Web3 Security Weekly Data Report — September 7–13, 2026
This report computes the week's indicators from the thirteen publicly reported events in the matching news review — nine loss events, one enforcement freeze, one follow-up, one unquantified incident and one data breach. The comparison basis is net (last week's ~$59.6M after the ~$272M Liquid return); the definitions are in the method note.
Approximately $5.1M in realized losses across 9 loss events — down ~91% from the prior week's net ~$59.6M and still the smallest weekly figure this site has recorded. Separately, Tether froze $39.27M in enforcement action on ten TRON addresses (not counted as a loss), and Symbiosis minted $46.1B in face value of unbacked syBTC of which only ~$336K was realizable.
- Realized losses~$5.1M-91% w/w (net basis)
- Loss events9plus 1 freeze, 1 follow-up, 1 unquantified, 1 breach
- Largest event~$3.1MNomic unbacked nBTC mint
- Top-3 concentration~85%of the weekly realized total
The Week in Numbers
| Indicator | Reading | Basis |
|---|---|---|
| Realized losses | ~$5.1M | Sum of the 9 confirmed loss events; -91% w/w |
| Loss events | 9 | plus 1 freeze, 1 follow-up, 1 unquantified and 1 breach |
| Largest event | ~$3.1M | Nomic unbacked nBTC mint (Sep 9) |
| Top-3 concentration | ~85% | Nomic $3.1M + Chainflip $0.736M + Splash $0.503M |
| Median event size | ~$163K | Cozy V2 sits mid-list of the nine loss events |
| Enforcement freeze (excl.) | $39.27M | Tether, 10 TRON addresses, Xinbi-linked |
| Face-value mint (excl.) | $46.1B | Symbiosis syBTC; ~$336K realizable |
Where the Losses Sat
| Failure vector | Realized loss | Share | Events |
|---|---|---|---|
| Unbacked mint (bridge/wrapper) | ~$3.44M | 67% | 2 (Nomic, Symbiosis) |
| Missing or one-sided validation | ~$1.24M | 24% | 2 (Chainflip memo refund, Splash reserve domain) |
| Protocol exploits | ~$0.42M | 8% | 4 (Cozy V2, Zentra, BeatXswap, ether.fi) |
| Key compromise | ~$26K | 1% | 1 (WealthManagementV2; Dominion unquantified) |
| Data breach (not a loss) | 0 | — | 1 (Pocket Bitcoin, 5,411 customers) |
| Enforcement (not a loss) | $39.27M frozen | — | 1 (Tether / Xinbi) |
What the Numbers Say
Three observations. First, the dollar trough is real: ~$5.1M is the smallest weekly total on this site, down ~91% from last week's net ~$59.6M — no event crossed $3.2M, and the median loss event sits at ~$163K. Second, the quiet dollar tape hides a loud structural signal: unbacked-mint failures on Bitcoin wrappers are now 2 of the week's 9 loss events and 67% of its dollars, making it three such failures in six days with Liquid. The face-value-to-realized gap on Symbiosis ($46.1B minted, ~$336K realized) is itself data — market liquidity is an implicit cap on unbacked-mint damage, but a cap that fails the moment a wrapper has deeper exit liquidity. The week's second-largest cluster is a different failure at the same layer: two settlement checks that were never made. Chainflip's TRON vault read a memo attached to an already-signed transaction as a fresh swap instruction and refunded it, paying six withdrawals twice (~$736K); Splash's StableSwap validator let a 'tradable' reserve go negative without requiring a positive domain (~$503K). Together they are 24% of the week. Third, enforcement out-earned crime this week: the $39.27M Xinbi freeze is nearly eight times the week's realized losses, a reminder that the freeze pipeline acts on laundering infrastructure continuously, not just after headline events.
Month Context
September's running total is dominated by the September 6 Liquid event ($320M gross). The month's first calendar week (September 1–7) was independently tallied at ~$322M (The Crypto Times, consolidated review); adding this week's ~$5.1M keeps September on track to be the year's largest month even though every week since the Liquid event has run small. August closed at ~$255.4M across 46 incidents (DefiLlama, via Quantstamp).
Method Note
Figures are point-in-time estimates from the sources named in the matching news review; the event count and all share arithmetic are computed exactly from that list. The week-over-week comparison uses the net basis for the prior week (~$59.6M after ~$272M of on-chain returns). Chainflip is counted at the 736,442.17 USDT the protocol itself reported. Splash is counted at the net ADA drain of 2,424,778 ADA (~$503K at the September 13 price); the 1,988,222 OADA it also lost is deliberately not valued, because the same actor drained the venues where that synthetic could have been realised at par. The Dominion loss is unreported and excluded from totals; the Tether freeze and the Pocket Bitcoin breach are not losses and are excluded from loss sums.
Sources
- DefiLlama hacks database (event-level losses).
- Blockaid alert and Symbiosis statements (Sep 11); Bitcoin.com News / Approx Foundation (Sep 13).
- Chainflip incident notice and root-cause post (Sep 12-13); The Crypto Times.
- Splash incident report and Optim Finance updates (Sep 13); CryptoSlate.
- MistTrack freeze detection (Sep 8); The Block confirmation.
- SlowMist, Liquid Network analysis (Sep 11) — prior-week follow-up context.
- The Crypto Times, September first-week consolidated tally (month context).
- Pocket Bitcoin disclosure.
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Which numbers are estimates?
All dollar figures are point-in-time estimates from public reporting. The event count, category splits and concentration arithmetic are computed exactly from the shared incident list. The Dominion amount is unreported and excluded; Symbiosis' final figure may revise with its post-mortem; Splash's OADA leg is excluded because it had no market to realise at par.
Why is the week-over-week change computed on a 'net basis'?
Last week's total includes the Liquid Network event at $320M gross, of which ~$272M was returned on-chain after the patch. Comparing this week against the gross figure (-99%) would measure the return, not the trend. On the net basis (~$59.6M), the -91% change reflects actual activity levels.
Is the $46.1B Symbiosis mint counted as a loss?
No. $46.1B is the face value of unbacked syBTC minted — exposure, not proceeds. The attacker realized ~$336K before liquidity dried up; that realized figure is what enters the loss totals. The face value is reported as the scale of the verification failure.
Is the Tether freeze counted as a loss?
No. The $39.27M freeze is enforcement — immobilized at the token-contract level, recoverable in principle, tracked separately under this site's standing convention.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.