Web3 Security Weekly Recovery & Enforcement Update — September 14–20, 2026

Issuer Freeze Ledger

One batch, no names attached. Tether's contract blacklisted 15 TRON addresses holding a combined 3,313,462.02 USDT, with several of the largest frozen in the same TRON block at about 21:55 UTC on September 14; the largest single address held 1,134,712.62 USDT. Activity continued past the batch — one further TRON address was blacklisted at 01:18 UTC on September 15 while holding 310,449.66 USDT — for a two-day total of roughly $3.62M across 16 addresses. No Ethereum USDT freezes appeared in the same dataset, and Tether published no reason for the selections, so none of the wallets can be described as belonging to hackers, sanctioned entities or fraud operations without evidence that is not public. Tracing of the largest wallet shows repeated large inbound transfers from a single upstream TRON address (about 1.00M USDT on Aug 17, 503K on Aug 27, 545K on Sep 8 and 1.02M on Sep 9) — a lead, not an attribution.

Scale context is worth keeping in view: Tether's T3 Financial Crime Unit, run with TRON and TRM Labs, has reported more than $450M frozen since its 2024 launch, and earlier BlockSec research counted 4,163 addresses blacklisted during 2025 for $1.26B in USDT across Ethereum and TRON — and a separate 30-day stretch of the same tracker logged $514M across 370 addresses. This week's ~$3.62M is a routine batch by that standard. Last week's $39.27M Xinbi freeze was not extended in the data reviewed for this window.

Contested Recovery: The rsETH Race

The week's highest-profile exploit produced the month's strangest recovery picture. The attacker's transaction was broadcast to the public mempool; the searcher Yoink paid roughly 18.93 ETH (about $46K) to a block builder for priority and captured 2,900 rsETH at the top of block 25,980,525, moving 2,882.37 rsETH to a receiving address and swapping the residual 17.63 rsETH for about 18.95 ETH. The attacker's own transaction then failed in the same block. Kelp DAO paused the receiving address for 24 hours at 06:03 UTC on September 15 — a wallet-level action that blocks rsETH movement at the token level — and confirmed its contracts and rsETH backing were unaffected. That pause has expired.

What this means operationally: the tokens are traceable, the holder is identifiable, and there is no legal mechanism in this column's sources that compels a return. Expectation of a return is not a return, and it is not counted here as recovered. The $46K of builder fees and the ~18.95 ETH converted on-chain are gone from the claim regardless. The realistic levers are the issuer's pause authority, which has already been used once and lapsed, and negotiation — the same terrain as the Liquid Network's outstanding 598.5 BTC, where no movement has been reported since the September 11 SlowMist analysis.

Containment Ledger

Two chains bought containment with uptime this fortnight, and the invoices are visible. aelf brought public nodes and core front ends back on September 14 after an emergency shutdown of about seven days; the halt stopped further exploitation of malicious contract activity, and the price was a full week of staking rewards that will not be retroactively paid, no disclosed loss figure, and a root-cause report still unpublished. Radix's validators deliberately withdrew enough stake to break consensus — more than ten days without finality — because investigators concluded the vault flaw could be used against any vault on the network; transactions resumed September 11, and the contained loss stands at roughly $1.26M against what could have been the network's entire liquidity. Splash patched its validator within days, but containment there is a different animal: the pool holds 10 ADA against about 1.44M OADA and the patch restores no liquidity. Chainflip shipped its fix in software version 2.2.13 on September 15 and had swaps and quoting running again on every other chain by September 16, but held the TRON route back: every liquidity provider's TRON USDT balance is reset to zero on the books, with the pre-migration amount written to a separate on-chain record.

Refund and Compensation Tracker

Commitments were made this week; none were completed. Chainflip has promised to make affected users whole — including the 115,654.41 USDT swap still sitting unpaid in its vault — but has not selected or published a funding mechanism, and its zeroed provider balances are a bookkeeping step rather than a repayment. Optim Finance paused on September 13, removed remaining liquidity and stopped OADA-to-ADA swaps; its September 15 update said it was indexing the chain to compile a full accounting of affected addresses and assets, with no restored liquidity, redemption or timeline. Splash has patched the exploit path but announced no redemption route for OADA, which has no protocol-level redemption and now relies on pools that hold single- or double-digit ADA. D'CENT has made no compensation commitment while stating that losses beyond the XRP Ledger are unquantified — and the operator behind that drain is still holding 1,440,291 XRP (~$2.05M) in wallets the XRPL community has traced, 651,537 of it in a single address created on September 18, alongside 5,594,530 XRP that reached Ethereum through THORChain and 3,241,519 that went to one exchange. GalaChain filed an IC3 complaint, sent preservation and freeze requests to platforms and is tracing proceeds across four chains — remedial action, not refunds.

Unrecovered and Unaddressed

The standing pool this week: Nostra's ~$3.5M (no bounty, reconciliation unfinished), D'CENT's ~$16.7M (XRP Ledger leg only, with four more chains of exposure unpriced and 1.44M XRP still unmoved in the operator's wallets), GalaChain's ~$3.0M and Radix's ~$1.26M (both traced and partly liquidated into ETH), Splash's ~$503,000 plus the stranded OADA inventory, Flamincome's ~$345,900, Chainflip's $736,442.17, and — carried forward without movement — the Liquid Network's ~598.5 BTC, where Blockstream's September 11 statement reaffirmed that it will not pay a ransom. Blink Wallet has disclosed no figure at all, so it cannot yet be entered in the pool. The base rate this column keeps recording holds: outside freeze-assisted cases and public-pressure negotiated returns, recovery is rare and slow, and the two largest recovery events of the past month (Liquid's ~$272M and this week's contested rsETH) both depended on the holder choosing to give the money back.

What This Means for Buyers of Security

Three implications. First, module and keeper inventory is now a first-class audit item: the largest protocol-side loss of the week came from a wallet component the owner had already authorized, and the correct question for any treasury is not 'is our signer hardware?' but 'which addresses can move funds without our signers, and who can call them?'. Second, containment budgeting is real — a halting chain costs staking yield that no one refunds, and a patched contract without a liquidity plan leaves holders with no exit. Third, plan for the mempool: if your incident response assumes an exploit stays private while you patch, the rsETH race is the counter-example — a public transaction is a race, and the fastest participant need not be the attacker or a white hat.

Watch Items

• Whether the 2,882.37 rsETH is returned voluntarily, and whether Kelp re-imposes an address-level pause if it is not.
• Whether anything is frozen on the D'CENT side: 1,440,291 XRP is still sitting in the operator's own wallets, and the issuers of XRPL tokens collected in two further addresses have been asked to freeze the affected trust lines.
• Whether Chainflip's TRON route rejoins the rest of the network, and the first concrete statement on how make-whole is funded.
• Optim Finance's accounting result and whether any ADA liquidity or redemption path appears for OADA holders.
• Whether Tether attributes any of the 16 frozen TRON addresses, and whether the Xinbi action extends further.
• Any movement in the Liquid Network's 598.5 BTC — the oldest open item in this column.