Web3 Security Weekly Data Report — September 21–27, 2026

The Week in Numbers

Where the Losses Sat

What the Numbers Say

Three observations, computed from the tables above. First, concentration has reached its practical maximum: one incident is 95% of the week, and no weekly figure this site has recorded comes close — the prior high-water month produced its $322M first week from a different structure, many events. The practical consequence is that this week's category shares, medians and week-over-week change are all descriptions of a single exchange breach wearing a distribution as a costume; the six-event on-chain total of roughly $20.5M is the more comparable number against recent weeks (~$5.1M, ~$45.0M).

Second, the week's two most instructive losses were the cheapest per dollar. The Neutron governance takeover cost its operator about $20,199 in NTRN — less than a serious security audit's invoice for one developer-week — and reassigned the admin rights of ten contracts across two applications, worth $9.3M at SlowMist's count. Meter's block-validation flaw required no victim key and no bridge at all: the attacker minted the money directly. Neither fits the 'stolen keys' or 'hacked contract' template; both are failures of the layer that decides what the system will accept as true.

Third, the figures carry different certainties, and the two biggest moved during the week. Bitget's estimate rose from $351.6M to $387.5M as Zcash and TRON transactions were classified — the exchange states this is fuller accounting, not new theft. Duelbits climbed from ~$4.2M to ~$7M as Bitcoin and Solana wallets surfaced, with SlowMist's database still tracking ~$4.9M observed. Neutron's headline $9.3M sits well above the ~$4.4M itemized floor, with $2.2M of ATOM already swept back to a multisig. A single precise weekly figure for this window is a snapshot of estimates in motion, not a settled total.

Month Context

With the Bitget breach included, published tallies put September's losses above $684M — the costliest month of 2026 by a wide margin, and more than the previous five weeks of this site's coverage combined (~$166M across August 17 – September 20). DefiLlama's database carried about $1.4B of hacks for 2026 across 250 attacks when the month's Liquid breach landed; the three weeks since add roughly $458M of this site's recorded losses, putting the running total near $1.9B — this single week is roughly 22% of it — and the Financial Times, citing TRM Labs, reported $1.73B stolen across 333 incidents in 2026 before the Bitget event even landed. September's structure, though, is now a two-item story: the month's first-week tally (~$322M, dominated by Liquid) and this week's Bitget breach together account for the overwhelming share of it — the quiet weeks in between (~$5.1M, ~$45.0M) barely register against either.

Method Note

In-window basis: only incidents whose on-chain activity occurred between September 21 and September 27 count toward the weekly total. Bitget is counted at the exchange's own revised estimate of ~$387.5M (September 25), which the company describes as fuller accounting of the same incident rather than additional theft; the initial $351.6M is noted where relevant. Neutron is counted at SlowMist's $9.3M (Astroport $4.9M + Drop $4.4M); a former contributor's itemized account puts confirmed outflows nearer $4.4M with more than $1.6M in USDC protected by rate limits and the halt, and Cosmos Hub validators swept 1,227,121 ATOM (~$2.2M) back on restart — those offsets are tracked in the recovery column, not netted here. Duelbits is counted at the co-founder's ~$7M confirmation, with SlowMist's ~$4.9M observed-transfer figure noted; the root cause is unpublished and the key-compromise reading is a researcher assessment. Meter's $2.3M is Blockaid's sizing of the unbacked mint actually sold. Payy's $1,832,149.47 is an exact on-chain figure. Enforcement freezes — the $318K Circle/Tether action — and fiat forfeitures are recoverable in principle and are excluded from loss sums, consistent with this site's standing convention. Category shares, concentration and the median are computed exactly from the seven-event list and rounded to the nearest point.