Web3 Security Weekly Intelligence — September 7–13, 2026

Q1 — Wallets: What happened to wallets this week?

The wallet-adjacent story of the week is the third customer-data breach in three weeks: Pocket Bitcoin disclosed that a sustained attack on its support infrastructure exposed data for 5,411 customers. No funds were lost — but the pattern across Trezor's fulfilment partner, Pocket Bitcoin and their peers is that support and fulfilment data becomes targeted phishing ammunition. The week's only user-fund losses were tiny: Dominion's unquantified Solana key compromise and WealthManagementV2's ~$26K. The wallet layer itself was quiet.

Q2 — Smart Contracts: What happened at the contract layer?

Two contracts at the settlement layer, and a small tail below them. Chainflip's TRON vault read swap instructions out of a transaction's memo field — including transactions its own validators had already signed — so a resubmitted memo was treated as a fresh swap, failed, and refunded; six liquidity-provider withdrawals were paid twice, for $736,442. Splash's Cardano StableSwap computed a 'tradable' reserve by subtracting accrued fees from real balances, never required it to stay positive and never enforced swap direction, so the pool kept trading after that reserve went negative and lost 2,424,778 ADA (~$503K). Below them the small tail repeated known classes at known scale: Zentra's rounding error (~$140K, a week after Balancer V1's precision bug), BeatXswap's spot-price dependency (~$78K), ether.fi's arbitrary external call (~$43K), and Cozy V2's undisputed false oracle claims (~$163K) — a protection market paying out on fabrications being the week's irony. The contract layer's biggest story is at Q3, because the largest verification failure of the week wasn't in an application contract at all.

Q3 — DeFi & Bridges: What happened across DeFi and cross-chain?

Three wrapper backing failures in six days. Nomic: extra nBTC minted against insufficient backing for ~$3.1M — with the flaw unnoticed for months, which means backing verification was effectively nobody's continuous job. Symbiosis: BridgeV2 accepted an unauthorized message and minted ~46.1B syBTC in face value; the attacker realized only ~$336K because Uniswap V4's WBTC pool was the only exit deep enough. Liquid: restarted September 10 on v23.3.4. The structural read: the same trick worked three times on different systems, which makes it a class — and the Symbiosis case proves the damage is capped by exit liquidity, not by the mint itself. Wrappers with deeper liquidity are strictly larger targets.

Q4 — People & OpSec: What does the week say about people and process?

Two process stories. First, the freeze pipeline: MistTrack's attribution of ten TRON addresses to Xinbi Guarantee — a marketplace with ~$24.2B in processed volume, sanctioned by the UK in March — led to a same-week $39.27M Tether freeze, confirmed by The Block. Analytics → attribution → issuer action is now a production line, and it operated at nearly eight times the week's crime total. Second, bounty economics matured: Symbiosis put a 20% white-hat bounty with a September 13 deadline on the table and secured ~15 BTC on a multisig; the Liquid negotiation's remaining 598.5 BTC stayed put, with Blockstream holding its no-ransom line. Attacker incentives, deadlines and outcomes are now public, trackable market data.

Q5 — Outlook: What should you watch next week?

Five watch items. First, Symbiosis' post-mortem and the bounty outcome — the 20% offer lapsed or closed on September 13, and whether an information-led recovery follows is the test of that mechanism. Second, Nomic's remediation detail and any loss revision. Third, further unbacked-mint attempts: two weeks of success against wrappers suggests the class is being shopped. Fourth, the Liquid negotiation — 598.5 BTC is still attacker-controlled and the OP_RETURN channel is live. Fifth, September's month-end position: at ~$325M gross the month is already the year's largest, and the last two weeks decide whether it runs away with the record.