Two production systems failed in September. Neither was cryptographically broken. That distinction is the entire story, and almost nobody reported it.
Bitget, a top-tier centralized exchange, lost roughly $387 million from its hot wallet. Liquid Network, a federated Bitcoin sidechain, lost approximately $320 million through its peg-out authorization path. Together they account for about 92 percent of the month's total โ $766 million across all reported incidents. The remaining 53 incidents combined for roughly $59 million. That is less than half of August's total.
The headline number was built to frighten. The underlying data says something colder. The code spoke, but the logic was a lie.
I ignored the aggregate first. Aggregates are for headlines. I pulled the two dominant cases and read the attack mechanics instead, because based on my audit experience โ the 400 hours I spent inside the Luno staking contract in 2021, the oracle validation work I did on an autonomous AI-wallet protocol in 2025 โ the interesting failure is never the one being marketed. It is the one being buried behind the sentence "private keys were not compromised."
Both Bitget and Liquid said exactly that. Both lost nine figures.
Context: Two Architectures, One Trust Assumption
Bitget is centralized custodial infrastructure. Customer assets sit in wallets controlled by the exchange, and movement out of those wallets depends on an internal authorization process. Liquid Network is a federated Bitcoin sidechain operated by a set of functionaries who hold the peg-out keys. Different structures. Same underlying property: a small number of authorized actors, or the systems serving them, can move large amounts of capital.
That property is the design intent. It is also the single point of failure. Trust is a variable you cannot hardcode โ and both networks had hardcoded it anyway.
The industry spent the last three years telling itself a story about trust minimization. Zero-knowledge bridges, fraud proofs, decentralized sequencers. The narrative moved faster than the deployments. What actually runs in production, at scale, is still a permissioned set of humans and machines with the authority to release funds. September did not reveal a new vulnerability. It revealed how thin the gap has always been between the marketing layer and the execution layer.
I want to be precise about what happened, because the imprecision in most coverage is doing real damage. This was not a break of ECDSA. It was not a break of threshold signatures. It was not a cryptographic event at all. It was an operational one.
Core: Deconstructing the Attack Surface
Start with Bitget. The CEO, Gracy Chen, stated that the attacker entered the backend systems of the wallet infrastructure, forged transaction data, and deceived the authorization process into releasing funds. She explicitly ruled out private key leakage. Read that again, slowly. The keys were intact. The signatures were valid. The system did what it was told, because the data it was told to trust had been fabricated upstream of the signing step.
That is not a bug in the cryptography. It is a bug in the epistemology of the system. The machine could not distinguish between a legitimate instruction and a forged one, because both arrived through the same channel, in the same format, with the same apparent authority.
In audit terms, this is a data-integrity failure in the human-in-the-loop authorization chain. The trust boundary was drawn in the wrong place. Every system that says "if the request looks right, sign it" is one compromised upstream component away from draining itself. Bitget is a $387 million demonstration of that principle.
Now Liquid. The reporting indicates that a white hat used the SideSwap peg-out authorization keys, but that the keys themselves were not leaked. This is the same pattern wearing different clothes. The key material was static and uncompromised. What failed was the logic governing when and how that key could be invoked. The authorization path โ not the secret โ was the exposed surface.
I want to flag a detail most readers will skip. If the keys were never leaked, then the attacker either obtained a valid execution context, or the process that consumes the keys accepted input it should have rejected. Either way, the security model assumed that possession of the key implied legitimacy of the action. That assumption is false, and it has always been false.
Here is the uncomfortable arithmetic. A single exchange hot wallet holding $387 million in liquid assets is, by ordinary risk-management standards, an anomaly. Hot wallets are supposed to hold working liquidity, not balance-sheet-scale reserves. The size of the outflow suggests one of two things. Either the loss figure includes token notional value that was never actually liquid at that scale, or the operational discipline around hot-wallet sizing was absent. I cannot verify which without on-chain reconciliation, and the reporting does not provide it. But the number is a signal.
Then there is the laundering chain, which is where this stops being a story about one exchange and becomes a story about infrastructure.
SlowMist attributed the Bitget funds to DPRK-linked actors and traced the movement through CoW Protocol order flow, Chainflip deposit addresses, conversion into BTC, and CoinJoin mixing. That is not a manual process. That is a pipeline. CoW Protocol is an intent-based aggregation layer. Chainflip is a cross-chain AMM. CoinJoin is a privacy mechanism. None of these was attacked. All of them were used as plumbing.
