Web3 Security Weekly News Review — September 7–13, 2026
This week's review covers September 7 – 13, 2026: 13 publicly reported events and roughly $5.1M in realized losses — still the smallest weekly dollar figure this site has recorded. The dollar count undersells the week. The defining story is thematic: the unbacked-mint failure class that drained the Liquid Network last week appeared twice more — Nomic (~$3.1M, a flaw unnoticed for months) and Symbiosis (billions in face-value syBTC minted, only ~$336K realizable). Three Bitcoin-backed wrapper systems failed on the same basic trick in six days.
Enforcement was the week's other headline: Tether froze $39.27M in USDT across ten TRON addresses linked to the Xinbi Guarantee marketplace — the issuer's largest single action against a Telegram escrow network this year. Follow-ups from last week also landed: the Liquid Network restarted September 10 and SlowMist published its full analysis September 11. No confirmed user-level losses on TRON this week; the freeze is enforcement, not a loss.
The spread of the unbacked-mint pattern: Nomic's nBTC wrapper was exploited for ~$3.1M on September 9 through a flaw that had gone unnoticed for months, and on September 11 Symbiosis' BridgeV2 minted roughly 46.1 billion syBTC (~$46.1B face value) without backing — though thin liquidity let the attacker realize only ~$336K. That makes three Bitcoin-wrapper unbacked-mint failures in six days, after Liquid's $320M on September 6.
- Realized losses~$5.1Mquietest dollar week on this site
- Largest event~$3.1MNomic unbacked nBTC mint
- Enforcement$39.27MTether freeze, 10 TRON addresses
- Unbacked mints3 in 6 daysLiquid, Nomic, Symbiosis
Overview
Nine loss events, and no single one crossed $3.2M. But the structure of the week matters more than its size. Three Bitcoin-backed wrapper systems — Liquid, Nomic, Symbiosis — all failed within six days on the same basic trick: convincing a wrapper to print coins that were supposed to stand for real Bitcoin. The class has a name now, and every wrapper's backing-verification path is testable against it. Two more of the week's dollars belong to the same family of missing checks, one layer down at settlement: Chainflip's TRON route read a memo attached to a transaction its own validators had already signed as a fresh swap and paid six withdrawals twice (~$736K), and Splash's Cardano StableSwap let a 'tradable' reserve go negative without ever requiring it to stay positive (~$503K).
The enforcement side was anything but quiet. Tether's September 8 freeze immobilized $39.27M in USDT across ten TRON addresses attributed by MistTrack to Xinbi Guarantee — a Telegram-based escrow marketplace with roughly $24.2B in processed volume that the UK sanctioned in March. And the Liquid Network's restart (September 10) and SlowMist's full post-mortem (September 11) closed last week's chapter with 598.5 BTC still outstanding.
The 13 Stories
Symbiosis BridgeV2 unbacked syBTC mint ($46.1B face; ~$336K realized)
Blockaid detected that Symbiosis' BridgeV2 contract accepted an unauthorized cross-chain message and minted roughly 2^62 raw syBTC — about 46.1 billion tokens at 8 decimals, a face value near $46.1B — to a fresh address on BNB Chain. The attacker converted only ~4.39 WBTC (~$336K) through Uniswap V4 on Ethereum before thin liquidity left the remaining ~46.1B syBTC stranded and worthless. Symbiosis halted BTC routes at 04:28 UTC September 11, secured ~15 BTC on a team multisig, and offered a 20% white-hat bounty open until September 13.
Source: Blockaid alert; Symbiosis statements; Delta Incident Archive; Bitcoin.com
Nomic unbacked nBTC mint (~$3.1M)
Nomic — a Bitcoin interchain protocol — was exploited via an unbacked cross-chain mint, with estimated losses of ~$3.1M. Reporting indicates the underlying flaw had gone unnoticed for months, letting extra nBTC be minted against insufficient backing.
Source: DefiLlama hacks database; Approx Foundation analysis
Tether freezes $39.27M linked to Xinbi Guarantee — 10 TRON addresses
MistTrack detected 39,273,713 USDT frozen across ten TRON addresses, the largest holding ~$10.78M. The addresses are attributed to Xinbi Guarantee, a Chinese-language Telegram escrow marketplace that analysts estimate has processed ~$24.2B in volume and which the UK sanctioned with an asset freeze on March 26 — the first country to do so. The Block confirmed the figure through a source with direct knowledge. Tether's cumulative illicit-funds freeze total stands above $4.2B.
