Web3 Security Weekly Data Report — September 14–20, 2026

The Week in Numbers

Where the Losses Sat

What the Numbers Say

Three observations, computed from the tables above. First, three quarters of the week ran on keys rather than broken code: 74% of the total came from wallet-side signing failures — 37% from a flaw that let an operator work through a prepared list of keys for six days (6,678 XRP Ledger wallets, 11.75M XRP, and 5,001 emptied accounts deleted afterwards to claim the reserve each one held), and another 37% from a bridge whose signing key was compromised, letting the attacker mint 260M AGIX and 53.8M WMTx it still holds. Nothing on the XRP Ledger itself was broken. Second, the pattern this site has tracked for weeks produced the rest of the damage: 17% of the week came from an authorization check that was never there — a public keeper multicall driving a Safe's custom module into attacker-controlled code, with the wallet's own signature threshold never consulted. Add the Radix vault reference and the GalaChain signature scope from the backlog table and that missing-check class accounts for about 24% of everything disclosed this week, in-window or not. It is not a novel technique; it is maintenance debt surfacing across six systems in the space of a month.

Third, the figures carry very different degrees of certainty, and two of the five are floors. D'CENT has quantified only the XRP Ledger leg — 11,746,198 XRP — a cumulative count that grew for six days and stopped at the window's close, while the company states that addresses on Bitcoin, Ethereum, TRON and EVM chains may also be exposed, so the eventual number can only move up. An independent XRPL intelligence tally, working from a narrower address set, puts the same campaign at 6,160 addresses and 9.3M XRP. Nostra's ~$3.5M is borrowed value against collateral whose entire market was under $600K, and the protocol's own reconciliation is unfinished. SingularityNET's ~$16.8M is PeckShield's attacker-holdings count from September 20 — the face value of what was minted is far higher, and the realizable value moves with the market. Anyone quoting a single precise September figure for either incident is quoting a snapshot, not a total.

Fourth, the week's most-discussed exploit did not end up with the attacker — and it is no longer the week's largest loss. The Safe exploit transaction was broadcast to the public mempool and front-run in the same block by an automated searcher, which forwarded 18.93 ETH (about $46K) to a block builder for priority; the tokens sit at a known address that the rsETH issuer paused for 24 hours. The victim's $7.73M left the wallet either way. The contrast with the two losses that now outrank it is the point: neither needed a race, an atomic transaction or a novel trick — only keys, whether an operator's prepared wallet list or a bridge's signing key.

The Disclosure Backlog

Two incidents that occurred before this window had their figures become public during it. On a combined basis they add ~$4.3M — about 9% of the ~$49.3M of losses disclosed this week, in-window or not — and they are listed separately rather than folded into the weekly total, so the week-over-week series keeps measuring when money actually left. The other two prior-period incidents in this week's news review, Chainflip and Splash, occurred inside the September 7 – 13 window and are counted in that week's total; only their settlement and patch news appears here.

Month Context

September's first calendar week (September 1–7) was independently tallied at roughly $322M, dominated by the September 6 Liquid Network event. Adding this window's ~$45.0M and the prior week's ~$5.1M puts the month near $372M on published figures — already above August's ~$255.4M across 46 incidents (DefiLlama, via Quantstamp), with ten days still to count. Even so, September's structure is unusual: strip Liquid out — $320M of that first-week tally — and the rest of the month totals roughly $52M across the other three weeks, which is a quiet month by count and a record month by dollars. For a longer anchor, a CertiK- and Forbes-cited analysis puts DeFi exploit losses above $1.3B in the first eight months of 2026.

Method Note

In-window basis: only incidents whose on-chain activity occurred between September 14 and September 20 count toward the weekly total. A multi-day campaign is counted once, at its cumulative figure as of September 20 — that is how the D'CENT drain is measured, and it is why its number differs from the single-wave totals still circulating. Prior-period incidents disclosed during the window are shown in a separate backlog table and are excluded from the weekly figure and from the week-over-week change. Enforcement freezes — the Tether batch and its continuation — are recoverable in principle and are excluded from loss sums, consistent with this site's standing convention. Category shares and concentration are computed exactly from the five-event list and rounded to the nearest point; the SingularityNET figure uses PeckShield's attacker-holdings count (~$16.77M, September 20) rather than the face value of tokens minted; D'CENT's figure covers one chain of five named as exposed, and Nostra's is borrowed value against collateral pending the protocol's own reconciliation. D'CENT's dollar figure converts its 11,746,198 XRP at ~$1.42, the September 15 rate used consistently with the matching news review; the ledger quantity, not the conversion, is the primary figure. Flamincome is counted at the ~$345,900 that Blockaid and SlowMist both put on the attacker's realised profit; DefiLlama's dataset carries ~$595,000 for the same incident on a broader basis, and that figure is not used here.