The attackers did not break DeFi middleware. They instrumented it. They treated permissionless infrastructure the way a developer treats an SDK โ as a set of callable functions that do what they are documented to do. The protocols complied, because compliance is their design.
Chainflip's response is the most revealing single data point in the entire month. It refused at least one deposit, then chose to refund rather than freeze. Sit with the logic of that decision. A protocol that markets itself as permissionless and neutral cannot selectively seize funds without contradicting its own premise. But a protocol that refunds known criminal proceeds may, in some jurisdictions, be read as facilitating the movement of illicit capital. There is no clean position. The refund is a hedge against legal exposure, and it is also an admission that the protocol has no real AML posture at all.
Cos, the founder of SlowMist, said the quiet part out loud: anti-money-laundering checks are lagging behind automated scripts. That is the most important sentence produced this month, and it received a fraction of the attention the dollar figure did. The defense is manual and slow. The offense is scripted and fast. That is a generation gap, not a configuration problem.
Now the counterweight, because the data demands it. Strip out Bitget and Liquid, and September looks like a good month. Fifty-three incidents, roughly $59 million combined, individual losses between $3.15 million and $7.81 million. Compare that to August, and the long tail of industry loss roughly halved. The two mega-events did not represent a broad deterioration of security. They represented a concentration of loss into two trust-dependent architectures while everything else quietly improved.
That is the inverted reading the market missed. They built a palace on a fault line, and when the fault moved, the palace fell. But the surrounding structures โ the smaller, more paranoid, more carefully audited protocols โ held. The headline number described a catastrophe. The distribution described progress.
One more case deserves a line, because it proves a different point. In a separate incident involving a LimitBreak payment processor contract, a white hat identified as Quit moved out 23,155 NFTs worth nearly $6 million to protect them. Roughly 660 WETH remained unrecovered. Notice what this says about asset class. NFTs are individually addressable and can be swept to safety in bulk. Fungible tokens, once they leave, are gone. The rescue capability of the ecosystem is asymmetric. It works on unique assets and fails on uniform ones. Anyone building a treasury on the assumption that a white hat will save them should internalize that asymmetry before they need it.
Contrarian: What the Bulls Actually Got Right
The reflexive bearish take is that September proves crypto security is broken. That take is lazy, and it is contradicted by the same dataset it claims to interpret.
Here is what the optimists got right, and it deserves stating precisely. The dominant failure mode this month was operational, not cryptographic. That is genuinely better news than the alternative. A cryptographic break would be systemic and unpatched โ it would invalidate assumptions across thousands of protocols simultaneously. An authorization-flow failure is architectural. It can be isolated, audited, and fixed. The failure was expensive, but it was local.
Second, the white-hat recovery on Liquid is real. Of roughly $320 million lost, approximately $285 million was returned, leaving a net loss near $35 million. The attacker publicly committed to returning funds once nodes were patched. That is a meaningful mitigation, and dismissing it as theater ignores the balance sheet.
But โ and this is where the bulls overreach โ the fact that a single actor could extract 4,000 BTC from a federated sidechain before deciding to give it back is not a reassurance. It is a confession. The recovery does not restore confidence in the trust model. It demonstrates how completely that model depends on the goodwill of whoever holds the keys at any given moment.
And the white-hat framing itself is contested. Charles Guillemet, the CTO of Ledger, publicly questioned it, noting that legitimate security researchers do not typically drain a cross-chain bridge and then request on-chain contact. That is a high-credibility source raising a structural objection. When the person who builds hardware security for a living says the rescue narrative does not add up, the rescue narrative does not add up. Data does not lie, but it does not care who is telling the story.
Takeaway: The Replicable Pattern Is the Real Risk
The dollar figure is not the threat. The replicable attack pattern is. Two separate, unrelated systems fell to the same class of failure โ forged or misused authorization input, valid keys intact โ within a single month. That is not coincidence. That is a method, and methods get copied.
The forward question is not whether Bitget can cover $387 million from a $464 million protection fund. The arithmetic there is grim but survivable, leaving roughly $77 million of buffer. The forward question is what happens when the same technique is applied to the next hot wallet, the next federated bridge, the next protocol that assumed a valid signature meant a valid instruction. Watch the authorization layer, not the marketing layer. Watch whether protocols start verifying intent rather than merely verifying signatures. The code will keep executing exactly what it is told. The only question is whether anyone has finally learned to tell it something true.