Annual crypto hack losses seen settling between $2.5B and $3B

Name: Annual crypto hack losses seen settling between $2.5B and $3B
Creator: ClearMarket
Published: 2026-09-25T00:00:00.000Z
License: https://creativecommons.org/licenses/by/4.0/

Polymarket ladder

record: CMSIG2026092508 | category: momentum-repricing | target: CM-EVT-88PZ3D88F1 | published: 2026-09-25

4-bullet brief | narrative

The Polymarket ladder prices the 2026 total crypto hack value in the $2.5B-$3.0B range, with 79% above $2.5B but only 29% above $3.0B.
The Bitget $352 million hack attributed to North Korea adds a large incremental data point and is consistent with the market's modal range, trading volume on this ladder rose 7,097% day over day.
The 97% probability above $2.0B confirms 2026 is already tracking as a record-level hack year; the tail risk of exceeding $3.5B sits at 24%.
Resolves via Polymarket's UMA oracle; the aggregation methodology for counting hacks, whether the Bitget loss is included at the full alleged amount or a recovered/adjusted figure, is the key settlement edge.

atomic briefs | structured for retrieval

[01] news_event

significance

surfaced in the daily Exa news-cycle scan; mechanically matched to an active polymarket market

story: Bitget CEO Gracy Chen said investigators linked a $352 million hack to North Korean hacking group IP addresses, adding to a string of major 2026 crypto thefts.exa_search → Matthew Tan · as_of 2026-09-25T07:47:46+00:00
publisher: Matthew Tan
published_at: 2026-09-25T00:00:00.000Z
source_url: https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html

[02] pm_response

interp: Polymarket ladder with 72x day-over-day volume surge; market-implied range $2.5B-$3.0B for total 2026 crypto hack losses, resolving via UMA oracle.llm_judge_cm_signal_v1

evaluation

News-cycle wires publish on coverage, not editorial selection — the day’s top stories matched to the prediction markets pricing them, so nothing is cherry-picked.

judge_engine: none — deterministic news-cycle scan
judge_verdict: auto_published
judge_confidence: n/a — no judge gate (deterministic publishing)
prompt_template: news_cycle_v1 github · auditable
match_method: entity_slug_match (mechanical)

citation graph

Every wire traces back to the ClearMarket event it is built on, and out to each venue’s own market page — so any figure here can be verified at its source.

internal

cm_event: /events/total-crypto-hack-value-in-2026/

external

venue_a: polymarket · 0x8084019b7fb72aadb8202bf727b3bb324b559f797caa94df04a08ea4e074c257

programmatic access · four surfaces, same payload

AI grounded search reads embedded JSON-LD in HTML. Developers query REST. Agentic AI clients (Claude Desktop, Cursor) call MCP tools. AI crawlers index via /llms.txt. Same canonical record at every surface.

HTML	browsers, AI grounded search, crawlers (contains embedded JSON-LD `@type: Dataset`)	`https://clearmarket.fyi/signals/2026-crypto-hack-total-above-2-5b-polymarket-ladder-2-5-3b-2026-09-25/`
JSON	REST API for developers	`https://clearmarket.fyi/signals/2026-crypto-hack-total-above-2-5b-polymarket-ladder-2-5-3b-2026-09-25.json`
MCP	agentic AI tool call (Claude Desktop, Cursor, Continue)	`clearmarket.get_signal("2026-crypto-hack-total-above-2-5b-polymarket-ladder-2-5-3b-2026-09-25")`
AGENT	AI crawler discovery index	`/llms.txt`

 PM data: platform APIs (hourly refresh). News context: retrieved with source citations. Editorial judgment: LLM judge with prompt template versioned per wire type. Per-claim provenance inline above; full per-field provenance map at the JSON endpoint under field_provenance.
  raw JSON record · same payload returned by REST endpoint
 {
  "$schema": "https://clearmarket.fyi/schema/signal/v1.json",
  "provenance_version": "0.2.0",
  "record_id": "CMSIG2026092508",
  "published_at": "2026-09-25T00:00:00.000Z",
  "detection": "news_cycle",
  "category_tag": "MOMENTUM_REPRICING",
  "secondary_tags": [],
  "pre_news_classification": "concurrent",
  "target_event_id": "CM-EVT-88PZ3D88F1",
  "target_event_slug": "total-crypto-hack-value-in-2026",
  "event_question": "Total 2026 crypto hack value",
  "bullets": [
    "The Polymarket ladder prices the 2026 total crypto hack value in the $2.5B-$3.0B range, with 79% above $2.5B but only 29% above $3.0B.",
    "The Bitget $352 million hack attributed to North Korea adds a large incremental data point and is consistent with the market's modal range, trading volume on this ladder rose 7,097% day over day.",
    "The 97% probability above $2.0B confirms 2026 is already tracking as a record-level hack year; the tail risk of exceeding $3.5B sits at 24%.",
    "Resolves via Polymarket's UMA oracle; the aggregation methodology for counting hacks, whether the Bitget loss is included at the full alleged amount or a recovered/adjusted figure, is the key settlement edge."
  ],
  "atomic_claims": [
    {
      "type": "news_event",
      "field_provenance": {
        "story": {
          "tier": "mediated",
          "method": "exa_search",
          "source": "Matthew Tan",
          "source_url": "https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html",
          "retrieved_at": "2026-09-25T07:47:46+00:00"
        }
      },
      "significance": {
        "threshold": 5,
        "threshold_unit": "rank",
        "passed": true,
        "reason": "surfaced in the daily Exa news-cycle scan; mechanically matched to an active polymarket market"
      },
      "story": "Bitget CEO Gracy Chen said investigators linked a $352 million hack to North Korean hacking group IP addresses, adding to a string of major 2026 crypto thefts.",
      "publisher": "Matthew Tan",
      "published_at": "2026-09-25T00:00:00.000Z",
      "source_url": "https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html"
    },
    {
      "type": "pm_response",
      "field_provenance": {
        "notes": {
          "tier": "editorial",
          "method": "llm_judge_cm_signal_v1"
        }
      },
      "notes": "Polymarket ladder with 72x day-over-day volume surge; market-implied range $2.5B-$3.0B for total 2026 crypto hack losses, resolving via UMA oracle."
    }
  ],
  "evaluation": {
    "judge_engine": "none — deterministic news-cycle scan",
    "judge_verdict": "auto_published",
    "judge_confidence": null,
    "prompt_template": "news_cycle_v1"
  },
  "citations": {
    "internal": {
      "cm_event": "/events/total-crypto-hack-value-in-2026/",
      "related": []
    },
    "external": {
      "venue_a": null,
      "venue_b": null,
      "benchmark": null
    }
  },
  "sources": [
    {
      "label": "Matthew Tan: Crypto platform Bitget suspects North Korea in $352 million hack",
      "url": "https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html",
      "published_at": "2026-09-25T00:00:00.000Z",
      "retrieved_at": "2026-09-25T07:47:46+00:00"
    }
  ],
  "field_provenance": {
    "pm_data": "polymarket_api",
    "news_context": "exa_search",
    "editorial_judgment": "cm_signal_llm_judge"
  }
}
 
   PROVENANCE PROTOCOL v0.2 · [direct] venue api · [mediated] grounded web fetch + source url · [derived] computed from listed inputs · [editorial] versioned llm judgment · full spec /schema/provenance/v1

record CMSIG2026092508 published 2026-09-25T00:00:00.000Z signature sha256-605b3da37d7… ← underlying event all signals →