Web3 Security Weekly Data Report — September 28–October 4, 2026

The Week in Numbers

Where the Losses Sat

What the Numbers Say

First, the week-over-week whiplash is the data point. Roughly $10.2M against last week's ~$408M is a ~40x drop, and it is the smallest weekly figure since early September's ~$5.1M low. Two weeks ago the median was meaningless next to a $387.5M outlier; this week the mean (~$2.55M) and the median (~$2.1M) sit within half a million dollars of each other for the first time in a month — the list is close to a normal distribution of ordinary-size failures, which is the honest baseline the outlier weeks distort.

Second, the whole week sat in the glue. Every dollar lost came from a permission or middleware layer: a borrowing allowlist changed by a valid multisig signature, a Safe module's missing caller check, a hook's shared-unlock netting, a deposit/withdrawal rail's contract interaction. The core layers all held — Aave V3's Base market, Uniswap v4's contracts, the NEAR chain and Base itself functioned as designed, and each incident report says so explicitly. The monitoring story is consistent with it: two of the four events were caught in progress by real-time alerting, and one was patched within about an hour, yet none of that stopped the outflows, because the compromised component was the thing that decides which calls are legitimate.

Third, the recovery column produced its first completed return. NEAR Intents' ~$3.8M is counted here at outflow value — the money left on October 1 — while the full return on October 2 is recorded as recovery, not as a smaller loss. That convention matters this week more than usual: netting the return would show a ~$6.4M week and hide the fact that a mid-size protocol treasury can be emptied and refilled inside 36 hours. The loss series and the recovery series answer different questions, and this week both have clean readings.

Month Context

The five weeks before this one (August 24 – September 27) total roughly $551M on this site's realized basis, and about 70% of that is the single Bitget breach — so this week's ~$10.2M is best read against the pre-Bitget baseline of ~$5–45M per week, not against the Bitget week itself. Third-party anchors published this week: DefiLlama's database carried about 277 hacks for 2026 with losses near $1.84B by late September, against 148 incidents and ~$2.7B in all of 2025 — 2026 has nearly doubled last year's incident count with a quarter of the calendar left. CertiK's monthly report put September at roughly $766M (revised to ~$773M on CertiK's dashboard), and independent roundups of the month agree on its structure: Bitget and the Liquid Network breach together account for about 92% of September's gross, meaning the month's other incidents — 95 of them on CertiK's 97-incident count — averaged small — exactly the profile this week's four-event list extends.

Method Note

In-window basis: only incidents whose on-chain activity occurred between September 28 and October 4 count toward the weekly total. The Base vault is counted at ~$6M — 1,783.067 aBaswstETH borrowed and redeemed for roughly 1,783 wstETH at the ~$3,386 wstETH print; some counts place it at $6.0–6.1M depending on the price moment. NEAR Intents is counted at the ~$3.8M preliminary figure (Bitquery's reconstruction reads 3.865M USDT across five withdrawals); the full return of October 2 is tracked in the recovery column, not netted here, consistent with this site's standing treatment of recoveries. FlashLoopAdapter is counted at ~$305K per the incident registry; SlowMist's alert counts approximately 114.09 ETH, consistent at reporting-time prices — the registry dates the exploit October 1 and the SlowMist alert landed October 2. GoldPesa is counted at ~$114.9K (the attacker's net was 114,428.51 USDC per on-chain reads). Two items are excluded from the loss series on classification grounds: the fake GIWA bridge scam (~$2M, occurred September 26) — a user-facing social-engineering event that SlowMist files as fraud rather than a hack, carried as a development — and the MetaMask/ether.fi staking-infrastructure incidents, which have disclosed no fund loss. Enforcement freezes (~$840K cumulative in the Bitget case) are recoverable in principle and excluded, per convention. Category shares, concentration and the median are computed exactly from the four-event list and rounded to the nearest point.