Web3 Security Weekly News Review — September 14–20, 2026
This week's review covers September 14 – 20, 2026: 14 publicly reported items, five of them loss events inside the window, led by a six-day key-list drain on D'CENT's App Wallet and a bridge minted from a compromised signing key.
Two accounting notes apply throughout: older incidents that only published figures this week sit in a separate disclosure backlog, not in the weekly total, and two of the five loss figures are floors pending fuller reconciliation. Each card carries both the incident date and its disclosure dates.
The largest loss of the week was a wallet, not a protocol. Over six days an operator emptied 6,678 XRP Ledger wallets of 11,746,198 XRP (~$16.7M) using keys it already held, working a prepared list through D'CENT's App Wallet; the last sweep landed at 20:56 UTC on September 20. The second-largest was a single transaction: on September 15 a public keeper multicall drove a custom Uniswap v4 module attached to an Ethereum Safe wallet, moving ~2,900 rsETH (~$7.73M) out without the owner's signature — then lost the race to an MEV bot called Yoink, which captured 2,882 rsETH in the same block. On September 17 Nostra on Starknet was drained of ~$3.5M in borrows against a manipulated price for a token whose entire market capitalisation is under $600K.
- Realized losses~$45.0M5 in-window events
- Largest event~$16.8MSingularityNET bridge mint, Sep 20; D'CENT floor ~$16.7M
- Disclosure backlog~$4.3MGalaChain, Radix
- Enforcement~$3.62MTether, 16 TRON addresses
Overview
The dollar figure is up and the pattern is narrow. Five incidents happened inside the window and total roughly $45.0M — about 8.8x last week's ~$5.1M — with 74% of it in two signing-key failures: a six-day wallet drain that needed no exploit at all, and a bridge whose compromised signing key let the attacker mint tokens it still holds. The other three are the same failure in different plumbing: a check that should have stopped an unauthorized operation was either absent, one-sided, or satisfied by the attacker's own input. A Safe module forwarded caller-supplied calldata into the wallet's own execution context with no caller gate. Nostra's oracle accepted a price that valued a $600K token as $3.5M of collateral. Flamincome's vault let a share price be inflated and redeemed at the inflated rate. Splash's validator let a tradable reserve go negative. GalaChain's verifier accepted type definitions supplied with the request. Radix's engine let a foreign vault reference be used for an ordinary withdrawal.
The second story is the wallet layer, and it is the one this review will keep returning to: 6,678 addresses, six days, no exploit primitive — only keys the operator already possessed and a signing path that D'CENT says was defective in app versions released before November 2025. Two details make it worse than the headline. Those same keys were used again after the sweep, to delete 5,001 emptied accounts and claim the XRP reserve each one held, so victims lost the reserve on top of the balance. And the proceeds moved quickly but traceably — 5.59M XRP through THORChain into Ethereum, 3.24M to a single exchange — which is a recovery opportunity, not a recovery.
The third story is one the weekly format usually hides: disclosure lag. Two incidents that occurred before this window published their first quantified figures during it, and together they add ~$4.3M — about 10% of what the window itself produced. Both (Radix, GalaChain) had already been named in earlier reviews with partial numbers; what arrived this week was the figure. Two further incidents dated just before the window — Chainflip (September 12) and Splash (September 13) — are booked in the September 7 – 13 total, and only the settlement and patch developments that landed in this one are covered here. This site's convention is to date incidents to the day they happened and to say when a figure first became public, which is why the older pair appear as a labelled backlog instead of being folded into the weekly total.
Enforcement was quiet by recent standards: one Tether batch on TRON worth ~$3.62M in total across 16 addresses, with no public attribution for any of them. The $39.27M Xinbi freeze that dominated last week has not been extended in the data reviewed for this window.
The 14 Stories
Safe module exploit drains 2,900 rsETH (~$7.73M) — MEV bot captures the loot
An attacker used a public keeper multicall to route a custom Uniswap v4 liquidity module attached to an Ethereum Safe (v1.3.0) into a pool carrying an attacker-controlled hook. The hook unwrapped the wallet's aEthrsETH position into freely transferable rsETH, and ~2,900 rsETH left the wallet without any owner signature. The exploit transaction was broadcast to the public mempool and front-run in the same block (25,980,525, 04:38:47 UTC) by the MEV searcher Yoink, which took 2,882.37 rsETH and swapped the remaining 17.63 rsETH for ~18.95 ETH, paying ~18.93 ETH (~$46K) to a block builder for priority. Blockaid put confirmed losses at ~$7.73M; PeckShieldAlert at ~$7.81M. Kelp DAO placed the receiving address under a 24-hour pause at 06:03 UTC and said its contracts and rsETH backing were unaffected. BlockSec, SlowMist, Blockaid and AstraSec all located the root cause in the wallet's own authorized components — a flawed authorization check in a Multicall contract plus a module that forwarded fully caller-supplied calldata into execTransactionFromModuleReturnData with no caller gate — not in Safe's core contracts.
