Wallet Safety Intelligence — Week of August 31 – September 6, 2026

This is our structured weekly briefing, answering five fixed questions so weeks can be compared and a picture can build over time. Each answer is limited to 1–2 paragraphs, stays inside the cited sources, and separates confirmed facts from judgment.

This edition covers the week of August 31 – September 6, 2026.

1. Threats: What Is the Overall Wallet Threat Posture This Week?

The posture moved outward, away from the key itself. The week's largest event — roughly 3,996 BTC (~$320M) leaving the Liquid Network federation wallet on September 6 — involved no stolen seed, no malicious approval and no compromised signer; it came from the peg-out path of a settlement layer used by dozens of exchanges. Around it sat the same pattern at smaller scale: a shipping vendor's retained records re-exposing 80,689 hardware-wallet customers (Trezor, September 4), a governance proposal disguising a treasury takeover as a migration (Olas, 40.196 ETH at risk), and browser extensions that can drain EVM, Solana and TRON wallets after being installed as something else (Socket, 16 extensions).

The week's signal, in one line: the weakest link is increasingly a dependency you did not choose — a federation, a logistics partner, an extension store, a governance process, a clipboard.

2. Losses: What Were the Realized Losses and the Typical Cases?

Tracked direct losses were approximately $321.8M, but the distribution makes that number nearly meaningless as a trend: about 99.5% came from the single Liquid Network withdrawal. The rest of the window was small and conventional — Notional Finance at $1.73M from an unsafe uint128 downcast in a legacy V1 escrow contract, and Reddio's RedSonic Vault at 9.25 ETH from a permissionless asset registration plus flash-loan share inflation. Excluding Liquid, the week's tracked total is roughly $1.8M, about 77% below the prior week.

The typical case split cleanly in two. On the protocol side: accounting and type-handling bugs in old code — a liability of -2^128 truncated to zero, a collateral balance counted twice. On the user side: trusted identities borrowed for a moment — a CoinDesk employee impersonated in a meeting invite, a counterfeit Ledger app in an update prompt, a verified account posting a scam link. Neither requires your key to be weak; both require you to be busy.

3. Scams: What New Mechanics Appeared, and How Do You Recognize Them?

• Recognition — the verification step that is the theft: a platform blocks your withdrawal, then asks you to connect your main wallet and approve a small test transaction. That approval is the drain. (Ukraine's dismantled ring ran this at up to $1M a month across 20+ countries.)
• Recognition — the address that changes after you copy it: clipboard hijacking (EggJagger) replaces a copied address at paste time, so checking the source does not help. Confirm large destinations through a saved address book or a second channel.
• Recognition — borrowed authority: an impersonated journalist, a compromised founder account, an emoji from a bigger name. A verified badge confirms identity, not intent — check the contract and the domain yourself.
• Recognition — the update that installs a wallet app: a fake Google API Connector update delivered NetSupport RAT and counterfeit Ledger applications. Wallet software is installed from the vendor's own site, never from a link.
• Recognition — the routine migration: a governance proposal touching treasury control, framed as housekeeping. Verify the destination address independently before voting.

4. Operations: What Should Ordinary Users Actually Do This Week?

Five concrete actions. (1) Inventory your bridged and federated assets — if you hold L-BTC or anything issued against a reserve you do not control, decide now how much of your balance you want sitting there while the network is paused. (2) Audit browser extensions and wallet applications: remove anything wallet-adjacent you cannot account for, and if a seed could have been exposed, migrate to a fresh seed — removal is not remediation. (3) Empty legacy contract positions: Notional's loss came from a superseded V1 escrow that still held a withdrawable balance, so migrating off deprecated versions is a security action. (4) Keep endpoint hygiene current, because clipboard hijacking defeats every address-checking habit you have. (5) Make test transfers non-negotiable — with TRON energy rental quoted near 21 SUN per unit, a standard 65,000-energy USDT transfer costs about 1.37 TRX on the cheapest provider, so the cost argument against testing a new address no longer exists.

None of these requires new purchases. Four of the five are about removing exposure you already have rather than adding protection you do not.

5. Outlook: What Deserves Attention in the Week Ahead?

Watch items: (1) whether the bitcoin taken from Liquid is returned in full after the Elements fix is deployed. Post-publication update (September 8): after Blockstream confirmed in a signed on-chain message that its bridge nodes were patched, the actors returned 3,400 BTC (roughly $269M, about 85%) on September 7, in Bitcoin block 965,950; roughly 598.5 BTC (about $47M) remains in their address, so the watch item is partially resolved — what remains is the outstanding balance, the peg-out restart, and the outstanding post-mortem; (2) whether other federated or bridged assets publish reserve attestations in response; (3) the Harmony wind-down cut-off of September 10 for contracts still holding funds; (4) whether Trezor ships anonymous delivery and whether other hardware-wallet vendors audit their logistics partners' data retention; (5) continued Coldcard laundering — 82% of the stolen bitcoin is still static, and the pace of CoinJoin activity is the best available read on attacker confidence.

These are watch items, not predictions: we flag what could move wallet risk and why, and we will check next week which of them materialized.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.