Web3 Security Weekly News Review — September 21–27, 2026
This week's review covers September 21 – 27, 2026: 12 publicly reported items, seven of them loss events inside the window — together roughly $408M, the largest weekly figure this site has recorded, carried almost entirely by the Bitget hot-wallet breach.
One accounting note applies throughout: the Bitget figure is the exchange's own revised estimate of September 25. Each card carries both the incident date and its disclosure dates.
The Bitget breach. At 18:31 UTC on September 24 the exchange detected unauthorized transfers from part of its hot and warm wallet layers; its revised estimate, published September 25, puts the loss at approximately $387.5M — the largest crypto theft recorded in 2026. No private keys were taken: investigators say a critical backend system in the wallet infrastructure was compromised and used to forge transaction data and trigger the exchange's own authorization flow. The second story is stranger: on Neutron, a governance proposal titled 'AI Agent Takeover' that cost its submitter about $20,199 in voting power reassigned the admin rights of ten contracts belonging to Astroport and Drop, and the attacker drained roughly $9.3M within minutes of execution.
- Realized losses~$408M7 in-window events; ~9.1x last week
- Largest event~$387.5MBitget hot/warm wallets, Sep 24
- Enforcement~$318KCircle + Tether, Bitget exploiter wallet
Overview
The dollar figure is the story this week, and almost all of it has one name attached. Seven loss events occurred inside the window and total roughly $408M — about 9.1x last week's ~$45.0M — and a single incident, the Bitget hot-wallet breach, carries about 95% of it. Strip that one out and the week looks almost ordinary: ~$20.5M across six events, in line with the quiet weeks this site has recorded all month. That asymmetry is itself the finding — a single exchange-side infrastructure failure outweighed everything that happened on-chain this week combined.
The second story is a new vector for this column: theft by governance. On Neutron, a Cosmos-ecosystem chain that had entered what it calls a long-term maintenance phase, an attacker spent about $20,199 acquiring the NTRN needed to pass an expedited governance proposal — 'AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration' — whose eleven messages reassigned the administrator role of ten contracts belonging to Astroport, a decentralized exchange, and Drop, a liquid-staking protocol. Within twenty-four minutes of execution the contracts were migrated to attacker-controlled code and emptied. Nothing in either application's own code was exploited; the vote itself was the attack.
The third story is disclosure arithmetic. Two of the week's loss figures moved while the week was still running: Bitget's estimate rose from $351.6M to $387.5M on September 25 as Zcash and TRON transactions were added to the count, and Duelbits' estimate climbed from an initial ~$4.2M to the ~$7M its co-founder confirmed, as investigators found affected wallets on Bitcoin and Solana.
The 12 Stories
Bitget hot-wallet breach — ~$387.5M moved without any private key being stolen
Bitget's security systems detected unauthorized transfers from part of its hot and warm wallet layers at 18:31 UTC on September 24, with on-chain researchers flagging the outflows before the exchange's own announcement. The revised estimate published September 25 puts the loss at approximately $387.5M — up from the initial $351.6M after Zcash and TRON transactions were added — making it the largest crypto theft recorded in 2026 per DefiLlama's database. The exchange says a critical backend system inside its wallet infrastructure was compromised and used to forge transaction data and trigger the platform's internal authorization signing process; private-key compromise has been ruled out, cold wallets were untouched, and user account balances are stated as unaffected. Specter's asset breakdown counts 102.93M XRP (~$157.5M), 31,890 ETH (~$85.75M), 34.75M USDT and 21.05M USDC among the stolen assets, with roughly $170M swapped into ETH across chains — including ~$19.7M of USDT0 converted into 7,111 ETH on Arbitrum in about six minutes at a ~5% premium. More than 63,000 ETH sits in exploiter-linked wallets. Withdrawals were paused; a phased resumption starts with Bitcoin at 08:00 UTC on September 28, ETH on September 29, USDT on September 30, and all remaining assets, fiat and P2P on October 2. Mandiant and SlowMist are supporting the investigation, and CEO Gracy Chen has said a North Korean link is likely based on VPN and IP patterns — an attribution that remains unconfirmed.
