Web3 Security Weekly News Review — September 28–October 4, 2026
This week's review covers September 28 – October 4, 2026: 11 publicly reported items, four of them loss events inside the window — together roughly $10.2M, the quietest week this site has recorded since early September, and a round number smaller than any single hour of last week's Bitget breach.
The week's second story runs the other way: for the first time in this column's coverage, an exploiter returned everything — $3.8M to NEAR Intents, roughly 36 hours after the theft, after the protocol's general manager publicly claimed to have identified them and set a 48-hour clock.
Two, in opposite directions. On October 4 an unidentified investment vault on Base lost about $6M in wstETH after a freshly deployed contract was added to its borrowing allowlist through a valid multisig transaction — the vault's 3-of-7 Safe had been idle for 25 days, and roughly $31.7M remained inside with no team ever claiming ownership. On October 1 NEAR Intents lost ~$3.8M of USDT through a bug in its Omni deposit/withdrawal layer; two days later, after a public 'we have identified you' ultimatum with three return addresses and a 48-hour deadline, the exploiter sent every dollar back and left an on-chain apology.
- Realized losses~$10.2M4 in-window events; ~2.5% of last week
- Largest event~$6MUnidentified Base vault, Oct 4
- Recovered~$3.8MNEAR Intents, returned in full Oct 2
Overview
After the largest week this site has recorded, the series snapped back to earth: four loss events occurred inside the window and total roughly $10.2M — about 2.5% of last week's ~$408M, and the smallest weekly figure since early September. The structure is as instructive as the size. Not one of the four losses touched a core protocol: Aave V3's Base market, Uniswap v4's contracts, the NEAR chain and Base itself all functioned exactly as designed. The failures were one layer out — a borrowing allowlist, a third-party Safe module, a liquidity hook's shared accounting, a deposit/withdrawal rail. This column has spent weeks describing the trusted component as the attack surface; this week the trusted components were small, glued-on, and almost none of them had a name users would recognize.
The second story is a recovery with no precedent in this column. NEAR Intents' Omni deposit/withdrawal layer was drained of roughly $3.8M in USDT on October 1 — after two test withdrawals of $10 and $11 the day before, per Bitquery's reconstruction. The team patched within about an hour, and the money ran through KuCoin and a Bitcoin bridge. Then the general manager posted three return addresses, a 48-hour deadline, and the sentence 'We have identified you, sir.' By mid-afternoon on October 2 the full amount was back, an on-chain message read 'we were in the wrong,' and the investigation was closed. The full return is counted nowhere in this week's loss total — the outflow happened, and that is what the loss series records — but it is the week's most transferable data point: identification, publicity and a deadline worked on an attacker who was apparently neither state-backed nor disciplined.
The third story is the long tail of the $387.5M Bitget breach, which threaded through the whole window. Withdrawals resumed in phases — BTC on September 28, ETH on September 29, USDT (including the Tron leg) on September 30, everything else plus fiat and P2P on October 2 — while depositors voted with their feet: Bloomberg, citing DefiLlama proof-of-reserves data, recorded roughly $463M of net customer outflows inside a single day — a record for that data series. On September 30, Mandiant and SlowMist's interim reports landed: a zero-day in third-party security products gave the attacker internal credentials, the earliest malicious activity traces to August 31, and a customized withdrawal tool began executing theft at 01:49 am on September 25. On October 1, Chainalysis attributed the breach to North Korea-linked actors — an assessment, not a government confirmation — with wide reporting following on October 3.
The 11 Stories
An unidentified Base vault loses ~$6M in wstETH to a whitelist entry added through its own multisig
At 09:20 UTC on October 4, Blockaid flagged an ongoing exploit against a vault contract on Base; within roughly 40 minutes the estimate had grown from $2.02M to about $6M. The attacker borrowed 1,783.067 aBaswstETH — Aave V3's Base-market receipt token held by the vault — and redeemed it for roughly 1,783 wstETH, worth about $6M at the ~$3,386 wstETH print. The entry point was not a code flaw in Aave or Base: a freshly deployed contract was added to the vault's borrowing allowlist through a transaction signed by the vault's operating owner, a 3-of-7 Safe created through Safe Proxy Factory 1.4.1 whose seven signers are not publicly identified. On-chain timing is the damning part: the Safe had executed no transaction on the vault for 25 days, and at 08:52 UTC on October 4 it removed a contract belonging to the attacker from the allowlist — then re-admitted it one minute later, both signatures cryptographically valid. Roughly $31.7M remained in the vault; no project team has claimed it, no statement has been issued, and the reason the allowlist changed — stolen signer keys, social engineering, or an insider — remains open.
