Web3 Security Weekly Intelligence — September 28–October 4, 2026

Q1 — Wallets: What happened to wallets this week?

The week's wallet story is dwell time. Bitget's interim reports, published September 30, place the earliest malicious activity on August 31 — a hidden script running under a third-party security product's service process, reading the database password from an environment variable — with similar activity on two more nodes on September 23 and 25, a web shell and command-and-control on a second appliance, lateral movement into the production wallet job server, and a customized withdrawal tool that began running at 01:49 am on September 25 (SlowMist logs the first verified on-chain transfer at 02:31). The intrusion lived inside the security tooling for roughly four weeks before the money moved; the two small test transfers at 18:31 UTC on September 24 stayed under risk thresholds, and the attacker even tried to edit withdrawal records to queue more Bitcoin withdrawals. Against that, MetaMask disclosed an infrastructure incident in its staking business and began precautionary exits of all its Lido validators — signing infrastructure may have been compromised, but the non-custodial design means withdrawal keys were never in the same hands, and no wallet threat was identified; ether.fi disclosed its own node-operator event the same day. And the D'CENT theft crossed its final border: one compromised recovery phrase swept XRP, Bitcoin, Ethereum, Tron and Stellar — past 12.4M XRP from over 7,000 wallets, with at least 110 non-XRP transfer reports confirmed. Three altitudes, one lesson: the wallet's real perimeter is every system that can authorize movement — and a seed phrase governs every chain it derives.

Q2 — Smart Contracts: What happened at the contract layer?

Three failures, none in audited core code. The Base vault exploit is the cleanest specimen: the vault's accounting and its Aave V3 position were untouched — what changed was an entry on its borrowing allowlist, added through a transaction signed by the vault's own 3-of-7 Safe, whose seven anonymous signers had executed nothing for 25 days. The on-chain sequence at 08:52–08:53 UTC on October 4 — the attacker's contract removed from the allowlist, then re-admitted one minute later — reads as someone deliberately ordering approvals, and both signatures were cryptographically valid, so no rule was broken. FlashLoopAdapter, a third-party Safe module managing Aave v3 leveraged loops, failed its caller-authentication check: the module did not verify that the caller was the Safe it belonged to, so a forged Safe drained ~$305K from two wallets. GoldPesa's GPXHooks — a Uniswap v4 hook — lost ~$115K of protocol-owned liquidity to shared-unlock netting: TAKE_PAIR withdraws the PositionManager's whole net delta across the currently open unlock, and the hook never verified its own deltas were isolated, so an attacker's phantom ~115K debt cancelled the hook's real ~148.9K credit. Three add-ons, three missing checks — context, caller, isolation — each worth more than the audits that presumably cleared the code around them.

Q3 — DeFi & Bridges: What happened across DeFi and cross-chain?

The bridge story of the week is NEAR Intents, and it has two halves. The failure: a bug in the interaction between the Omni deposit/withdrawal infrastructure and the smart contracts let an attacker — after two test withdrawals of $10 and $11 on September 30 — pull about 3.865M USDT out of a BNB Chain treasury in five withdrawals over six hours. The response: SHIELD monitoring caught the irregular outflows, the contract flaw was patched within about an hour, eleven networks stayed restricted while audits ran, and the general manager published an identification claim, three return addresses and a 48-hour deadline — by 14:30 UTC on October 2 the full amount was back, with an on-chain 'we were in the wrong' attached. The laundering side of the ledger grew too: SlowMist documented fully automated North Korean laundering — scripts create Cow Protocol orders whose recipients are pre-staged Chainflip deposit contracts, converting stolen funds to BTC without a human — while THORChain formally declined Bitget's blocking request and processed $6.3M of ETH into 75.2 BTC, and NEAR Intents itself says it stopped more than $50M of related transfer attempts. One week, both faces of cross-chain infrastructure: the rail that leaks and the operator that watches it.

Q4 — People & OpSec: What does the week say about people and process?

Four process notes. First, attribution discipline held its tiers: Chainalysis published an assessment attributing the Bitget breach to North Korea-linked actors (pushing its 2026 DPRK-linked total past $1B), Bitget still calls its own indicators preliminary, and no government has spoken — three evidentiary tiers, three different sets of consequences, and the reporting mostly kept them separate. Second, multisig hygiene is now a countable failure: the Base vault's 3-of-7 Safe was anonymous, idle for 25 days, and executed a remove-then-re-add of the attacker's contract within one minute — no signer-integrity process would have signed either transaction. Third, a listing is not verification: DYORSWAP integrated a counterfeit chain because its chain ID matched a reservation, and its compensation schedule (40% for sub-5-ETH deposits, case-by-case above, on suspicion some 'victims' were operators) shows what listing-side diligence costs after the fact. Fourth, the quiet positive: an exploiter who was identified, named in public, and given a deadline chose to return everything — the first complete return this column has recorded, and a demonstration that identification plus publicity plus a clock is a response capability, at least against attackers who are not state-backed.

Q5 — Outlook: What should you watch next week?

Five watch items. First, the Base vault's remaining ~$31.7M: whether the attacker moves on it, and whether any team ever claims the vault — every day of silence is the governance failure compounding. Second, Bitget's promised full incident report: the third-party vendor's name, the final loss accounting, and the first recovered-funds figure from the 5%/5% bounty — against roughly $343M still dormant in 13 identified wallets. Third, NEAR Intents' detailed post-mortem: the return is complete but the technical account of the Omni bug is still unpublished. Fourth, the MetaMask and ether.fi investigations: validator counts, ETH involved, and whether either discloses an access method — the precedent set here will price every staking operator's incident response. Fifth, the carried items: Meter's recovery decision on its paused chain, Duelbits' root-cause statement, and a second count for the multi-wallet drain campaign.