Source: Blockaid; BlockSec; SlowMist; AstraSec; PeckShieldAlert; CoinDesk; ForkLog
Nostra drained of ~$3.5M against a manipulated NSTR price
Nostra, a money market on Starknet, reported at 13:28 UTC that a manipulated price for its NSTR token let a single account treat NSTR holdings as inflated collateral and borrow roughly $3.5M in ETH, STRK, USDC, USDT, WBTC and DAIv1. NSTR traded between ~$0.0055 and ~$0.0059 with a market capitalisation between roughly $550K and $590K, so the borrow was more than five times the entire value of the collateral token. PeckShield traced about $1.92M to Ethereum — 234.57 ETH and 1.3M DAI — while CertiK put roughly $1.55M as still on Starknet. The protocol paused lending, borrowing, withdrawals and liquidations; it says the final loss and any recoveries are not yet known, and no bounty has been announced.
Source: The Crypto Times; AMBCrypto; PeckShield; CertiK
D'CENT App Wallet drain — 6,678 XRP Ledger wallets, 11.75M XRP (~$16.7M)
A six-day drain emptied 6,678 XRP Ledger wallets belonging to users of the Korean wallet maker D'CENT, taking 11,746,198 XRP — roughly $16.7M at the ~$1.42 reference price, and a floor rather than a total. The campaign opened by hand at 15:35 UTC on September 15, when eight wallets holding 99,999 XRP or more were swept for 1,608,506 XRP into five fresh addresses; the script followed at 16:29 in two batches, with a 34-minute pause in which the twelve richest remaining wallets were moved manually. Day one took 1,682 wallets and 3,618,110 XRP. September 16 — the day of D'CENT's first notice — was the only quiet day. From 07:05 on the 17th, five more waves into five new collector addresses took 2,532 wallets and 7,597,207 XRP, the last sweep landing at 20:56:41 UTC on September 20. From the morning of the 17th those same keys were used a second time: 5,001 emptied accounts were deleted to claim the reserve each one held, and 2,470 wallets that had never been swept were deleted holding whatever they still had. The money moved fast — 5,594,530 XRP into THORChain with swap memos naming three Ethereum addresses, 3,241,519 to the exchange unionchain.ai, 546,080 to NEAR Intents, 535,666 to Binance deposit tags — and 1,440,291 XRP was still sitting in the operator's wallets at the time of writing. D'CENT's September 20 notice told App Wallet users to update to version 10.0.0, run the in-app check and move assets to a wallet built from a new recovery phrase; it says addresses that signed on versions before 8.1.0 (released November 5, 2025) may be exposed across Bitcoin, Ethereum, the XRP Ledger, TRON and EVM chains, with hardware wallets affected only where their recovery phrase was entered into the app. Only the XRP Ledger leg is quantified, no compensation commitment has been made, and a narrower independent tally run by an XRPL intelligence account counts 6,160 addresses and 9.3M XRP.
Source: D'CENT preliminary incident report and September 20 user notice; XRPL.to day-by-day reconstruction; U.Today; The Crypto Basic
Flamincome vault share-price inflation (~$345.9K)
Blockaid flagged an exploit against older Flamincome contracts associated with FlamingoFinance. The attacker flash-loaned roughly $18M in USDT, staked USDP liquidity-provider tokens into a strategy contract to inflate the reported share price of VaultYUSDT, then redeemed liquid aUSDT at the inflated rate for an attacker profit of about $345,900 in USDT — the figure both Blockaid and SlowMist put on the attacker's realised profit, and the one counted here; DefiLlama's dataset lists ~$595,000 for the same incident on a broader basis. An address linked to the activity was funded with 0.1 ETH from Tornado Cash roughly two hours before the main cluster. FlamingoFinance had not responded to press requests at publication.