Source: Blockaid, PeckShield, CertiK, GoPlus and ExVul real-time alerts (Oct 4); on-chain Safe records via the incident registries; Metaverse Post and ThreatCluster reconstructions
NEAR Intents drained of ~$3.8M through its Omni deposit rail — and every dollar returns by October 2
NEAR Intents, the cross-chain swap layer routing volume across more than 35 networks, halted services on October 1 after a bug in the interaction between its Omni deposit/withdrawal infrastructure and its smart contracts let an attacker drain roughly $3.8M — mostly USDT — from a BNB Chain treasury wallet. Bitquery's reconstruction counts two test withdrawals of $10 and $11 on September 30, then five withdrawals totaling about 3.865M USDT over roughly six hours. The platform's SHIELD monitoring detected the irregular outflows, the contract-side flaw was patched within about an hour, and deposits and withdrawals stayed restricted across eleven networks for about twelve more hours while audits completed. ZachXBT traced the funds through KuCoin and across a bridge into Bitcoin — roughly three-quarters of the stolen value. On October 2, general manager Alex Shevchenko posted 'We have identified you, sir,' published three return addresses (Bitcoin, BNB/Ethereum, Solana) and set a 48-hour deadline; the Bitcoin recovery wallet received about 34.59 BTC, and by roughly 14:30 UTC on October 2 the full amount had been returned. An on-chain message attributed to the exploiter read 'we were in the wrong.' Co-founder Illia Polosukhin had already pledged full user compensation; the investigation is closed, with a detailed post-mortem still promised.
Source: NEAR Intents statements (Oct 1–2); Shevchenko and Polosukhin posts; Bitquery on-chain reconstruction; ZachXBT tracing; CoinDesk, Cryptonomist and Cointelegraph coverage
FlashLoopAdapter, a third-party Aave v3 loop module, drained of ~$305K through a caller-authentication flaw
FlashLoopAdapter — a third-party Safe module that manages leveraged Aave v3 looping positions — was exploited for roughly $305,000 from two wallets, per the incident registries, which date the exploit to October 1. The flaw was caller authentication: the module failed to verify that the party invoking it was the Safe it belonged to, letting the attacker forge a Safe and drain the leveraged positions it managed. SlowMist's October 2 alert described the same incident as an exploit of an 'Aave v3 Loop Safe Module' with approximately 114.09 ETH taken — consistent with the dollar figure — and explicitly noted the target was the peripheral module, not Aave v3's core lending contracts. Mechanism details, attacker identity and remediation status were unconfirmed at reporting time.
Source: SlowMist alert (Oct 2, ~114.09 ETH); incident registry entries (Oct 1, ~$305K); KuCoin and CoinMarketCap flash coverage
GoldPesa's Uniswap v4 hook loses ~$115K of protocol-owned liquidity to a shared-unlock accounting flaw
A single transaction at 13:05:51 UTC on October 2 (Base block 52,078,502) drained roughly $114.9K — net 114,428.51 USDC per on-chain reads — from GoldPesa's protocol-owned GPX/USDC liquidity, managed by its Uniswap v4 hook GPXHooks. Defimon Alerts flagged the exploit the next day and classified it as a logic error; a proof-of-concept was published to the DeFiHackLabs repository. The mechanics: the hook rebalances inside its beforeSwap callback by burning and re-taking its position, but TAKE_PAIR withdraws the PositionManager's entire net positive delta across whatever PoolManager unlock is currently open — and the hook never verified its own deltas were isolated. The attacker borrowed 175,000 USDC from Morpho, minted a WETH/USDC position inside its own unlock without paying for it (a phantom ~115K USDC debt on the shared ledger), then tripped the hourly rebalance with two small buys: the hook's real ~148,900 USDC credit was netted against the attacker's debt, so the hook received only ~33,900 while effectively paying for the attacker's position. The attacker burned the now debt-free position for ~115,000 USDC, repaid Morpho, and bridged the proceeds out via Solana toward BNB Chain. Uniswap v4's core functioned as designed; the loss was confined to protocol-owned liquidity. GoldPesa has not published a post-mortem.
