Web3 Security Weekly Recovery & Enforcement Update — September 28–October 4, 2026

Recovery Ledger: The First Full Return

The week's recovery story has no precedent in this column. NEAR Intents lost roughly $3.8M of USDT from a BNB Chain treasury on October 1 through a bug in its Omni deposit/withdrawal layer — Bitquery's reconstruction counts two test withdrawals the day before, then five withdrawals over roughly six hours. The team patched within about an hour; the funds ran through KuCoin and a Bitcoin bridge, where ZachXBT traced about three-quarters of the value. On October 2, general manager Alex Shevchenko posted the identification claim — 'We have identified you, sir' — three return addresses (Bitcoin, BNB/Ethereum, Solana) and a 48-hour deadline framed as the last window for responsible disclosure. The Bitcoin recovery wallet received about 34.59 BTC; by roughly 14:30 UTC on October 2 the full amount had been returned across the three addresses, an on-chain message attributed to the exploiter read 'we were in the wrong,' and the investigation was closed with a request that future findings use bug bounties. Two honest caveats: the team had already pledged full compensation, so the return primarily spares NEAR Intents' own balance sheet rather than users' — and the playbook selects for recoverable attackers, which this one apparently was. The detailed post-mortem remains unpublished.

Issuer Freeze Ledger

Tracked freezes in the Bitget case now total roughly $840K, about 0.2% of the $387.5M stolen — up from 0.08% after the first on-chain freeze: Circle's 99,990 USDC and Tether's 218,023 USDT blacklisted at the exploiter wallet on September 25 (roughly $318K combined), plus roughly $503K NEAR Intents froze mid-execution and is holding for legal process. The laundering rails kept moving regardless: SlowMist documented fully automated conversion — scripts create Cow Protocol orders whose recipient addresses are pre-staged Chainflip deposit contracts, converting stolen assets to BTC without a human in the loop — and THORChain, having formally declined Bitget's request to refuse service to attacker addresses, processed roughly $6.3M of ETH into 75.2 BTC. Against the outflow, AMLBot's tracing puts the vast majority of the haul — roughly $343M — still dormant across 13 identified attacker wallets, consistent with the holding patterns recorded after previous DPRK-linked thefts. Bitget's Recovery Bounty Program (5% of frozen, 5% of recovered, using Bybit's LazarusBounty channel) remains live with no published recovered-funds figure. The same week offered the counter-example: NEAR Intents says it stopped more than $50M of related cross-chain transfer attempts — an operator-run rail can act in minutes; a permissionless one becomes the routing table of last resort.

Enforcement and Attribution

No new seizure, forfeiture or charges landed inside this window — a quiet enforcement week, stated plainly. The attribution record moved instead: Chainalysis published its attribution assessment on October 1 — wide reporting followed October 3 — attributing the Bitget breach to North Korea-linked actors, based on laundering patterns (cross-chain swaps into Bitcoin) and wallet overlaps with previously attributed campaigns; with the breach included, the firm assesses 2026 DPRK-linked theft above $1B. The tiers still matter: this is an analyst assessment, Bitget has not confirmed it and its CEO had called the indicators preliminary, and no government body has acted on it. Mandiant and SlowMist's September 30 reports address the intrusion path — a zero-day in third-party security products, earliest activity August 31 — not the attacker's nationality.

Refund and Compensation Tracker

The compensation market got two new data points. Drift (relaunched as Velocity) opened DFX recovery claims on October 1 — exactly six months after the April 1 exploit cost users $295.4M: one DFX per verified dollar lost, a pool of roughly 3.11M USDT, an initial redemption rate of about 0.0104 USDT per DFX (about 1.04% per dollar), burn-on-redeem and final, future funding from 60–90% of Velocity's daily net revenue plus commitment ceilings of up to $127.5M from Tether and $20M from partners, and a January 1, 2028 claim deadline after which unclaimed DFX burns. DYORSWAP, compensating the fake GIWA bridge scam, has paid out more than 200 ETH from its treasury, with 40% reimbursement for sub-5-ETH depositors and case-by-case review above — where some addresses are being screened as possibly tied to the operators. And Bitget's own ledger closed the loop: withdrawals fully resumed by October 2 (BTC Sep 28, ETH Sep 29, USDT incl. Tron Sep 30, the rest plus fiat and P2P Oct 2), the User Protection Fund was replenished above $300M by September 30, inside the one-week commitment — and the 47th proof-of-reserves snapshot (September 29) shows a 131% reserve ratio across 19 covered assets. Bloomberg, citing DefiLlama, recorded roughly $463M of net customer outflows in the 24 hours into September 29, the largest single-day figure in that series — users priced the incident even as the fund covered it.

Unrecovered and Unaddressed

The standing pool grew by one unowned problem: the Base vault attacker holds ~1,783 wstETH (~$6M) with roughly $31.7M still sitting in the vault, and no team has claimed ownership — there is no counterparty to negotiate with, no contract to pause, and no statement to wait for. New and small: GoldPesa's ~$115K sits with the exploiter (converted and bridged via Solana toward BNB Chain), as does FlashLoopAdapter's ~$305K, with neither project having published a statement. Carried without new movement: more than 63,000 ETH in Bitget-exploiter-linked wallets; the Neutron attacker's ~$1.8M Ethereum balance; the D'CENT operator's 1,440,291 XRP; the Liquid Network's ~598.5 BTC; and the Coldcard exploit's remaining ~97%. The base rate this column keeps recording was broken this week — in the good direction: consensus-level containment was not needed, because identification plus publicity plus a deadline produced the first complete return on record. It worked because the attacker was identifiable and not state-backed; the $343M of dormant Bitget funds is the same ledger's other column.

What This Means for Buyers of Security

Three implications. First, response capability is now measurable in hours, not weeks: NEAR Intents' detection-to-patch-to-recovery cycle ran inside 36 hours, and every component of it — monitoring, tracing, an identification claim, public return addresses — is purchasable or preparable in advance. Second, compensation has become a product with terms: DFX claim tokens give victims a choice between cash-now at ~1% and pool-growth-later, with a burn mechanism and an expiry — which means recovery terms deserve the same diligence as the audit report, before the incident, not after. Third, unnamed ownership is unrecoverable ownership: the Base vault's $31.7M cannot be protected, negotiated or frozen-in-place by anyone because no one will claim it — if you run a vault, the world knowing who you are is part of the security budget.

Watch Items

• The Base vault's ~$31.7M: attacker movement, and whether any owner ever claims the contract.
• Bitget's full incident report — the vendor's name, final accounting, and the first recovered-funds figure from the bounty program.
• NEAR Intents' detailed post-mortem on the Omni bug.
• Whether further issuer freezes land on the Bitget haul before the dormant $343M starts moving.
• Drift's redemption rate trajectory as Velocity revenue enters the pool daily at 00:00 UTC.
• Carried: Meter's recovery decision, Duelbits' root-cause statement, and a second count for the multi-wallet drain campaign.