Source: Blockaid public report; The Crypto Times
SingularityNET bridge exploited — attacker minted 260M AGIX and 53.8M WMTx and holds ~$16.8M
PeckShield reported that an attacker exploited a vulnerability in SingularityNET's bridging contracts on Ethereum to illegally mint 260M AGIX and 53.838M WMTx on September 20 — the final day of the window. By PeckShield's September 20 count the attacker held roughly $16.77M in crypto assets: about 198.3M AGIX (~$14.42M), 649 ETH (~$1.67M) and 33.538M WMTx (~$0.63M). The mint rode on the same campaign that drained Fetch.ai's converter and minted NuNet tokens the previous evening; Fetch.ai said its own contracts were unaffected and paused AGIX-to-FET conversions, and World Mobile confirmed the unauthorized WMTx mint and revoked minting rights. No post-mortem or recovery action had been published by the window's close.
Source: PeckShieldAlert (Sep 20); World Mobile Chain statement (Sep 20); Fetch.ai statement (Sep 20); ChainCatcher
Tether blacklists 15 TRON wallets holding $3.31M — continued into Sep 15
Tether's contract blacklisted 15 TRON addresses holding a combined 3,313,462.02 USDT in a concentrated batch; several of the largest were frozen in the same TRON block at about 21:55 UTC on September 14. The largest address held 1,134,712.62 USDT, with further balances of roughly 391,156, 334,687, 257,638 and 216,117 USDT. Freeze activity continued past the batch: another TRON address was blacklisted at 01:18 UTC on September 15 while holding 310,449.66 USDT, bringing the two-day total to about $3.62M across 16 addresses. No Ethereum USDT freezes appeared in the same dataset, and Tether has published no reason for the selections. Tracing of the largest wallet shows repeated large inbound transfers from one upstream TRON address — about 1.00M USDT on Aug 17, 503K on Aug 27, 545K on Sep 8 and 1.02M on Sep 9 — which is an investigative lead but not an attribution.
Source: USDT blacklist daily tracking, September 15; FinanceFeeds
GalaChain post-mortem: 74 replayed signatures drained ~$3M from nine wallets
GalaChain's September 14 post-mortem confirmed that an attacker reused 74 replayable signatures harvested from failed transactions — some up to 55 days old — to move about 2 billion GALA and roughly 37 other tokens, worth approximately $3M, out of nine wallets. The mechanics were two defects interacting: the EIP-712 verifier accepted the type definitions supplied with each request rather than deriving them from the operation being invoked, so data signed for one action could authorize another; and the transaction key that should have prevented resubmission rolled back when a transaction failed, leaving the signature live on a public ledger. One transaction carried the largest single share of the GALA moved; published accounts of that one transfer differ by an order of magnitude, so no single-transaction figure is quoted here. The attacker submitted 1,066 transactions at a median interval of 4.5 seconds, with 73.9% exactly one block apart, and 56 of 59 targeted account-token pairs were drained to the exact balance on the first attempt — evidence of prior reconnaissance. Gala paused its bridge within hours and deployed a fix the same day. CertiK's authorization review in late 2025 and Hashlock's SDK review in January 2026 did not flag either defect. Gala filed a complaint with the FBI's IC3, sent freeze requests to platforms, and is tracking proceeds across four chains.
Source: GalaChain post-mortem (Sep 14); CryptoSlate; TokenPost
Radix: three-year-old vault bug took ~$1.26M and forced a 10-day consensus halt
The Radix Foundation confirmed on September 17 that a defect introduced during a June 2023 cleanup of the Radix Engine let an attacker withdraw from vaults it did not own. Between 16:02 and 16:57 UTC on August 31 the attacker ran 26 transactions, taking 458,915 USDC, 72,420 USDT, 61.08 ETH, 6.35 wrapped Bitcoin, 536.16 SOL and 32.91 BNB — roughly $1.26M at that day's prices, with the two stablecoins alone accounting for about $531,335 — plus 13,000 XRD to cover fees. A transaction could identify another user's vault by its internal address and pass that reference into purpose-built contract code; the engine then allowed ordinary withdrawal functions to run without enforcing the ownership boundary. Investigators concluded the flaw could have been used against any vault on the network, so validators deliberately took enough stake offline to prevent consensus, halting finality for more than ten days while a patch was built. User transactions resumed September 11. Zellic's 2024 audit covered the engine kernel containing the defect and did not catch it. Secondary damage followed: pulling bridged assets out of one side of trading pairs distorted pool prices and let a second account extract millions of XRD.