Source: Defimon Alerts (Oct 3); The Crypto Times and Coinfomania coverage; DeFiHackLabs PoC (PR 1288); on-chain transaction reads via the hack registry
MetaMask discloses a staking-infrastructure security incident and exits all its Lido validators — ether.fi reports a node-operator event the same day
MetaMask disclosed on October 1 an ongoing security incident affecting part of the infrastructure behind MetaMask Staking (formerly ConsenSys Staking), and began precautionarily exiting the Ethereum validators it operates through Lido — Lido expects the final affected validators to exit by October 7, with the full exit-withdrawal-reentry cycle taking up to about 45 days under current queue conditions. The company says it has found no immediate threat to user wallets: the staking service is non-custodial, MetaMask signs for validators it runs but holds no withdrawal keys, so signing-infrastructure compromise cannot by itself move customer ETH. MetaMask has not confirmed the access method or the scope; researchers' on-chain analysis points to block-production rewards from 18 of its validators being redirected to a Tornado Cash-funded wallet (a diversion measured in fractions of an ETH), and researcher estimates put the precautionary exit near 17,000 validators controlling roughly 523,000 ETH — neither figure confirmed by the company. Lido confirmed the exits on its governance forum and said stETH holders need not act. The same day, ether.fi confirmed a security incident with its own node operators — the two largest Ethereum staking gateways disclosing infrastructure events within hours of each other. Downstream, Sentora's curated Morpho vaults saw sharp withdrawals within hours (its RLUSD vault fell from $426.4M to $350.4M and its PYUSD vault from $408.9M to $349.3M in about four hours) despite no reported link to the incident.
Source: MetaMask user update (Oct 1); Lido governance forum post; CoinDesk and Cointelegraph reporting; researcher on-chain analysis (0xKaden); CryptoBriefing on Sentora vault flows; ether.fi statement (Oct 1)
Bitget completes its withdrawal resumption on October 2 — and the interim reports fill in the $387.5M attack path
Bitget's phased resumption completed on schedule: BTC withdrawals reopened at 08:00 UTC on September 28, ETH across five networks on September 29, USDT on Ethereum, BSC, Solana and Tron on September 30, and all remaining tokens plus fiat and P2P services on October 2. The September 30 interim reports from SlowMist and Mandiant aligned on the attack path: a zero-day in third-party security products gave the attacker access to internal management systems, from which fraudulent withdrawal commands were injected into the wallet backend. SlowMist places the earliest malicious activity on August 31 — a hidden script under a service process that read the database password from an environment variable — with similar activity on two more nodes on September 23 and 25, access to a second product's management platform on September 25, and a customized withdrawal tool tailored to the exchange's withdrawal logic that began executing theft at 01:49 am on September 25. Mandiant found web-shell deployment and command-and-control on one appliance, then lateral movement to the production wallet job server. CEO Gracy Chen's account adds that the attacker ran two small test transfers at 18:31 UTC on September 24 that stayed under risk thresholds, began large transfers about thirty minutes later, and even attempted to edit withdrawal records to queue additional Bitcoin withdrawals. The User Protection Fund was replenished above $300M by September 30 — two days inside the one-week commitment — the 47th proof-of-reserves snapshot (September 29) shows a 131% reserve ratio across 19 covered assets, and Bloomberg, citing DefiLlama, recorded roughly $463M of net outflows in the 24 hours into September 29, the largest single-day figure in that series.