Source: MistTrack; The Block; TRM Labs / Elliptic research on Xinbi
Liquid Network restarts; SlowMist publishes full analysis — 598.5 BTC still outstanding
The Liquid Network restarted September 10 on Elements v23.3.4, which patches the rangeproof cache-key collision with proper length prefixes — four days after the $320M mint drained ~95% of federation reserves. SlowMist's September 11 analysis confirmed the attack chain and fund flows: ~3,400 BTC (~$272M) returned to the peg wallet, ~598.5 BTC (~$48M) still attacker-held, with the attacker continuing to demand a 10% bounty via OP_RETURN while Blockstream maintains its no-ransom position.
Source: SlowMist analysis (Sep 11); Liquid Federation statements; CoinDesk
Chainflip TRON memo exploit ($736,442) — six withdrawals paid twice, network paused
Chainflip's TRON settlement layer reads swap instructions from the memo field of a transaction reaching its vault — including transactions its own validators had already signed. Between 01:44 and 03:10 UTC on September 12 an attacker resubmitted a validator-signed fetch transaction carrying a malformed memo of their own; the network read that as a separate swap, classified it as failed and issued a refund, so six liquidity-provider withdrawals were paid out twice. Eight attempts over about ninety minutes, starting small and roughly doubling each round, produced unauthorised payouts totalling 736,442.17 USDT. A separate user swap of 115,654.41 USDT could not be paid and is still sitting in the vault. Chainflip paused the network and said in its September 13 incident report that impacted users would be made whole, without yet saying how the compensation is funded.
Source: Chainflip incident notice and root-cause post (Sep 12-13); The Crypto Times
Splash Cardano StableSwap drained — 2,424,778 ADA (~$503K), OADA holders stranded
Two transactions at 14:53 UTC on September 13 removed 2,434,648 ADA and 1,988,222 OADA from Splash's ADA/OADA StableSwap pool on Cardano. Net of the attacker's 9,870 ADA deposit, 2,424,778 ADA left the pool — roughly $503,000 at that day's price; the OADA is deliberately not valued, because the same actor went on to empty the other OADA venues, leaving no market to realise it at par. The pool's validator computed a 'tradable' reserve by subtracting accrued fees from real balances, never required that number to stay positive, bounded fee changes only from below, and did not enforce swap direction — so swaps kept executing after the tradable ADA reserve went negative. The pool was left holding 10 ADA against about 1.44M OADA. Optim Finance, which issues OADA, paused its protocol and withdrew remaining liquidity the same day, and OADA has no protocol-level redemption — so holders have no exit route.
Source: Splash incident report; Optim Finance updates (Sep 13); CryptoSlate
Cozy V2 exploit (~$163K)
Cozy V2, a protection-market protocol on Optimism, was drained of 163,326 USDC.e (~$163K) in a single transaction. The attacker submitted false YES resolutions to the UMA optimistic oracle backing its coverage markets; nothing disputed them, and Cozy's trigger process paid out without independently verifying that a covered failure had occurred. The funds were bridged out within 13 minutes.
Source: Blockaid monitoring; DefiLlama hacks database; on-chain transaction reconstructions
Zentra Finance rounding error (~$140K)
Zentra Finance on Citrea was exploited through a rounding error for approximately $140K.
Source: DefiLlama hacks database
Dominion private-key compromise (amount unreported)
Dominion on Solana was hit by a private-key compromise exploit; the loss amount has not been reported and remains unconfirmed.
Source: DefiLlama hacks database
BeatXswap spot-price manipulation (~$78K)
BeatXswap on BSC was exploited via spot-price manipulation for approximately $78K.
Source: DefiLlama hacks database
ether.fi Liquid arbitrary external call (~$43K)
ether.fi Liquid on Ethereum was hit by an arbitrary-external-call exploit with estimated losses of ~$43K.
Source: DefiLlama hacks database
Pocket Bitcoin support-infrastructure breach — 5,411 customers
Swiss non-custodial Bitcoin service Pocket Bitcoin disclosed that a sustained cyberattack against its customer-support infrastructure exposed information associated with 5,411 customers. No seed phrases or funds were reported affected.