Source: Radix Foundation disclosure (Sep 17); CryptoSlate; community ledger reconstruction
Splash StableSwap drained on Cardano — 2,424,778 ADA (~$503K) and OADA holders stranded
Two transactions at 14:53 UTC on September 13 removed 2,434,648 ADA and 1,988,222 OADA from Splash's ADA/OADA StableSwap pool. Net of the attacker's 9,870 ADA deposit and before fees, 2,424,778 ADA left the pool — about $503,000 at that day's price — while the OADA is deliberately not valued, because the same actor went on to empty the other OADA venues, leaving no market to realise it at par. The pool's validator computed a 'tradable' reserve by subtracting accrued fees from real balances, never required that number to stay positive, bounded fee changes only from below, and did not enforce swap direction, so swaps kept executing after the tradable ADA reserve went negative. The patch closes that path. It does not restore the balance sheet: the pool held 10 ADA against about 1.44M OADA afterwards, OADA has no protocol-level redemption, and other listed OADA venues held single- or double-digit ADA. Optim Finance paused its protocol on September 13, withdrew remaining liquidity and stopped OADA-to-ADA swaps; its September 15 update promised a full accounting without restoring liquidity or redemption.
Source: Splash incident report; CryptoSlate; Optim Finance updates; iTokenly hack registry
Chainflip resets TRON USDT provider balances to zero after the $736,442 memo exploit
Chainflip's TRON settlement layer read swap instructions from a transaction's memo field — including on transactions already signed by its validators. The attacker resubmitted a signed fetch transaction with a malformed memo of their own; the network read that as a separate swap, classified it as failed, and issued a refund, so six liquidity-provider withdrawals were paid twice. Eight attempts over roughly ninety minutes on September 12 produced six unauthorized payouts totalling 736,442.17 USDT; one ordinary user swap of 115,654.41 USDT is still sitting unpaid in the vault. The network paused, fixed the memo handling so a memo counts as a swap instruction only alongside a plain TRX or direct TRC-20 transfer, and on September 15 published a restart plan — shipped as software version 2.2.13 — that resets each liquidity provider's TRON USDT balance to zero on the books while keeping a separate on-chain record of what is owed. The restart sequence brings every other chain back before the TRON route, which stays off until the witnessing layer is fully synchronised. No freeze has been reported and the compensation mechanism is still undisclosed.
Source: Chainflip incident notice and root-cause post; crypto.news; The Crypto Times; iTokenly hack registry
aelf restores nodes after a seven-day halt — a week of staking rewards permanently lost
aelf brought its public nodes and core front ends back on September 14 and reported block heights climbing on September 15, ending an emergency shutdown that stopped block production outright after malicious smart-contract activity, and lasted about seven days. Investigators identified 155 transactions tied to the activity — 127 on the AELF MainChain and 28 on the tDVV sidechain — plus five distinct .NET assemblies capable of interacting with host systems, node keys and configuration files. As of August 26 the project reported no unauthorized transfers of ordinary user assets and no exposed user wallet keys, but its review did not clear node and infrastructure credentials, and the full root-cause report remains unpublished. No loss figure has been disclosed. Staking rewards generated nothing during the halt and will not be retroactively paid. Exchange access resumed venue by venue, with Bithumb scheduling ELF deposits and withdrawals back on September 14 and MEXC requiring users to generate new deposit addresses.
Source: aelf recovery updates (Sep 14–15); the project's Aug 26 incident report; CryptoSlate
Blink Wallet pauses services after custodial accounts are drained
Blink, a custodial and non-custodial Bitcoin wallet provider, paused its services on September 19 while investigating a security incident. Its statement said an attacker accessed a limited number of custodial accounts and withdrew funds, that the large majority of funds remain secure, and that non-custodial wallets were not affected. A follow-up update the same day narrowed the scope to "a few dozen custodial accounts" and committed to making every affected account whole. No dollar figure, access mechanism or resumption timeline was disclosed.
Source: Blink Wallet statement (Sep 19); The Crypto Times
Trezor contact data exported via a Brevo flaw — 347,149 email addresses
An attacker exploited a flaw in the SAML single sign-on implementation of Brevo, Trezor's marketing provider, and used Trezor's own newsletter account to send a phishing email on September 9. Trezor's September 17 update confirmed that 347,149 marketing contacts were exported from its list through the API during the incident. The phishing claimed a critical hardware vulnerability and asked recipients to enter their wallet backup into a malicious application; about 2,500 recipients reached the fake domain before Trezor disabled it. No device compromise has been reported.