Source: Bitget Academy incident timeline and withdrawal-resumption notices; SlowMist and Mandiant interim reports (Sep 30); The Block and BleepingComputer coverage; Bloomberg via DefiLlama proof-of-reserves data; PANews series
Chainalysis attributes the $387.5M Bitget breach to North Korea-linked actors — pushing its 2026 DPRK total past $1B
Blockchain analytics firm Chainalysis attributed the September 24 Bitget breach to hackers tied to North Korea — the assessment published October 1, with wide reporting following October 3. The firm's analysis centers on fund movement: funds left across four chains within three hours (Ethereum 49.7%, XRP Ledger 40.8%, Zcash 7.6%, Tron 1.8%), and a large XRP share moved through cross-chain swap services into Bitcoin — a laundering pattern Chainalysis characterizes as consistent with prior DPRK-linked operations. With the Bitget breach included, the firm assesses that cryptocurrency stolen by DPRK-linked actors in 2026 now surpasses $1B. The attribution is an analyst assessment: Bitget has not confirmed it, its CEO had earlier described the indicators as 'preliminary,' and no government body has weighed in. Mandiant and SlowMist's published reports address the intrusion path, not the attacker's nationality.
Source: Chainalysis assessment (Oct 1) via Finobird and aggregated reporting (Oct 3); Bitget CEO statements (Sep 25–29); Mandiant/SlowMist reports (Sep 30)
D'CENT theft spreads beyond XRP to Bitcoin, Ethereum, Tron and Stellar — the count passes 12.4M XRP
The D'CENT wallet compromise — booked on this site as a week-5 loss event at 11,746,198 XRP, the window-cumulative count through September 20 — kept growing through this window. On September 29, Protos reported the event had spread beyond the XRP Ledger: D'CENT's own disclosure names Bitcoin, Tron and Ethereum, at least one Stellar user reported losing XLM, and the developer IoTrust confirmed at least 110 abnormal-transfer reports involving non-XRP assets. The total passed 12.4M XRP from more than 7,000 wallets, after thieves took a further 640,370 XRP following September 21; roughly $18–20M in value at reporting-time prices, the year's second-largest XRP theft after Bitget's 102.9M. By the end of the week about 6.3M of the stolen XRP had crossed to Ethereum through THORChain — researchers note most of the stolen value is no longer held as XRP. D'CENT is urging every user of an app-created wallet to generate a new recovery phrase and migrate all assets, including tokens, NFTs and staked positions; the multi-chain design is the mechanism — one compromised phrase swept every chain the wallet touched.
Source: Protos (Sep 29); ZDNet Korea via IoTrust statements; BroadChain and Cryptonomist coverage; Yahoo Finance sizing; D'CENT incident report (Sep 17) and migration advisory
Drift opens DFX recovery claims at about one cent per dollar lost — a six-month-old $295M exploit starts paying out
On October 1 — exactly six months after the April 1 exploit — the Drift Foundation (the protocol relaunched in July as Velocity) opened claims and redemptions for DFX, its recovery token, for the $295.4M in verified user losses. Each verified dollar lost maps to one DFX; the fixed allocation is 299,500,810.998 DFX, and the Recovery Pool opened at roughly 3.11M USDT, producing an initial redemption rate of about 0.0104 USDT per DFX — roughly 1.04% per dollar, final and irreversible: the USDT payout and the token burn execute in one transaction, and burned DFX forfeits its share of future deposits. Future funding comes from 60–90% of Velocity's daily net protocol revenue plus committed ceilings of up to $127.5M from Tether and up to $20M from strategic partners — commitments, not cash on hand. The claim window closes January 1, 2028, when unclaimed DFX burns.
Source: Drift/Velocity launch announcement (Oct 1); CryptoSlate and The Block coverage; Tether April support plan; recovery dashboard figures
Fake GIWA reimbursements progress — with a classification fight attached
Follow-up on the counterfeit GIWA layer-2: a fake OP Stack chain reusing GIWA's reserved chain ID 9134 ran a working bridge and batcher, was listed by DYORSWAP as the real mainnet, and drained about 766.25 ETH (~$2M) from 1,335 addresses that bridged in — the scam occurred September 26 and was disclosed September 27–28, before this window. The in-window development is compensation: DYORSWAP has paid out more than 200 ETH from its own treasury, addresses that bridged under 5 ETH were offered 40% reimbursement, and larger deposits are under separate review because some may be tied to the operators. An accounting note belongs here: hack-tracking databases book the event as a phishing/social-engineering loss, while SlowMist files it under fraud rather than hacks. This column carries it as a development card and keeps it out of the weekly loss series, consistent with the standing treatment of user-facing scams — so the ~$2M appears in neither week's total.