Source: Pocket Bitcoin disclosure
WealthManagementV2 private-key compromise (~$26K)
WealthManagementV2 on BSC was exploited via private-key compromise for approximately $26K.
Source: DefiLlama hacks database
Key Signals
| Signal | Reading |
|---|---|
| Loss trend | ~$5.1M realized — still the quietest dollar week on this site; net basis vs last week's ~$59.6M is -91% |
| Top pattern | Unbacked mint on Bitcoin wrappers: 3 failures in 6 days (Liquid, Nomic, Symbiosis) |
| Second pattern | Settlement-layer checks that were never made: Chainflip's TRON memo (~$736K), Splash's reserve domain (~$503K) |
| Largest realized event | ~$3.1M (Nomic); Symbiosis' $46.1B face-value mint realized only ~$336K |
| Enforcement | $39.27M Tether freeze on 10 TRON addresses (Xinbi) — immobilized, not lost |
| TRON activity | 1 major issuer freeze; no confirmed TRON-user losses |
| Biggest watch item | Whether other wrapped-asset systems audit backing-verification paths |
TRON Footprint
| Item | On-chain footprint | Status |
|---|---|---|
| Tether freeze, Xinbi-linked (~$39.27M) | USDT blacklist applied on-chain across 10 TRON addresses; largest wallet ~$10.78M; visible on TRONSCAN | Confirmed |
For Tron energy users: the Xinbi freeze shows the issuer-level freeze mechanism acting at scale on TRON, without touching other assets at the same addresses. The user-side takeaway is about counterparty risk rather than technique — funds parked with escrow-style services carry the service's whole enforcement exposure. As always, energy costs for a routine transfer are trivial next to one bad counterparty.
What I'm Watching Next Week
- Symbiosis' technical post-mortem and whether the 20% white-hat bounty (deadline September 13) was accepted or lapsed.
- Nomic's remediation and a loss figure that may revise from the current ~$3.1M.
- Dominion's confirmed loss amount.
- Whether the unbacked-mint pattern draws further attempts against other wrapped-asset systems — and whether the Liquid negotiation's remaining 598.5 BTC moves.
- How Chainflip funds its make-whole commitment, and whether Splash or Optim Finance finds an exit route for the OADA stranded behind an ADA reserve that was never required to stay positive.
- September's running total: at ~$327M gross for the month already, September is closing on the year's largest month.
Sources
- Blockaid community alert; Symbiosis official statements (Sep 11).
- Bitcoin.com News / Approx Foundation, 'Another Bitcoin Bridge Broke' (Sep 13).
- DefiLlama hacks database (Nomic, Cozy V2, Zentra, BeatXswap, ether.fi, Dominion, WealthManagementV2).
- MistTrack freeze detection (Sep 8); The Block confirmation; TRM Labs and Elliptic research on Xinbi.
- SlowMist, Liquid Network analysis (Sep 11); Liquid Federation restart statements.
- Pocket Bitcoin disclosure, September 2026.
- Chainflip incident notice and root-cause post (Sep 12-13); The Crypto Times; crypto.news.
- Splash incident report; Optim Finance updates (Sep 13); CryptoSlate.
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Why is the week's total so small after last week's $320M event?
Because the largest events of early September landed in the prior window: Liquid ($320M gross) fell on September 6, inside the Aug 31 – Sep 6 week. This week's realized losses (~$5.1M) are genuinely small — though the unbacked-mint pattern that spread this week is arguably the more important story.
Is the $39.27M Tether freeze a loss?
No. It is enforcement — funds immobilized at the token-contract level, recoverable in principle and tracked separately from exploit losses under this site's standing convention.
Why is Symbiosis counted at ~$336K when headlines said $46 billion?
$46.1B is the face value of syBTC minted without backing — a number the attacker could never realize because exchange liquidity was thin. Only ~4.39 WBTC (~$336K) actually converted on Uniswap V4. The mint succeeded; the exit failed. I count realized proceeds and report the face value as exposure.
Are these figures exact?
No. They are point-in-time estimates from the sources named on each card. The Dominion figure is unreported and excluded from totals; Symbiosis' final loss may revise with its post-mortem; Splash's 1,988,222 OADA is excluded from the dollar total because the venues where it could be realised at par had been drained. Event counts and share arithmetic are computed exactly from the list.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.