Source: CryptoSlate
Needle Stealer: fake AI crypto software impersonating signed Microsoft binaries
A malware campaign dubbed Needle Stealer used signed Microsoft software as a delivery vehicle to target seven browser crypto wallets, replacing legitimate extensions with credential-stealing copies rather than breaching Coinbase or MetaMask themselves. HP Wolf Security published the research on September 17, from activity it observed between April and June 2026. Reporting framed it as part of a broader jump in blockchain-linked malware activity that Chainalysis attributes partly to open-weight AI models lowering the build cost of dead-drop infrastructure.
Source: CryptoSlate; Chainalysis commentary
The Disclosure Backlog
Two items in this week's list are incidents that happened before the window and whose figures became public around it. They are separated here so the weekly total stays honest about when money actually left; each row gives both the incident date and the date the figure first became public. Two further incidents dated just before the window — Chainflip (September 12, $736,442.17) and Splash (September 13, ~$503,000) — are booked in the September 7 – 13 total; what landed in this one is their restart plan and patch, covered above and in this week's recovery column.
| Incident | Occurred | Figure first published | Loss |
|---|---|---|---|
| GalaChain signature replay | Aug 18 | Sep 14 post-mortem | ~$3.0M |
| Radix vault authorization | Aug 31 | Sep 17 Foundation disclosure | ~$1.26M |
| Backlog total | — | — | ~$4.3M |
Key Signals
| Signal | Reading |
|---|---|
| In-window losses | ~$45.0M across 5 events, vs ~$5.1M last week (about 8.8x) |
| Top pattern | Two signing-key failures (D'CENT's prepared key list and SingularityNET's compromised bridge key — 74% of the week between them) alongside missing or one-sided authorization checks in trusted components: Safe module, Radix vault reference, GalaChain signature scope, Splash reserve domain |
| Largest event | ~$16.7M (D'CENT App Wallet, six days, no exploit primitive); the second, ~$7.73M, was a Safe module exploit captured by an MEV searcher rather than the attacker |
| Disclosure backlog | ~$4.3M of prior-period losses first quantified this week |
| Enforcement | ~$3.62M frozen across 16 TRON addresses; no public attribution |
| Unquantified | Blink Wallet (undisclosed), aelf (no figure, no make-good on staking rewards) |
TRON Footprint
| Item | On-chain footprint | Status |
|---|---|---|
| Tether blacklist batch (~$3.31M) | 15 TRON addresses; largest 1,134,712.62 USDT; several frozen in one block at ~21:55 UTC Sep 14; visible on TRONSCAN | Confirmed |
| Tether blacklist, continued (~$310K) | One further TRON address blacklisted at 01:18 UTC Sep 15 | Confirmed |
| D'CENT App Wallet exposure | TRON listed among the chains whose keys may be exposed for addresses that signed on app versions before 8.1.0; no TRON losses quantified | Confirmed pattern |
For Tron energy users the takeaways are unglamorous but concrete. First, the freeze lever remains the most active enforcement control on TRON and it operates at the token-contract level: 16 addresses, ~$3.62M, no name attached to any of them. Second, the D'CENT exposure is the one item on this page that can touch a TRON holder directly — if a recovery phrase ever went into that app, the TRC-20 balance at the derived address sits under the same key. Rotating to a new phrase and moving assets is the whole remedy, and it is cheap; energy costs for that transfer are trivial next to what a sweeper bot can do in fifteen minutes.
What I'm Watching Next Week
- Whether the MEV searcher returns the 2,882 rsETH it captured — analysts expect a return but nothing has been committed, and Kelp's 24-hour pause on the receiving address has expired.
- Nostra's reconciliation and whether the ~$1.55M that CertiK places on Starknet is recovered; no bounty has been offered.
- D'CENT's full scope — 11.75M XRP is the XRP Ledger leg only, while Bitcoin, Ethereum, TRON and EVM exposure is named but unpriced. The clearest lever is also the most mechanical: 1.44M XRP is still sitting in the operator's own wallets, and 5.59M XRP moved through THORChain to Ethereum, where the receiving addresses are public.
