Web3 Security Weekly Recovery & Enforcement Update — September 21–27, 2026

Issuer Freeze Ledger

One freeze, and the week's clearest illustration of what issuer freezes can and cannot do. Circle blacklisted the wallet labelled 'Bitget Exploiter 8' at 05:00 UTC on September 25, immobilizing 99,990 USDC; Tether added the same address roughly seven hours later, freezing 218,023 USDT. Combined: about $318,000 — 0.08% of the $387.5M stolen. The shortfall is asset mix, not issuer speed: the attacker had already swapped roughly $170M of the stolen stablecoins into ETH, and trackers put more than 63,000 ETH in exploiter-linked wallets, beyond any issuer's reach. Bitget publicly thanked both issuers and launched a Recovery Bounty Program — 5% of the value of funds frozen and 5% of funds recovered through outside help — using Bybit's LazarusBounty initiative as a core channel, with a live dashboard tracking the attacker's addresses. The exchange has not disclosed how much its partners have frozen so far.

Scale context: this week's ~$318K is small against Tether's cumulative enforcement record — the T3 Financial Crime Unit has reported more than $450M frozen since 2024, and BlockSec's 2025 research counted 4,163 addresses blacklisted for $1.26B — but the Bitget case is the sharpest demonstration yet of the lever's structural limit. Freezes attach to tokens; a disciplined attacker leaves the tokens first.

Containment Ledger: The Cosmos Hub Sweep

The week's most aggressive recovery move was made by validators, not issuers. After the Neutron governance takeover, Neutron halted block production about five hours after the malicious vote executed — by which time roughly $1.96M had already bridged out. Cosmos Hub validators then halted their own chain, which was not itself exploited, for more than 24 hours (from block 33,086,740 on September 22 until 12:00 UTC on September 23) specifically to trap the attacker's remaining balance, and restarted on Gaia v28.3.0 with a one-time state change that moved 1,227,121 ATOM — about $2.2M — into a 4-of-6 validator multisig, held for return to affected users. The containment leaked at the seams: a THORChain refund of 168,990.9 ATOM reached the attacker after the restart and was moved to Osmosis and sold for roughly 266,841 USDC within hours. Neutron contributors had prepared a new binary by September 24 to restore the affected contracts to their previous code and administrators, with a post-mortem promised once the chain is back online.

Enforcement: The Capstone Forfeiture

A $84.2M US forfeiture became widely public on September 24–25, though most of it predates the window. The case: Capstone, a Montana payments company accused of operating as an unlicensed money transmitter in at least six states, had $79.11M seized from a Wells Fargo Securities account, $1.86M from a second Wells Fargo account, $2.06M from JPMorgan Chase and just over $1M in USDT across two crypto addresses — seizures executed September 14 under a complaint filed July 15 in the Eastern District of California. The Financial Times' reporting linked the case to Tether and Bitfinex through their banking relationship with EQIBank, the Dominica-based bank behind Capstone; the filing itself names neither company, and neither is charged. Tether confirms the EQIBank wire relationship and says its exposure is below 0.034% of group assets. Separately, a California woman received an 18-month sentence on September 24 for concealing $2.6M tied to a crypto criminal operation from the IRS — a reminder that the associates of crypto crime are charged independently of the principals.

Legal Watch: KelpDAO v. LayerZero

The April rsETH bridge exploit — 116,500 rsETH, about $292M — moved from a public dispute into a courtroom. Evercrest Technologies, KelpDAO's legal entity, filed a civil claim in British Columbia against LayerZero and co-founder Bryan Pellegrino, announced September 24–25. Kelp alleges LayerZero failed to disclose known technology risks and failed to prevent the compromise of its own verifier infrastructure, and says LayerZero reviewed and approved Kelp's bridge configuration in writing before the incident. The public record already establishes the intrusion's shape: LayerZero's May report confirmed an attacker socially engineered a developer on March 6, entered the RPC cloud environment, altered verifier nodes, and fed the forged message that released the tokens; a second attempted theft of 40,000 rsETH was blocked when Kelp paused contracts roughly 46 minutes after the drain. LayerZero blames Kelp's 1-of-1 verifier configuration as the single point of failure. Pellegrino called the claims meritless. Depositors were made whole by June; the case is about who bears the consequence, not whether users are repaid.

Refund and Compensation Tracker

The week's compensation story is an exchange with a fund large enough to mean it. Bitget states the entire ~$387.5M loss falls within its User Protection Fund — 5,500 BTC, worth more than $464M at the time of the incident — with user balances unaffected, deposits and trading live throughout, and withdrawals returning in phases: BTC from 08:00 UTC on September 28, ETH on September 29, USDT on September 30, and all remaining assets, fiat and P2P on October 2. Duelbits says user funds are safe and the platform is rebuilding deposit and withdrawal servers before relaunching, but has made no figure-specific commitment. Payy has paused all transactions and committed to following incident-response guidelines without naming a compensation mechanism; the stolen funds were users' non-custodial deposits. Neutron's restore plan promises returns to users after the restart, with the multisig ATOM held for that purpose. SingularityNET has published no post-mortem, no compensation statement and no recovery action within the window.

Unrecovered and Unaddressed

The standing pool this week is dominated by what the freeze ledger could not touch: more than 63,000 ETH in Bitget-exploiter-linked wallets (plus the unconverted remainder across chains), against the ~$318K frozen — with the bounty program and Mandiant/SlowMist tracing as the active levers. The Neutron attacker retains roughly $1.8M in an Ethereum address and netted ~$266,841 from the leaked THORChain refund. Duelbits' stolen funds were consolidated in a single address holding ~2,234 ETH (~$6M worth). Meter's $2.3M was sold into market liquidity — diluted, not parked. Payy's 683 ETH sits unmoved across four fresh addresses. Carried forward without new movement: the D'CENT operator's 1,440,291 XRP, the Liquid Network's ~598.5 BTC, and the Coldcard exploit's remaining ~97% — against which the week's white-hat consolidation of 52.37 BTC (2.8% of the haul) under an OP_RETURN claim is a promise, not a recovery. The base rate this column keeps recording holds: consensus-level containment (this week's Cosmos Hub sweep) is the only mechanism that produced completed custody of stolen funds this week, and it required validators willing to stop a healthy chain.

What This Means for Buyers of Security

Three implications. First, the authorization layer above key management is now the dominant loss point — an exchange backend that could forge transactions cost more than every on-chain exploit of 2026 combined to that point, and 'are our keys safe?' is no longer the whole question; 'what else can trigger a transfer?' is. Second, governance security is application security: if your protocol lives on a chain whose DAO can reassign your contract admins, your audit scope has to include the chain's voting mechanics, quorum and expedited tracks. Third, containment is a capability you buy in advance — Cosmos Hub validators executed a fund recovery by stopping a chain that had not been attacked, and that only works where the validator set is small, coordinated and willing.

Watch Items

• Whether Bitget's phased withdrawal resumption holds to schedule (BTC Sep 28, ETH Sep 29, USDT Sep 30, everything else Oct 2), and the first frozen-funds number from the Recovery Bounty Program.
• Movement of the 63,000+ ETH in exploiter-linked wallets — and whether any further issuer freezes land before it mixes.
• Neutron's restart: whether the restore binary executes, whether the multisig ATOM reaches users, and what changes in expedited governance as a result.
• Duelbits' promised root-cause statement, and whether the platform returns with a confirmed mechanism.
• Meter's recovery decision, and any compensation plan for MTRG holders who absorbed the dilution.
• Whether the KelpDAO case produces early procedural rulings — and whether other exploited protocols follow the litigation route.