Source: Bitget security notice (Sep 24) and revised estimate (Sep 25); Specter asset breakdown via PANews; DefiLlama hacks database; CoinDesk; CNBC
Neutron governance takeover: a $20K vote reassigned Astroport and Drop admin rights — ~$9.3M drained
Neutron governance proposal 9 — 'AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration' — passed its expedited track with about 82% approval when voting closed late on September 21 UTC (early September 22). Its eleven messages each handed admin control of a Neutron contract to the proposer's address; ten of the contracts belonged to Astroport and Drop. According to an on-chain reconstruction, the account carrying most of the yes vote bought about 31.6M NTRN for 20,199 USDC and staked it less than twelve minutes before voting closed. Within twenty-four minutes of execution the attacker migrated the contracts to malicious code and drained them — SlowMist recorded ~$4.9M at Astroport and ~$4.4M at Drop, $9.3M in all, while a former Neutron contributor's itemized count puts the confirmed outflow nearer $4.4M (about $3M ATOM, $1.2M USDC, ~$100K DYDX and smaller wstETH/WETH), with Neutron's rate limits and the subsequent halt protecting more than $1.6M in USDC. Neutron halted block production about five hours after the vote closed, by which time roughly $1.96M had already left for other chains. Cosmos Hub validators then halted their own chain for over 24 hours — from block 33,086,740 on September 22 until 12:00 UTC on September 23 — and restarted on Gaia v28.3.0 with a one-time state change that moved the attacker's remaining 1,227,121 ATOM (~$2.2M) into a 4-of-6 validator multisig pending return. A post-restart THORChain refund of 168,990.9 ATOM reached the attacker and was moved to Osmosis and sold for roughly 266,841 USDC before it could be caught.
Source: Neutron proposal 9 on-chain record; SlowMist incident entries; Cosmos Hub forum and restart notice; GoPlus Security and Rarma on-chain reconstructions; Protos; CryptoSlate
Duelbits returns online September 27 after a ~$7M multi-chain hot-wallet theft
Crypto casino and sportsbook Duelbits confirmed a hack its co-founder sizes at roughly $7M, with the platform offline while wallets are replenished and the investigation continues. The loss estimate moved upward all day: ScamSniffer first flagged ~$4.2M in abnormal outflows from hot wallets on Ethereum, BNB Chain and Tron; PeckShield put it at $4.3M; Specter raised the figure twice — to $4.9M and then $5.9M — after identifying compromised wallets on Bitcoin and Solana; the co-founder's confirmation landed at approximately $7M. On Ethereum the affected wallet moved 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI and 12.4 billion SHIB within minutes, with 209 BNB and 192,000 TRX on other chains and 8.1 BTC from the Bitcoin hot wallet; most proceeds were consolidated into a single address holding around 2,234 ETH (~$6M). The transaction pattern indicates unauthorized control of wallet-signing capability, but no technical root cause has been published, so the suspected private-key compromise remains a researcher assessment. The co-founder states user funds are safe. On September 27 the platform announced its relaunch with about $8M across hot and cold wallets and deposits and withdrawals live. Duelbits lost $4.6M to a 2024 incident that CertiK also linked to private-key exposure.
Source: ScamSniffer alert; PeckShield; Specter tracing; Duelbits co-founder statement (Sep 24); SlowMist hacked-project database; CoinDesk
Meter: block validation flaw used to mint ~$2.3M of unbacked MTR and MTRG
An attacker exploited a block validation flaw on the Meter mainnet at 21:14 UTC on September 23 to mint unbacked MTR and MTRG, dump them on decentralized exchanges and bridge funds out — about $2.3M of fabricated assets sold through PancakeSwap, per Blockaid. The selling pressure sent MTR down roughly 80% and MTRG about 75% (from ~$0.0099 to ~$0.0027 on one tally). The team said chain state was preserved, paused the mainnet and the bridge, and asked users to stop all activity; a recovery method was still undecided days later. Meter lost $4.4M to a similar bridge exploit in 2022.
Source: Meter.io statement (Sep 24); Blockaid sizing; The Crypto Times and Cryptonews coverage
Payy Network bridge drained of its full balance — $1.83M in USDC
A single transaction at 04:21:23 UTC on September 24 (Ethereum block 26,044,909) called the verifyRollup function on Payy Network's RollupV1 contract and moved 1,832,149.4681 USDC out — 1,828,589.38 of it to one address. Payy, a zero-knowledge rollup for stablecoin payments, confirmed the exploit and said the bridge's entire balance was taken; the funds involved are users' non-custodial deposits. The attacker had seeded the operation's gas through the Railgun privacy protocol in advance, converted the first batch into roughly 683 ETH and split the proceeds across fresh addresses. A second verifyRollup batch about five hours later moved a further ~90.2K USDC to the same recipient, taking the identified total to roughly $1.92M. All Payy transactions — deposits, withdrawals, transfers and card transactions — are paused. A September 25 update says initial root-cause analysis is complete and working with a top audit firm for validation, and states the incident was NOT a compromised key, social engineering, or an exploit of off-chain infrastructure.
