Web3 Security Weekly Intelligence — September 14–20, 2026
The same five questions, answered in the same order, from the week's publicly reported events: wallets, smart contracts, DeFi & bridges, people & OpSec, outlook. In-window loss events total roughly $45.0M: D'CENT App Wallet (~$16.7M over six days), SingularityNET (~$16.8M minted from a compromised bridge key), Safe module / rsETH (~$7.73M), Nostra (~$3.5M) and Flamincome (~$345.9K).
Two of the week's largest losses ran on keys rather than broken code: a six-day drain of roughly $16.7M (37% of the total) needed no exploit at all — an operator held a prepared list of keys and worked it against an app that kept producing valid signatures — and a bridge minted roughly $16.8M from a compromised signing key. Everything else repeated the pattern this site has tracked for weeks: an authorization boundary failing in the component the system already trusts. A Safe module that was already whitelisted accepted caller-supplied calldata; a Radix transaction passed a foreign vault reference into an ordinary withdrawal; a GalaChain verifier accepted the type definitions the request itself supplied; Splash's validator never required its tradable reserve to stay positive. None of those is a broken cryptographic primitive — each is a missing check in code the architecture had already decided to trust.
- Q1 WalletsPrepared key listD'CENT: 6,678 wallets, ~$16.7M
- Q2 ContractsOne-sided checksFlamincome share price, Splash reserve domain
- Q3 DeFi/BridgesModule trust$7.73M Safe module, MEV-captured
- Q5 WatchAudit scopeTwo reviews missed the defects they covered
Q1 — Wallets: What happened to wallets this week?
The wallet story is a software-wallet story, and this week it is also the largest loss by a wide margin. D'CENT's App Wallet was drained over six days — 6,678 XRP Ledger wallets, 11,746,198 XRP, about $16.7M, and a floor because the company names four other chains as exposed without pricing any of them. The pattern was patient rather than fast: by-hand sweeps from 15:35 UTC on September 15, a script from 16:29 that closed the day at 1,682 wallets and 3,618,110 XRP, one quiet day, then five more waves into five new collector addresses until the last sweep at 20:56:41 UTC on September 20. From the 17th the same keys were used a second time, to delete 5,001 emptied accounts for the reserve each one held and 2,470 never-swept wallets along with their balances. The attacker already held the keys and worked from a prepared list rather than scanning in real time. D'CENT's report describes a signing vulnerability on app versions before 8.1.0 (released November 5, 2025), and says the same exposure covers addresses on Bitcoin, Ethereum, TRON and EVM chains where the recovery phrase ever touched the app; hardware wallets were affected only when their phrase had been entered into it. A second Trezor-adjacent data exposure (347,149 email contacts via a Brevo SAML flaw, followed by phishing that asked recipients to type in their backup) completes the picture: this week the wallet layer's weak point was the software and the inbox, never the silicon.
Q2 — Smart Contracts: What happened at the contract layer?
Two one-sided checks, both cheap to fix, both expensive to miss. Flamincome's older vaults let an attacker flash-loan ~$18M of USDT, stake USDP liquidity-provider tokens into a strategy contract to inflate VaultYUSDT's reported share price, and redeem liquid aUSDT at the inflated rate for ~$345,900 — a share price set by the same component being trusted. Splash's Cardano StableSwap — drained on September 13 and booked to the previous week, not this one — computed a 'tradable' reserve by subtracting accrued fees from real balances, never required it to remain positive, bounded fee changes only from below, and never checked swap direction; when the reserve went negative the contract kept accepting trades, and the pool lost 2,424,778 ADA (about $503,000) plus 1,988,222 OADA. Both fixes are described by the projects themselves as one or two missing constraints. Neither restores the balance sheet.
Q3 — DeFi & Bridges: What happened across DeFi and cross-chain?
The week's largest protocol loss was a module, not a bridge. A custom Uniswap v4 liquidity module attached to an Ethereum Safe wallet forwarded fully caller-supplied calldata into the wallet's own execution context with no caller gate, so a public keeper multicall was enough to drive it into an attacker-controlled hook pool that unwrapped the wallet's aEthrsETH into transferable rsETH — about 2,900 tokens, ~$7.73M, with no owner signature. Nostra on Starknet borrowed ~$3.5M against an inflated NSTR price from a token whose entire market capitalisation was under $600K. And Chainflip's follow-up detail landed on the TRON side: because its settlement layer read swap instructions from transaction memos — including on transactions its validators had already signed — a resubmitted transaction with a rewritten memo was paid as a failed swap and refunded, doubling six withdrawals for 736,442.17 USDT. The unifying property is that all three accepted an instruction from a party the system had already decided to trust.
