Well, about a third came back, either sent back by the attackers as white hats, or rewound like Chronos. Another third was paid by the companies themselves for what they had saved up for situations like that.
And nearly all of that was Bitget. And the last third, about 384 million, nobody returned and nobody covered. Those people simply lost their crypto. And that could be their retirement fund. That could have been their savings.
You name it. The money's gone. Bitget could cover its users because it had a fund that was big enough just sitting there. But, what if they didn't have that fund sitting there? You see, most places is your coins don't.
The Coldcard owners did everything right and they're the ones nobody paid back. And in every one of the big hacks, the money went out through one thing everybody trusted and nobody was watching closely enough. A security tool, a fix, a token price, or device that made the keys. So, is your crypto exposed if you have it in a ledger or a Trezor or some other cold storage wallet or a centralized exchange? You see the code everyone worries about wasn't where the big money went.
It went out through everything around it. And when something does go wrong, whether you ever see that money again depends far more on where your coins sit and how careful you were when you set up your wallet and then how you diversify your risk so you don't have to rely on one centralized exchange or one cold storage wallet. So, think about those cold card owners one more time. They kept their Bitcoin offline. They never handed it to anyone.
They did everything right and the first sign anything was wrong was an empty wallet. Now, imagine if they put all of their crypto on one wallet. They were wiped out. Now, ask yourself one question right now. Do you actually know where every coin you own is sitting?
Is it in just one wallet? Is it in one centralized exchange? Do you know who's in control of it? Do you know what happens to you if that one place gets hit or gets hacked? If that question makes you a little uneasy because you don't know, you're not alone there.
That's a lot of people out there in crypto right now. But, it's an honest question you need to ask yourself because answering that properly isn't just one quick check there. It means knowing whether the exchange holding your coins or the cold storage wallet could cover you the way that Bitget did or whether one bad day would freeze your withdrawals with nothing behind them because you can't even contact customer support. So, it means knowing whether the wallet you trust was set up on a device with a flaw you've never heard about and how much of everything you own is sitting in that one place, especially with artificial intelligence as it hits that J curve and it keeps advancing over the years, leading us into quantum computing. Because quantum computers are going to be better at guessing seed phrases, private keys, you name it, over the next few years.
So, the answer isn't going to stay the same over time. You see, the Coldcard owners had that flaw sitting in their wallet since 2021 without even knowing it. And Liquid's hole showed up 5 days after a fix that was supposed to happen. So, the setup you trust now can turn into a weak spot without you ever knowing about it 5 or 10 years from right now. And with work, with family, with kids, you know, nobody has the time to keep up with all of that.
And that's exactly where people get caught. So, that's the part that my research team helps take off your plate. We've been in the crypto market for the past decade. We've seen virtually every single hack, scam, rug pull under the sun. We're tracking all of the new ones every single day.
My team goes through this with you, so that way you're not alone. What I've done is I've left a link in the description below. It'll lead you to a free portfolio review where you don't reveal your private keys, you keep full custody of your crypto. We don't really get to see how much you have. That's not the purpose of the call.
The purpose of the call is to look at your whole position with you, what you hold, where it's held, how much is dependent on just one source of failure, and your timeline for your goals. That way you walk away knowing where you stand, where your security risk is, where you're over-leveraged, instead of lying awake at night with just wondering and guessing. You can search us on Trustpilot. Just type in Altcoin Pro or type in Bull Runners. You'll see we have 4.9 out of five stars of everyone that we've worked with.
So, don't just take my word for it. Do your own research. I'm not a financial advisor. This video is purely for educational purposes only. I'm not here to scare you.
I'm here to prepare you. Because if you can't honestly ask these important questions to yourself right now to understand where you're exposed, then it doesn't matter how you grow or how you scale your portfolio if it's not secure on a firm foundation in the first place. So, click that first link right now. Schedule your call immediately. Do not put this off.
I will see you on the next video. I will see you at the top. As always, you know what to do. Stay bullish.
Oh.
Oh. Oh.
[music]
Oh.
Education and commentary only, not financial advice. Crypto is volatile and you can lose money. Do your own research and speak to a qualified advisor before making investment decisions. Figures and quotes are as reported in the video on October 24, 2026 and may have changed since.