Source: DYORSWAP reconstruction and statements (Sep 27–30); GIWA official denial (Sep 27); Protos, Cointelegraph and Crowdfund Insider coverage
THORChain refuses Bitget's blocking request and processes $6.3M of the haul — while automated Cow/Chainflip laundering converts the rest
The decentralization argument that opened before this window kept producing numbers inside it. THORChain declined Bitget's formal request to refuse service to attacker addresses — its position being that a permissionless protocol has no address-blocking mechanism — and attacker-linked wallets converted roughly $6.3M of ETH into 75.2 BTC through it. SlowMist's tracking shows the automation behind the rest: scripts create Cow Protocol orders whose recipient addresses are pre-prepared Chainflip deposit contracts, converting stolen assets to BTC without a human in the loop. Against that, NEAR Intents says it stopped more than $50M of related cross-chain transfer attempts, and tracked freezes in the case now total roughly $840K — about $318K from Circle and Tether on the attacker addresses plus about $503K NEAR Intents froze mid-execution. AMLBot's tracing puts the vast majority of the stolen assets — roughly $343M — still dormant across 13 identified attacker wallets, a holding pattern consistent with Lazarus-linked history.
Source: THORChain and Bitget statements (Sep 26); SlowMist TrackAgent findings (Sep 30); NEAR Intents statement on blocked transfers; AMLBot tracing via crypto.news; Volity and ourcryptotalk summaries
Key Signals
| Signal | Reading |
|---|---|
| In-window losses | ~$10.2M across 4 events, ~2.5% of last week's ~$408M — the smallest week since early September |
| Largest event | ~$6M — the unidentified Base vault (Oct 4), about 59% of the week on its own |
| Recovery | NEAR Intents' ~$3.8M returned in full on Oct 2 — the first complete return this column has recorded |
| Top pattern | Permission and middleware layers: a borrowing allowlist, a Safe module's caller check, a hook's shared unlock, a deposit rail |
| Enforcement | ~$840K in tracked freezes in the Bitget case (~0.2% of the theft); no new forfeitures in the window |
TRON Footprint
| Item | On-chain footprint | Status |
|---|---|---|
| Bitget USDT leg reopened | USDT withdrawals across Ethereum, BSC, Solana and Tron resumed Sep 30; TRX and TRC-20 USDT remain among the stolen assets | Confirmed |
| D'CENT spread | Tron named in D'CENT's own disclosure; TRX balances swept under the same compromised recovery phrase; migration advisory live | Confirmed |
| Tether freeze (carried) | 218,023 USDT immobilized at the Bitget exploiter wallet on Sep 25 remains the largest single issuer action in the case | Standing |
| D'CENT app wallets (carried) | Pre-8.1.0 app-created wallets remain exposed until the recovery phrase is rotated and assets migrated | Standing advisory |
For Tron energy users the takeaways are concrete. First, the D'CENT spread is the week's proof that a recovery phrase governs every derived chain at once — rotating to a new phrase before moving anything remains the only real fix, and it costs a fraction of one energy rental. Second, the Bitget timeline shows USDT on Tron reopening inside the resumption schedule, which is also a reminder that the TRC-20 slice of any stolen basket is the slice issuers can still touch: Tether's 218,023 USDT freeze is standing evidence. Third, none of this week's four losses involved a TRON protocol — but two of them (a Safe module and a multisig allowlist) are patterns any TRON-native treasury should price before assuming the chain's low fees make it a smaller target.
What I'm Watching Next Week
- Whether anyone claims the Base vault — and whether the attacker moves on the ~$31.7M still sitting in it.
- Bitget's promised full incident report: the third-party vendor's name, the final recoverable amount, and the first recovered-funds figure from the 5%/5% bounty.
- NEAR Intents' detailed post-mortem — the return is complete, but the published technical account of the Omni bug is still pending.
- The scope of the MetaMask staking incident (validator count, ETH involved, access method) and ether.fi's node-operator details.
- Meter's recovery decision on its preserved-but-paused chain, and Duelbits' still-pending root-cause statement — both carried from prior weeks.
- Whether the multi-wallet drain campaign from two weeks ago picks up a second independent count or a named victim.
