Crypto firms and users have lost nearly $2.7 billion to security incidents this year, with North Korea-linked thefts exceeding $1 billion.

Blockchain security firm CertiK recorded 658 incidents through September, with about $420.4 million of stolen assets frozen or returned. That leaves adjusted losses of roughly $2.26 billion and an average loss of $4.1 million per incident.

September sharply altered the year’s tally. Losses reached about $766.5 million, surpassing April’s $651.3 million and making it the costliest month of 2026. Bitget’s $387.5 million breach and the $318.7 million Liquid Network incident accounted for more than $700 million of the damage.

The surge has left the annual total increasingly dependent on a small number of…