Two exchanges, Bitget and Liquid, account for $707 million of September's $766 million in crypto losses, and that concentration tells a story the headlines are burying.
The top-line number is dramatic enough on its own. But here is what matters: remove those two platforms and the remaining 53 hacks combined for roughly $59 million. That is less than half of August's $136.3 million across all incidents. In other words, the broader ecosystem actually got safer in September, while two catastrophic failures at centralized exchanges did almost all the damage.
The Illusion Inside the Number
When a single month posts $766 million in losses, the instinct is to call it a systemic crisis. It is not, at least not the kind most people are imagining. This is not a story of DeFi protocols leaking funds at scale or a wave of sophisticated smart contract exploits spreading across chains. This is a story of exchange-level failure, the kind that has a name, a history, and a very specific warning attached to it.
Centralized exchanges hold custody. Custody means a single point of failure. When that point breaks, the numbers get ugly fast.
Why the 53 Other Hacks Matter More Long-Term
Fifty-three separate incidents in one month, even at a combined $59 million, is not a clean bill of health. It means roughly 1.7 exploits per day are hitting the ecosystem. Bridges, lending protocols, and smaller DEXs are still bleeding. The amounts are smaller, but the frequency is the real signal.
Security firms have consistently flagged that smaller exploits are often dress rehearsals. Attackers probe, extract what they can before detection, and return with refined methods. The $200K hack today can become the $20 million hack in Q1 next year.
What Crypto Holders Should Actually Watch
First, custody is still the variable that kills portfolios. If your assets are sitting on a centralized exchange without withdrawal limits, 2FA, and active monitoring, September is a reminder of what the downside looks like at scale.
Second, watch the exploit frequency, not just the dollar totals. A month where the headline number looks contained because two big events dominate can mask a quietly accelerating attack rate underneath.
Third, protocols that have published recent audits and active bug bounty programs are separating themselves from the ones that are not. That gap is going to matter more as institutional money moves in and raises the stakes for everyone.
The $766 million figure will dominate crypto Twitter for days. The $59 million figure is the one worth keeping in your notes.