Source: PeckShieldAlert incident report; Payy statements (Sep 24, Sep 25); Specter alert; The Crypto Times on-chain verification
Circle and Tether freeze ~$318K at a Bitget exploiter wallet — the limit of issuer freezes
Circle blacklisted the wallet labelled 'Bitget Exploiter 8' on Etherscan at 05:00 UTC on September 25, freezing 99,990 USDC; Tether added the same address to its USDT blacklist roughly seven hours later, immobilizing 218,023 USDT. Combined: about $318,000 — roughly 0.08% of the $387.5M stolen. The freeze came late because the attacker had already converted most of the stolen stablecoins into ETH, which no issuer can touch; trackers cited in reporting put more than 63,000 ETH in other exploiter-controlled wallets. Bitget publicly thanked both issuers and separately launched a Recovery Bounty Program paying 5% of funds frozen and 5% of funds recovered through outside help, using Bybit's LazarusBounty initiative as a core channel, with a live dashboard tracking the attacker's addresses.
Source: CoinDesk (Sep 25); Circle and Tether blacklist transactions; Bitget Recovery Bounty announcement; Decrypt tracing
KelpDAO sues LayerZero and its CEO over the $292M rsETH bridge exploit
Evercrest Technologies, the legal entity behind KelpDAO, filed a civil claim in British Columbia against LayerZero and co-founder Bryan Pellegrino over the April 18 exploit that drained 116,500 rsETH — about $292M — from Kelp's LayerZero-based bridge. Kelp alleges LayerZero failed to disclose known risks in its technology and failed to prevent its own security infrastructure from being compromised, and says LayerZero reviewed and approved Kelp's deployment and configuration in writing before the incident. LayerZero's own May incident report confirmed the intrusion began March 6 with the social engineering of a developer, after which the attacker entered LayerZero's RPC cloud environment and altered nodes used by its verifier — which then signed a forged message releasing the tokens. LayerZero blames Kelp's 1-of-1 verifier configuration as the single point of failure; Pellegrino called the lawsuit meritless and said he will defend it in Vancouver. Kelp migrated rsETH bridging to Chainlink CCIP in May, and depositors were made whole by June.
Source: KelpDAO statement (Sep 24-25); LayerZero May incident report; BeInCrypto, crypto.news and Blockonomi coverage; court filing via KelpDAO
US forfeiture of $84.2M tied to the Capstone payments firm becomes public — Tether named only by association
US prosecutors' civil forfeiture of approximately $84.2M connected to Capstone, a Montana-based payments company accused of operating as an unlicensed money transmitter, became widely public on September 24–25 when the Financial Times linked the case to Tether. The court filing itself — a complaint filed July 15 in the Eastern District of California, with seizures executed September 14 — names neither Tether nor Bitfinex: it itemizes $79.11M from a Wells Fargo Securities account, $1.86M from a second Wells Fargo account, $2.06M at JPMorgan Chase and just over $1M in USDT across two crypto addresses. Behind Capstone, per the documents, stood EQIBank, a Dominica-licensed digital bank that allegedly directed the money movement; EQIBank's motion to recover the funds was denied in July. Tether confirmed EQIBank processed its USDT issuance and redemption wires but says its exposure is below 0.034% of group assets, and neither Tether nor Bitfinex is charged.
Source: US civil forfeiture filing (E.D. Cal., Jul 15; seizures Sep 14); Financial Times reporting (Sep 24-25); Tether statement; TokenPost
Coldcard white-hat funds consolidated under an on-chain claim — 52.37 BTC, 2.8% of the exploit haul
Galaxy research monitored white-hat-held funds from the Coldcard vulnerability exploit merging 52.37 BTC — from the Wave 2, Footprints AA, AU and AX clusters — into a new address that wrote an OP_RETURN message reading 'claim:cryptorecoverytrust dot com'. The consolidated amount represents about 2.8% of the funds taken in the Coldcard exploit, which drained a nine-figure haul — peak estimates have ranged from just over $100M to about $130M — via a firmware bug exploited from late July. The claim is a public assertion of intent to return funds, not a return; nothing in the posting itself verifies who controls the address or when users would be paid.
