Web3 Security Weekly Intelligence — September 21–27, 2026

Q1 — Wallets: What happened to wallets this week?

The week's largest loss was a wallet-infrastructure story without a stolen key. Bitget detected unauthorized transfers from part of its hot and warm wallet layers at 18:31 UTC on September 24; the revised estimate is ~$387.5M across XRP (~102.93M tokens, ~$157.5M), ETH (31,890), USDT (34.75M) and USDC (21.05M), among others. The mechanism matters more than the number: a critical backend system was compromised and used to forge transaction data and trigger the platform's internal authorization signing — nineteen transfers from the hot and warm tiers, cold wallets untouched, private keys ruled out. The attacker converted aggressively and fast: ~$170M into ETH across chains, including 7,111 ETH bought on Arbitrum in six minutes at a ~5% premium. The same week, a private-key campaign drained 145+ Ethereum addresses and at least five Bitcoin addresses (total unsettled, single-outlet reporting), and Duelbits' hot wallets across four chains lost ~$7M with signing capability — not a contract — the suspected target. Three incidents, one lesson at three altitudes: the component that can authorize movement is the wallet, whatever its name says.

Q2 — Smart Contracts: What happened at the contract layer?

Two verification failures and two small ones. Payy Network's bridge was emptied of its full balance — 1,832,149.47 USDC — by a single forged verifyRollup batch on its RollupV1 contract, with gas pre-seeded through Railgun two days earlier and the proceeds split into 683 ETH across fresh addresses; the project says the cause was not a key, social engineering, or off-chain infrastructure, which puts it squarely in the verification machinery. Meter's block validation flaw let an attacker mint unbacked MTR and MTRG — ~$2.3M sold through PancakeSwap, MTRG down ~75% — a failure at the layer every contract inherits. The two small entries are textbook single-defect classes: The Internet Token ($16K, arbitrary external call) and DoinGud ($35K, swap logic flaw). None of the four involved a user signature; all four involve machinery the user has no choice but to trust.

Q3 — DeFi & Bridges: What happened across DeFi and cross-chain?

The cheapest large theft this site has recorded was not a bridge hack in any recognizable sense. On Neutron, an attacker bought about 31.6M NTRN for 20,199 USDC, staked it twelve minutes before an expedited governance vote closed, and won passage of a proposal — 'AI Agent Takeover' — whose eleven messages reassigned the admin of ten contracts belonging to Astroport and Drop. Within twenty-four minutes the contracts were migrated to malicious code and drained of what SlowMist counts as $9.3M. The containment response was extraordinary and visible: Neutron halted within five hours; Cosmos Hub validators halted their own chain for over a day specifically to trap the attacker's 1,227,121 ATOM, then restarted with a one-time state change sweeping it into a 4-of-6 multisig. The sweep is real containment — and the leak is real too: a post-restart THORChain refund of 168,990.9 ATOM reached the attacker and was sold on Osmosis for ~266,841 USDC before anyone could catch it. Containment at consensus speed beats containment at contract speed, but only while every exit is watched.

Q4 — People & OpSec: What does the week say about people and process?

Four process notes. First, attribution discipline: Bitget says a North Korean link is 'likely' based on VPN and IP patterns, Specter links it to the July AFX exploit — and no security firm has published attribution, which is the correct posture for day three of an investigation. Second, estimate hygiene: Bitget's number moved from $351.6M to $387.5M in a day, Duelbits' from ~$4.2M to ~$7M — both in the honest direction (additive accounting), both a reminder that day-one figures are floors. Third, the forum war turned into a courtroom: KelpDAO filed suit in British Columbia over the April rsETH exploit, and the filing's key exhibits are said to be written records of LayerZero reviewing Kelp's configuration — documentation as litigation posture, something every integration team should assume from now on. Fourth, the least glamorous item may matter most to ordinary users: SlowMist flags the Darksword iOS spyware adapted beyond its documented version range, plus a fake wallet app in Apple's own App Store that cost three investors ~$1.8M — the delivery layer, again, not the cryptography.

Q5 — Outlook: What should you watch next week?

Five watch items. First, Bitget's withdrawal resumption — BTC from September 28, ETH September 29, USDT September 30, everything else October 2 — and whether the Recovery Bounty Program (5% of frozen, 5% of recovered) produces a first concrete frozen-funds figure; more than 63,000 ETH in exploiter wallets is the number to watch move. Second, Neutron's restart and post-mortem: whether the prepared restore binary returns the contracts to their original code and admins, and whether the swept ATOM actually reaches users. Third, Duelbits' promised root-cause statement — the co-founder said an official account would follow within 24 hours of September 24, and it had not landed by week's end. Fourth, Meter's recovery decision on a preserved-but-paused chain. Fifth, whether the 145-address drain campaign picks up a second independent count — or a named victim — before its floor of $4.3M gets quoted as a total.