September 2026 crypto hacks: $766 million taken — where the money is one week later

Bitget, 24 September — about $387.5 million. The exchange’s hot wallets were emptied on several chains. On Ethereum the attacker gathered 68,465 ETH on eight holding wallets, then began moving it three days later. By 15:53 UTC on 29 September all eight were empty. About 35,000 ETH was sent toward THORChain, the rest through bridges and decentralised exchanges across hundreds of fresh wallets. The only money stopped was about $318,000 in USDT and USDC, frozen by Tether and Circle.

Liquid Network, 6 September — about $320 million. An attacker minted about 4,000 unbacked L-BTC and withdrew real bitcoin against it. After a negotiation conducted partly through messages written into the blockchain, about 3,400 BTC — 85% — was returned. The remainder has not moved: 598.50 BTC sits on one address that has not spent since 9 September.

NEAR Intents, 30 September — $3.87 million. Taken in seven withdrawals over eleven hours, routed through KuCoin and bridges, and then returned in full on 2 October. The exploiter’s address left a message on chain: “We’ve returned all the funds, we were in the wrong.”

Kelp rsETH / the “Yoink” bot, 15 September — 2,900 rsETH. A flawed module let a position be drained; a MEV bot front-ran the drain and took 2,882 rsETH. A day later the bot’s operator sent all of it back to the owner — a return nobody reported until we found it on chain.

Limit Break / Magic Eden, 24–25 September — about 540 WETH. Old marketplace approvals were used to pull WETH out of wallets. About 283 WETH was taken by a MEV operator who has said he will return 90% of it. The other large share, 223 ETH, is parked; 46 ETH went into Railgun.

The fake GIWA bridge, 27 September — 766 ETH. A copy of a real bridge collected deposits from 1,331 wallets; a two-signature Safe drained it and every ether went into Tornado Cash within a day.

Payy Network, 24 September — $1.92 million. A forged proof released USDC from the bridge. $1.83 million was swapped to about 683 ETH and deposited into Tornado Cash on 26 September. A second payout of 90,202 USDC was never moved and, as of 5 October, has not been frozen.

Duelbits, 24 September — about $4.9 million. Five chains drained into one Ethereum wallet. 1,370 ETH has gone into Tornado Cash; 1,011.55 ETH is still there.

Seven addresses hold what is left of seven of these incidents. We read each on 5 October 2026. Together they hold 598.50 BTC, 2,715 ETH, 1.35 million DAI and 90,202 USDC — about $59 million.

Neutron, Astroport and Drop, 22 September — about $9.4 million. A governance vote, 98% of it cast by two wallets tied to the attacker, handed over admin rights to ten contracts. Cosmos Hub validators later moved 1.23 million ATOM out of the attacker’s address; 794.05 ETH reached Ethereum and has never moved.

FetchAI, SingularityNET and NuNet, 19 September — about $2.3 million cashed out. Two wallets minted and sold billions of tokens. The main one still holds 433.05 ETH and hundreds of millions of unsold tokens.

Nostra, 17 September — $3.5 million. About $2 million reached Ethereum, was turned from USDC into DAI within minutes, and sat for two weeks. On 4 October the attacker moved all of it — 253.47 ETH and 1,347,821 DAI — to a fresh wallet, where it sits now.

Meter Passport, 24 September — reported as $2.3 million. A bug let an attacker mint a billion bridge tokens. The number is the tokens’ list price; what the attacker actually got out of the pools was about $420.

Size decides the route. The two largest thefts did not go near Tornado Cash: Bitget’s ether went through THORChain and bridges, which can take tens of thousands of ETH in days, and Liquid’s ended in a negotiation. Tornado Cash got the mid-sized ones — 2,819 ETH from three incidents here.

A surprising share simply waits. Seven attackers out of twelve still have something parked a week or more later, and none of it can be frozen except Payy’s USDC. Those balances are the part of the month that is still undecided — and the part worth watching. When one of them moves, the incident’s page here is updated the same day.

It is not a complete list of September’s incidents: it covers the twelve we traced ourselves, and leaves out incidents that came to light in September but happened earlier. The month’s $766 million total is crypto.news’ figure and Bitget’s loss is Bitget’s own revised number. Balances in the table were read on 5 October 2026; dollar values use $84,203 per BTC and $2,678 per ETH. It names no person and does not say who controls any address.