Source: Galaxy research via ChainCatcher (Sep 22); on-chain OP_RETURN record; July Coldcard firmware-incident coverage
A multi-wallet drain campaign crosses Ethereum, other EVM chains, TRON and Bitcoin — total unsettled
On-chain analyst Specter tracked a private-key-compromise campaign affecting more than 145 Ethereum addresses plus at least five Bitcoin addresses, with the attacker still moving funds as of September 22. Many affected wallets held USDC, which the attacker converted into ETH before moving assets across chains; Bitcoin proceeds were consolidated with the Ethereum-derived funds. Reported losses exceed $4.3M and are explicitly open-ended while the activity continues. The figures come from a single analyst's thread echoed by one outlet; no affected platform has come forward, and no independent second count exists yet.
Source: Specter on-chain tracking via CryptoMeter (Sep 22); single-outlet reporting — flagged accordingly
Two small token-contract exploits: The Internet Token ($16K) and DoinGud ($35K)
DefiLlama's hacks database recorded two small exploits on September 21: The Internet Token on Base, drained of about $16,000 via an arbitrary external call, and DoinGud, an NFT-fi protocol on Polygon, drained of about $35,000 through a swap logic flaw. Neither incident produced a project post-mortem or a recovery effort within the window, and neither amount moves any weekly aggregate on its own.
Source: DefiLlama hacks database entries (Sep 21)
Darksword iOS spyware adapted past its published version range — wallet data in scope
SlowMist's 23pds flagged that the Darksword iOS spyware — originally documented by Google Threat Intelligence Group as affecting iOS 18.4 through 18.7 — has been adapted to iOS 26.5, a judgment SlowMist notes is not yet officially verified. The attack typically begins with social engineering: a malicious link sent through social media or messaging apps leads to root-level device access and extraction of wallet data. The same reporting cycle includes three investors who lost close to $1.8M in Bitcoin after downloading a fake wallet app from Apple's official App Store, and who are suing Apple.
Source: SlowMist 23pds alert (Sep 22); Google Threat Intelligence Group original Darksword disclosure; ChainCatcher reporting
Key Signals
| Signal | Reading |
|---|---|
| In-window losses | ~$408M across 7 events, vs ~$45.0M last week (about 9.1x) |
| Largest event | ~$387.5M — Bitget, ~95% of the week on its own; the largest crypto theft recorded in 2026 |
| Top pattern | Authorization layers above key management: an exchange backend that could forge transactions, a governance vote that reassigned application admin rights, a forged rollup verification batch |
| Enforcement | ~$318K frozen by Circle and Tether at one Bitget exploiter wallet; an $84.2M fiat forfeiture tied to the Capstone case surfaced |
| Unquantified | Multi-wallet drain campaign (single-outlet floor of $4.3M+); Bitget's own frozen-funds total undisclosed; Duelbits root cause pending |
TRON Footprint
| Item | On-chain footprint | Status |
|---|---|---|
| Bitget breach, TRON leg | TRON transactions added in the revised $387.5M estimate; TRX and TRC-20 USDT among the affected assets | Confirmed |
| Duelbits outflows | 192,000 TRX moved from the Tron hot wallet alongside Ethereum, BNB Chain and Bitcoin legs | Confirmed |
| Tether freeze (Bitget case) | 218,023 USDT immobilized at the exploiter wallet ~7 hours after Circle's USDC freeze | Confirmed |
| D'CENT exposure (carried) | TRON remains among the chains whose keys may be exposed for pre-8.1.0 app users; no TRON losses quantified | Standing advisory |
For Tron energy users the takeaways are concrete. First, the week's largest theft again ended in an ETH swap precisely because issuer freezes cannot reach ether — the TRC-20 slice of a stolen basket is the slice that can be immobilized, and this week that slice was $218,023 of $387.5M. Second, the Duelbits outflows show thieves treating TRON as a rail, not a destination: 192,000 TRX moved through it in minutes. Third, none of this changes the standing advice — a recovery phrase that has touched compromised software governs the TRC-20 balances at the derived address, and rotating to a new phrase before moving assets costs a fraction of one energy rental.
What I'm Watching Next Week
- Bitget's phased withdrawal resumption (BTC from September 28, USDT September 30, everything else October 2) and whether the recovery bounty produces a first frozen-funds figure.
- Whether the more than 63,000 ETH in exploiter-linked wallets starts moving to mixers or exchanges — and whether any additional issuer freezes land first.
