Web3 Security Weekly News Review — September 28–October 4, 2026
A vault with no named owner lost $6M to a whitelist entry, a swap protocol got its $3.8M back in 36 hours with a public ultimatum, and the exchange breached for $387.5M finished…
Articles tagged Bridges
A vault with no named owner lost $6M to a whitelist entry, a swap protocol got its $3.8M back in 36 hours with a public ultimatum, and the exchange breached for $387.5M finished…
The series snapped back 40x after the Bitget week — and every dollar of it sat in the glue: an allowlist, a Safe module, a hook's shared unlock, a deposit rail. Not one core…
A $20K governance vote took over a chain's applications, an exchange lost $387.5M without a single private key being stolen, and the costliest month of 2026 got that way in seven…
One exchange breach carries 95% of the largest weekly loss this site has recorded — and the same week produced the cheapest large theft yet: a $20K governance vote.
Two signing keys drove the week's damage — a prepared list worked for six days, and a bridge minted from a compromised key — while the other failures shared one shape, a check…
A quiet dollar week with a loud pattern: three unbacked-mint failures on Bitcoin wrappers in six days, two settlement-layer checks that were never made, plus Tether's $39.27M…
The smallest dollar week this site has recorded, on a net basis down 91% — but three unbacked-mint failures in six days, and two settlement-layer checks that were never made, make…
A quiet dollar week with a structural alarm: three wrapper backing failures in six days, and a freeze pipeline operating at nearly eight times the week's crime total.
The third unbacked-mint failure in six days — and the clearest demonstration that a wrapper's true loss ceiling is its exit liquidity, not its mint logic.
The largest Bitcoin-sidechain incident of the year defines the week: 3,998.5 unbacked L-BTC minted via a cache-key collision, pegged out within minutes, mostly returned on-chain…
A dual-basis report: the largest single event of the year ($320M gross, ~$272M returned) sits on top of a busy protocol tail (~$11.6M).
The week's theme is trust in computed verdicts: cached proofs, collided identifiers and forged claims all let a protocol accept something it should have checked.
The largest Bitcoin-sidechain incident of the year traces to a performance optimization from 2016 — cache keys built without length prefixes turned a speedup into a minting press.
10 events; ~$33.8M realized; two price-manipulation lending attacks define the week and the month — plus a chain rollback that reversed $111.2M.
9 whitelist-sourced events; ~$22.2M realized losses; a $8.5M governance takeover takes the headline while a shared-infrastructure bug spreads across six Cosmos EVM chains.
~$22.2M realized losses across 9 events; top-3 concentration 77%; the week's shape is governance and shared infrastructure, not classic key theft.
Governance becomes an attack surface, a shared-infrastructure bug spreads across six chains, and a silent patch process turns a known bug into a countdown timer.