Web3 Security Weekly Data Report — October 5–11, 2026

The Week in Numbers

Where the Losses Sat

What the Numbers Say

First, this is a one-event week wearing a six-event list. The Ledger supply-chain drain is about 86% of the total on its own, and the top two events are roughly 99% — a concentration shape closer to the Bitget week than to the ordinary weeks either side of it. Strip the headline incident out and the remaining five events total under $14M, which is unremarkable; the week is a single channel compromise, not a systemic breakout. The honest reading of a number like this is that it measures one incident's scale, not the field's health.

Second, the vector that carried it was not code. The largest loss came from a reseller channel — devices altered before purchase, seed phrases read off the display and transmitted by cellular data, with the secure element and firmware intact. That is a supply-chain failure, and it lands in the same bucket as the year's other key-compromise events rather than in the smart-contract bucket where most loss totals are filed. The tail reinforces the pattern: an operator hot key with no multisig (79thVault), an unauthenticated function on a six-year-old keeper (MakerDAO), a client-supplied key in a boarding check (Second), a one-share rounding variance (Set Protocol). Across all six events the audited core held; the failures were in a person, a channel or an unmaintained contract.

Third, the freeze-and-evade cycle is now fast enough to measure in a single day. Tether blacklisted more than twenty addresses and froze roughly $10M of the Ledger cluster — a real ~$10M against an ~$86M base — and the attacker converted USDT into USDD through SUN.io and USDD's peg-stability module to move the float onto a dollar token with no freeze primitive. Enforcement dollars are not loss dollars and this column never adds them to the total, but the recovery column now has a clean reading: issuer freezes work where the asset has an issuer, and any actor who reads the freeze coming will route around it within hours, not weeks.

Month Context

The five weeks before this one (August 31 – October 4) total roughly $528M on this site's realized basis, and about 73% of that is the single Bitget breach — so this week's ~$99.6M is best read against the pre-Bitget baseline of roughly $5–60M per week, not against the Bitget week itself. The third-party anchors published this week point the same way. DefiLlama's hacks dataset records about $2.24B stolen across 284 incidents between January 1 and October 1, 2026 — nearly double last year's 148-incident count with a quarter of the calendar left — against ~$2.715B across 148 incidents in all of 2025, with key compromise and bridge exploits each accounting for about 31% of 2026 losses and access control a further 17%. That class breakdown is worth holding next to this week: a supply-chain seed-phrase drain is a key-compromise event, and 2026's key-compromise share is the one the Ledger case enlarges.

Method Note

In-window basis: only incidents whose activity occurred between October 5 and October 11 count toward the weekly total. Ledger is carried at ~$86M — the most-cited count — with the range stated rather than averaged: investigators published $86M+ (Specter), $72M+ (tanuki42), close to $90M (MistTrack) and $86M–$94.5M (later reporting), and Arkham's cluster held about $71.6M in assets at one snapshot; using the upper estimate would put the week near $108M, so the base figure is deliberately the conservative one. 79thVault is counted at ~$12.5M (16,249 BNB at ~$769.50/BNB). Mezo is counted at ~$470K for the 5.52 BTC taken (proceeds converted to 174.61 ETH; valued near the incident-hour prints). MakerDAO is counted at $542,982 (CertiK; SlowMist logs $538,000 — the two figures round here to $542K). Second's Ark server is counted at ~$62K (0.75 BTC of Second's own liquidity; no user funds). Set Protocol is counted at ~$13.7K (SlowMist; DefiLlama logs $21.9K). Two items are excluded on classification grounds: the Fomo bookmark-phishing attack (Oct 8) — a client-side session compromise that SlowMist files as phishing rather than a protocol exploit, carried as a method card — and all enforcement actions, which are recoverable or non-loss by nature (the DOJ Iran forfeitures and the Conduit v. Tether suit). Category shares, concentration and the median are computed exactly from the six-event list and rounded to the nearest point.