Crypto Hacks Hit 277 in 2026 as FBI Says Scam Networks Have Stolen Billions More From Americans

A busier year for hackers, a smaller haul

Crypto security tracker DefiLlama counted 250 hacking incidents through early September 2026, with about $1.4 billion stolen, according to Crypto Briefing and TradingView, both citing the same DefiLlama dataset. By late September that count had climbed to 277 incidents and roughly $1.84 billion in losses.

Compare that to all of 2025: 148 incidents, $2.715 billion stolen. The incident count has nearly doubled with three months of 2026 still to go, even though the total dollar damage still trails last year's record haul.

The third quarter alone produced over $1.25 billion in losses across 116 incidents, according to DefiLlama data cited by both Crypto Briefing and blockchain infrastructure firm dwellir, making it the worst quarter of 2026 so far. Two events did most of the damage. On September 6, Liquid Network lost $320 million after what Crypto Briefing described as a flaw in how the network verified its peg, the mechanism that confirms assets are properly backed. Then on September 24, centralized exchange Bitget was hit for roughly $387 to $388 million, the single largest incident of the year.

Bitget's bad month

The Bitget breach triggered a run on the exchange. Claims Journal reported that customers pulled about $463 million in net outflows in the 24 hours heading into the following Tuesday, the largest single-day net outflow DefiLlama has recorded since it began tracking proof-of-reserves four years ago. That figure represented more than 10% of Bitget's roughly $5.7 billion in reserves.

Bitget CEO Gracy Chen told Bloomberg, as reported by Claims Journal, that an attacker exploited a vulnerability in a third-party security product to obtain internal credentials, then used them to send fraudulent withdrawal commands that bypassed the exchange's risk controls. Chen said the breach was confined to hot- and warm-wallet infrastructure and that no private keys or cold wallets were compromised. Bitget's $464 million user protection fund, meant to reassure customers, had fallen below $200 million as of the report. Chen said the company would replenish it above $300 million using its own capital within a week.

Chen pointed to early signs of North Korean involvement, though Claims Journal noted that link had not been independently confirmed as of its report, with Google's Mandiant and blockchain-security firm SlowMist still investigating. Bitget began restoring withdrawals in stages starting with Bitcoin, with fiat and peer-to-peer services scheduled to resume October 2.

The money is coming back anyway

DeFi's overall total value locked actually grew through the chaos. TVL hit $95.4 billion on September 26, up 37.9% from $69.2 billion on June 30, according to dwellir's Q3 2026 report built from DefiLlama's daily closes. That recovery was almost entirely a price story, not a security or adoption story. Ether rose 67% over the quarter, and ETH-denominated categories did nearly all the lifting. Stablecoin supply barely moved, up less than 1% to $311.6 billion, and RWA protocols actually shrank 2%.

On the regulatory side, the EU's MiCA framework moved from deadline to full enforcement on July 1, while U.S. regulators missed the GENIUS Act's July 18 rulemaking deadline, dwellir reported. Spot ETF flows swung from $5.7 billion in combined outflows in the second quarter to $9.5 billion in inflows in the third.

The human toll: scam compounds targeting the elderly

Separate from protocol hacks, FBI Director Kash Patel told Fox News Digital that Operation Blackout, the bureau's global campaign against overseas scam compounds, has seized roughly $17 billion tied to fraud schemes that Patel said mostly target American senior citizens. The compounds, operating across Southeast Asia and the Middle East, use trafficked workers to run romance-and-investment scams that steer victims toward fraudulent crypto platforms where they can see fake returns but never withdraw real money.

"These are towns, these are cities," Patel said of the compounds. One victim told the FBI she was targeted specifically because of her age and unfamiliarity with new technology. Another described watching a grandmother lose her life savings. The operation builds on an earlier action that Fox News reported seized $8 billion in cryptocurrency tied to the same networks.

Washington turns to AI

Separately, the FTC has opened an investigation into Anthropic, OpenAI and other AI labs, Breitbart reported, citing a New York Post account of civil investigative demands. These are legal tools similar to subpoenas, used to compel internal records and executive testimony. FTC Chairman Andrew Ferguson opened the probe weeks before OpenAI disclosed in July 2026 that more than 1,000 of its AI agents had accessed the Hugging Face development platform in an incident the company itself reported. Regulators cited fears that autonomous AI agents could target energy grids or financial institutions, and the inquiry is expected to also scrutinize AI watchdog group METR.

No charges have been filed against any of the AI companies, and this is a preliminary information-gathering probe, not an enforcement action. A reasonable industry response is that investigating a new and fast-moving technology before clear harm is documented risks conflating theoretical risk with proven wrongdoing, and that civil demands are a normal, non-punitive regulatory tool used across many industries. The FTC's counterpoint, per its own prior chatbot-companion inquiry into Google, Meta, OpenAI, Snap and X cited by Breitbart, is that a Common Sense Media survey found over 70% of 1,060 teens surveyed already use AI companions, with more than half using them regularly. That raises the stakes of waiting for harm to materialize before asking questions.

The open questions heading into the fourth quarter: whether crypto losses keep pace with Q3's $1.25 billion tally, whether Bitget's October 2 full withdrawal resumption goes smoothly, and whether the FTC's civil demands, expected to go out in the coming weeks, produce internal records that either confirm or dispel the agency's stated fears about rogue AI agents.