Sources
- Blockaid, PeckShield, CertiK, GoPlus Security and ExVul alerts (Oct 4) on the Base vault exploit; Metaverse Post and ThreatCluster reconstructions of the Safe allowlist sequence.
- NEAR Intents statements (Oct 1–2); Alex Shevchenko and Illia Polosukhin posts (Oct 2–3); Bitquery reconstruction (test withdrawals and five-drain timeline); ZachXBT tracing; CoinDesk, Cryptonomist, Cointelegraph.
- SlowMist alert (Oct 2) on the Aave v3 Loop Safe Module (~114.09 ETH); incident registry entry for FlashLoopAdapter (Oct 1, ~$305K).
- Defimon Alerts (Oct 3) on GoldPesa GPXHooks; The Crypto Times and Coinfomania; DeFiHackLabs PoC (PR 1288); on-chain reads via the hack registry (net 114,428.51 USDC).
- MetaMask user update (Oct 1); Lido governance forum exit notice; ether.fi statement (Oct 1); CryptoBriefing on Sentora Morpho vault flows; researcher on-chain analysis (0xKaden) of the reward redirection.
- Bitget Academy incident timeline, withdrawal-resumption schedule and Protection Fund replenishment notice; SlowMist and Mandiant interim reports (Sep 30); The Block, BleepingComputer; Bloomberg via DefiLlama proof-of-reserves.
- Chainalysis attribution assessment (Oct 1) via Finobird and aggregated reporting (Oct 3).
- Protos (Sep 29) on the D'CENT spread; ZDNet Korea via IoTrust; BroadChain and Cryptonomist coverage; D'CENT incident report (Sep 17).
- Drift/Velocity DFX launch announcement (Oct 1); CryptoSlate, The Block and KuCoin flash coverage; Tether April 2026 support plan.
- DYORSWAP on-chain reconstruction and compensation updates (Sep 27–30); GIWA official denial; Protos and Cointelegraph; SlowMist fraud classification.
- THORChain and Bitget statements on the blocking request; SlowMist TrackAgent (Sep 30) on Cow Protocol/Chainflip automation; NEAR Intents on >$50M stopped transfers; AMLBot tracing (~$343M dormant).
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Why is the weekly total only ~$10.2M after last week's ~$408M?
Because the total counts money that actually left during the window, and this week only four incidents produced outflows: the Base vault (~$6M), NEAR Intents (~$3.8M), FlashLoopAdapter (~$305K) and GoldPesa (~$115K). Weekly series are volatile by construction — last week's figure was one exchange breach. The smallest week this site has recorded remains W4's ~$5.1M.
NEAR Intents got all its money back. Why is it still counted as a $3.8M loss?
This site's loss series counts outflows during the window, and roughly $3.8M left the treasury on October 1; the full return on October 2 is tracked in the recovery column rather than netted out of the loss. That convention keeps the loss series comparable week to week and keeps recoveries visible as recoveries — the same way the Cosmos Hub ATOM sweep is recorded as containment, not a smaller Neutron loss.
Is the ~$2M fake GIWA scam in the weekly total?
No. The bridge scam occurred September 26 and drained users who were tricked into bridging to a counterfeit chain. Hack-tracking databases classify it as a phishing loss; SlowMist's own ledger files it as fraud rather than a hack. That classification split is why the reimbursement progress runs as a development card here — the loss series covers protocol and platform exploits, so the ~$2M appears in neither week's total.
How much of the Bitget haul is frozen?
Tracked freezes total roughly $840K — about 0.2% of the $387.5M stolen. The components: Circle's 99,990 USDC and Tether's 218,023 USDT blacklisted at the exploiter wallet on September 25 (roughly $318K combined, carried from last week), plus roughly $503K NEAR Intents froze mid-execution, per BlockSec's tracing summary. Enforcement freezes are excluded from the loss total under this site's standing convention.
Why do incidents from before September 28 appear in this review?
As developments, not losses. The D'CENT spread (Sep 29 update to a Sep 15–20 event), the fake GIWA reimbursements (scam occurred Sep 26), the Bitget resumption and reports (consequences of the Sep 24 breach), and the THORChain dispute (requested Sep 26) are all dated to their in-window development days, and none of them enters the weekly loss total, which counts only money that left during this window.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.