Stacy Muur compiled a list of security incidents from January 5 to October 24, 2026. It counts 230 incidents, each above $50,000, worth a reported $2.35 billion. Bitcoin itself does not appear once. The losses sit in the systems built around it: exchanges, sidechains, lending markets and hardware wallet supply chains.
The losses were concentrated: of the 230 incidents, 113 topped $1 million and 117 stayed below it. The median incident cost $909,500, against a mean of $10.2 million, dragged up by a few giants. The five largest incidents account for 59.5 per cent of the total, and the ten largest for 73.6 per cent, or $1.73 billion. The largest single incident, Bitget, accounted for $367 million.
For anyone holding or moving bitcoin, the lesson is about where to look for danger: the middlemen, not the network. These are reported figures, before any recoveries, and the list is Muur’s own compilation. What follows covers the largest incidents, the calendar of losses, and what the numbers do not show.
The largest incidents
The biggest incidents 
| Incident | Date | Amount |
|---|---|---|
| Bitget | 2026-09-24 | $367,000,000 |
| Liquid Network | 2026-09-06 | $320,000,000 |
| Drift Trade | 2026-04-01 | $296,000,000 |
| Kelp | 2026-04-18 | $293,000,000 |
| Tectonic | 2026-08-30 | $124,500,000 |
| COLDCARD | 2026-07-31 | $116,000,000 |
| Ledger (Supply Chain) | 2026-10-09 | $93,000,000 |
| Nesa | 2026-08-24 | $50,000,000 |
| Step Finance | 2026-01-31 | $40,000,000 |
| Humanity | 2026-06-08 | $32,000,000 |
| Truebit | 2026-01-08 | $28,400,000 |
| Resolv USR | 2026-03-21 | $24,500,000 |
| AFX Bridge | 2026-07-22 | $24,150,000 |
| Ostium | 2026-07-15 | $23,750,000 |
| BonkDAO | 2026-07-06 | $20,000,000 |
The largest single entry is Bitget, a centralised exchange, at $367 million on September 24. Liquid Network, a federated sidechain, follows at $320 million. Drift Trade, a perps venue, lost $296 million, and Kelp, a restaking protocol, lost $293 million. Tectonic, a lending market, lost $124.5 million. Together with hardware wallet supply chains, these names dominate the year.
The calendar
September was the worst month by value, with $724.9 million across 26 incidents, because it contains the two largest entries of the year. April was second, with $648.1 million across 32 incidents, driven by Drift Trade and Kelp. July recorded the most incidents, 34, but a comparatively modest $254.1 million. October is partial, running only to October 24, with 15 incidents and $129.3 million.
Month by month
| Month | Incidents | Amount |
|---|---|---|
| 2026-01 | 14 | $114,595,000 |
| 2026-02 | 8 | $21,511,000 |
| 2026-03 | 19 | $42,457,272 |
| 2026-04 | 32 | $648,066,167 |
| 2026-05 | 30 | $82,318,000 |
| 2026-06 | 25 | $86,104,000 |
| 2026-07 | 34 | $254,132,400 |
| 2026-08 | 27 | $249,639,000 |
| 2026-09 | 26 | $724,908,790 |
| 2026-10 | 15 | $129,286,659 |
What the pattern shows
Three findings stand out. First, bridges were frequent but not where the money went. Eighteen rows carry “Bridge” in the name, yet together they total only $79.3 million, about 3.4 per cent of all losses. Second, the largest losses sit in centralised and adjacent layers rather than in protocols themselves. Third, the label “protocol” is loose: the list mixes protocols with centralised exchanges, wallets, an MEV bot, foundations and a supply-chain incident. It is best read as a list of security incidents, not strictly of protocol exploits. Six names appear twice, each pair dated months apart, and are treated here as separate incidents, as listed. Whether any are double counts of one event is unverified.
The Bitcoin question
Bitcoin itself has no entry in the list, and that absence is the most consequential finding for a Bitcoin audience. The clearly Bitcoin-adjacent entries total $535,850,000, nearly a quarter of all losses: Liquid Network at $320 million, COLDCARD at $116 million, the Ledger supply chain at $93 million, Nomic at $3.15 million, SovBTC at $2.7 million, Bisq at $550,000 and Garden at $450,000. Every one of them sits in a layer around Bitcoin rather than on it. The industry built around holding and moving bitcoin absorbed some of the year’s worst damage. The implication is uncomfortable rather than reassuring. Holding bitcoin is not the same as holding it well. A sidechain is not Bitcoin, and a hardware wallet is only as good as its supply chain.
What the numbers do not show
The figures require qualification. No data source is named in the post or in the images, and the list reads as Muur’s own compilation. The amounts are reported snapshots, not final audited totals. Bitget illustrates the point: the company revised its figure from $351.6 million to $387.5 million, while the list records $367 million. The table does not define “loss”. It does not distinguish funds stolen from funds at risk, frozen or later recovered. Liquid Network is recorded at $320 million gross, yet about 3,400 bitcoin were returned, leaving a net loss near $47 million. Tectonic is recorded at $124.5 million gross, yet a rollback reversed about $111.2 million, leaving about $9.19 million unrecovered. The $2.35 billion headline in this article is therefore the gross reported figure, the value hacked at the time. Returns and rollbacks are context, not corrections to it. A final gap: the screenshots number rows 2 through 231, giving 230 data rows, while the first row is not visible in any image. The post’s count of 230 matches the visible rows, so nothing appears lost.
Taken together, the report describes a year in which the largest damage came not from failures of Bitcoin itself, but from the trusted intermediaries rebuilt around it: exchanges, federations, lending markets and vendors. That is the finding that matters, and the reason the list deserves attention beyond its headline total.