Q4 — People & OpSec: What does the week say about people and process?
Three process failures, in ascending order of discomfort. First, disclosure lag: two incidents from August published their first hard figures this week, together worth ~$4.3M — GalaChain's post-mortem came 27 days after the drain, Radix's Foundation disclosure 17 days after the theft and six days after the chain restarted. Delay is not dishonesty, but it means every weekly number in this industry is provisional in a way readers rarely see. Second, audit scope: Zellic's 2024 review of Radix covered the engine kernel that contained a defect introduced a year earlier and did not catch it, and GalaChain's defect survived a CertiK authorization review in late 2025 and a Hashlock SDK review in January 2026. Both teams drew the same conclusion — that signature scope and maintenance changes need dedicated review — which is the right conclusion reached expensively. Third, the unexpected actor: an MEV searcher front-ran the Safe exploit and took the proceeds, paying about $46K in builder fees for the position. That is not justice and it is not a control, but it is a fact about mempool visibility that incident-response planning should absorb.
Q5 — Outlook: What should you watch next week?
Five watch items. First, whether the searcher holding 2,882 rsETH returns it now that Kelp's 24-hour pause has expired — analysts expect a return, nothing has been committed, and this is the week's only plausible recovery on the protocol side. Second, D'CENT's full scope, since only the XRP Ledger leg has a number attached while four other chains are named as exposed — and whether anything is recovered from the 1.44M XRP still sitting in the operator's own wallets or the 5.59M that went through THORChain to Ethereum. Third, Nostra's reconciliation and whether the ~$1.55M CertiK places on Starknet is recovered; no bounty has been offered. Fourth, whether Radix and GalaChain convert their audit misses into changed scope — both have said they will, neither has published the new criteria. Fifth, the Chainflip restart sequence, which brings every chain back before TRON, and whether Splash or Optim Finance produces an actual redemption route for OADA rather than a patched contract with no liquidity behind it.
- The largest loss needed no exploit at all: 6,678 wallet keys, six days, ~$16.7M.
- Whitelisted components are attack surface: a Safe module with no caller gate cost ~$7.73M.
- One-sided checks are not checks: Splash bounded fees from below, and the reserve from nothing.
- An exploit in the public mempool is a race, not a theft — and the winner paid ~$46K for priority.
- Two external audits covered the code that failed this week; scope, not effort, was the problem.
- Disclosure lag is a data problem: ~$4.3M of prior-period losses first appeared this week.
Sources
- Blockaid and BlockSec alerts and analyses (Safe module, Flamincome).
- D'CENT preliminary incident report (Sep 17) and September 20 user notice; XRPL.to day-by-day reconstruction.
- GalaChain post-mortem (Sep 14); Radix Foundation disclosure (Sep 17).
- Splash incident report; Chainflip root-cause post; Optim Finance updates.
- The Crypto Times, AMBCrypto, PeckShield and CertiK on Nostra.
- Kelp DAO statements; CoinDesk coverage of the MEV front-run.
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Why does this column answer the same five questions every week?
Fixed questions make weeks comparable and prevent cherry-picking. The week's events answer the questions — not the other way around. If a question has nothing to report, the answer says so explicitly.
Is the MEV searcher a thief, a white hat or a bystander?
Legally and technically it is a third party that paid for block position and captured tokens mid-exploit; the victim's loss is unchanged. This column reports the behaviour and the amounts without assigning a label — the label is for courts and for the token issuer's freeze policy to settle.
Why is a wallet vendor's data exposure in the wallets section?
Because for hardware-wallet owners the recovery phrase is the asset, and the phishing campaign that followed the Brevo exposure asked for exactly that. A device that never leaked anything still produced a path to the funds once the phrase reached compromised software.
Where do the figures quoted here come from?
From the week's publicly reported incidents, verified against the sources listed on each card of the matching news review and at the bottom of this page. This column adds no new figures.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.