- Whether the Radix and GalaChain audit misses produce concrete scope changes, since both defects lived inside code that external reviews had already covered.
- The Chainflip restart sequence and its TRON-last ordering; and whether Splash or Optim Finance puts a redemption route behind the OADA patch.
- September's running total: with ~$322M in the first week and roughly $33M across the next two, the month is still on track to be the year's largest.
Sources
- Blockaid exploit detection alerts (Sep 15 Safe/rsETH; Sep 16 Flamincome).
- BlockSec, SlowMist and AstraSec root-cause analyses of the Safe multicall authorization flaw.
- PeckShieldAlert front-run size and tracing; CertiK Starknet balance estimate.
- CoinDesk, ForkLog, Gadgets360 and The Crypto Times coverage of the rsETH front-run.
- The Crypto Times and AMBCrypto, Nostra coverage; PeckShield tracing of the bridged portion.
- D'CENT preliminary incident report (Sep 17) and September 20 user notice; XRPL.to day-by-day drain reconstruction; U.Today; The Crypto Basic; Bitcoin.com News.
- GalaChain post-mortem (Sep 14); CryptoSlate and TokenPost reporting.
- Radix Foundation disclosure (Sep 17); CryptoSlate; community ledger reconstruction.
- Splash incident report; CryptoSlate; Optim Finance updates.
- Chainflip incident notice and root-cause post; crypto.news; iTokenly hack registry.
- aelf recovery updates (Sep 14-15) and the project's August 26 incident report.
- USDT blacklist daily tracking (Sep 15); FinanceFeeds coverage of the TRON batch.
- Blink Wallet statement (Sep 19) and its same-day follow-up narrowing the scope to a few dozen accounts.
- Trezor incident notice and its September 17 update confirming the 347,149-contact export; Brevo's own incident notice.
- HP Wolf Security Threat Insights Report, September 2026 (Needle Stealer); Chainalysis blockchain-malware commentary.
- DefiLlama hacks database for event-level confirmation.
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Why is the weekly total ~$45.0M when the stories mention $16.7M, $16.8M, $7.73M, $3.5M and $345.9K?
Those five are the incidents that occurred inside the window, and they sum to about $45.0M. The other incidents on this page either happened earlier (GalaChain and Radix — reported separately as a ~$4.3M disclosure backlog; Chainflip and Splash occurred on September 12 and 13 and are booked in the September 7 – 13 total), are enforcement rather than loss (the Tether freeze), or carry no quantified loss (Blink, aelf, the data breaches and the malware campaign).
Was the rsETH loss $7.73M or $7.81M?
Two firms, two price snapshots: Blockaid reports ~$7.73M in confirmed losses, PeckShieldAlert sizes the front-run at ~$7.81M. The token amount is not in dispute — about 2,900 rsETH left the wallet, of which 2,882.37 went to the searcher's address. This page uses Blockaid's confirmed figure and notes the other.
Did the attacker in the Safe case actually get paid?
No. The attacker's transaction was in the public mempool, and the MEV searcher Yoink executed a competing transaction with higher priority in the same block, capturing the tokens first; the attacker's transaction then failed. The victim still lost the funds, the searcher holds them (minus ~18.95 ETH converted and ~18.93 ETH paid to a block builder), and Kelp paused the receiving address for 24 hours.
Are the figures exact?
No, and two are explicitly floors. D'CENT has quantified only XRP Ledger losses — 11,746,198 XRP across 6,678 wallets ≈ $16.7M — while stating exposure on four other chains; a narrower independent XRPL tally counts 6,160 addresses and 9.3M XRP. Nostra's own reconciliation is unfinished, and the ~$3.5M is borrowed value against worthless collateral rather than a final loss. Blink and aelf have disclosed no figures at all. Event counts and share arithmetic are computed exactly from this list; dollar values are point-in-time estimates from the sources named on each card.
Why do incidents from August appear in a September review?
Because the figures became public in September. GalaChain's post-mortem landed on September 14 and Radix's Foundation disclosure on September 17 — both incidents from August whose numbers had not been published when their own weeks were written. Rather than retro-fit them into closed weekly totals, they are listed here with their incident dates so a reader can see both when the money left and when the industry learned how much. Chainflip (September 12) and Splash (September 13) are the same problem in miniature: those two occurred inside the September 7 – 13 window, so they are counted in that week's total, and only their September 14 – 17 confirmation, patch and restart news appears here.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.