- Neutron's restart and post-mortem: whether the prepared restore binary goes live, whether the 1,227,121 ATOM in the Cosmos Hub multisig reaches users, and what changes in expedited governance.
- Duelbits' promised root-cause statement now that the site is back online, and whether the confirmed mechanism matches the suspected key compromise.
- Meter's recovery plan for a preserved-but-paused chain, and any second count of the MTRG supply damage.
- Whether the multi-wallet drain campaign gets a second, independent count — or a named victim.
Sources
- Bitget security notice (Sep 24) and revised estimate (Sep 25); Bitget Academy incident timeline and withdrawal plan.
- Specter asset breakdown via PANews (Sep 25); Arkham Intelligence dashboard; Hacken and PeckShield alerts.
- Neutron proposal 9 on-chain record; SlowMist incident entries (Sep 22); Cosmos Hub forum Weekly Update #17 and restart notice (Sep 23); GoPlus Security and Rarma reconstructions; Protos; CryptoSlate; SigIntZero analysis.
- ScamSniffer alert; PeckShield estimate; Specter revised counts; Duelbits co-founder Joe statements (Sep 24); SlowMist hacked-project database; CoinDesk.
- Meter.io statement (Sep 24); Blockaid sizing; The Crypto Times; Cryptonews.
- PeckShieldAlert incident report and Payy statements (Sep 24, Sep 25); The Crypto Times on-chain verification; smartcontractshacking.com reconstruction.
- CoinDesk (Sep 25) on the Circle and Tether freezes; Circle and Tether blacklist transactions; Bitget Recovery Bounty announcement; Decrypt.
- KelpDAO statement (Sep 24-25); LayerZero May incident report; BeInCrypto, crypto.news, Blockonomi; British Columbia filing via KelpDAO.
- US civil forfeiture filing, E.D. Cal. (Jul 15; seizures Sep 14); Financial Times (Sep 24-25); Tether statement; TokenPost.
- Galaxy research via ChainCatcher (Sep 22) on the Coldcard white-hat consolidation and OP_RETURN claim.
- Specter tracking via CryptoMeter (Sep 22) on the multi-wallet drain campaign — single outlet, flagged.
- DefiLlama hacks database (Sep 21 token entries; 2026 yearly totals).
- SlowMist 23pds alert (Sep 22) on Darksword; Google Threat Intelligence Group original disclosure.
- TRM Labs 2026 running totals via the Financial Times; Crypto Coin Show September aggregate.
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Why is the weekly total ~$408M when the cards mention $387.5M, $9.3M, $7M and $2.3M?
Those are the largest of the seven incidents that occurred inside the window; adding Meter ($2.3M), Payy ($1.83M) and two small token exploits ($35K + $16K) brings the sum to roughly $408M. Enforcement items — the Circle/Tether freeze and the Capstone forfeiture — are not losses and are excluded.
Was Bitget's loss $351.6M or $387.5M?
Both are Bitget's own figures. The initial assessment of September 24 was $351.6M; the September 25 revision to $387.5M adds Zcash and TRON transactions that the first count missed. The exchange states the revision reflects fuller accounting of the same incident, not new transfers. This page uses the revised figure.
Is the Neutron loss $9.3M or $4.4M?
Depends on the basis, and both are stated on the card. SlowMist recorded $4.9M at Astroport plus $4.4M at Drop — $9.3M in all — and Protos initially put it near $9.5M. A former Neutron contributor's itemized count of confirmed outflows is nearer $4.4M, with Neutron's rate limits and the halt protecting more than $1.6M in USDC, and Cosmos Hub validators swept a further $2.2M of ATOM back on restart. This page uses SlowMist's $9.3M as the headline event figure and notes the itemized floor; the recovery column tracks what was actually clawed back.
Did Duelbits lose $4.3M or $7M?
The number grew as more wallets were found: ScamSniffer's first count was ~$4.2M, PeckShield's $4.3M, Specter's $4.9M then $5.9M after Bitcoin and Solana wallets surfaced, and the co-founder's confirmation is approximately $7M. SlowMist's database still tracks ~$4.9M actually observed moving. This page uses the platform's own ~$7M and notes the tracked figure.
Why do incidents from before September 21 appear in this review?
As developments, not losses. The Capstone forfeiture was executed on September 14 and became widely reported on September 24–25, and the KelpDAO lawsuit was filed on September 24 — both are dated to when they became public, and neither enters the weekly loss total, which counts only money that left during the window.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.