This is our weekly review of wallet security: the incidents and disclosures that defined the past seven days, what actually happened in each case, and the one operation habit that would have helped. Every item is based on a disclosed source — security-firm reporting, official statements or on-chain investigators — and we label anything not yet confirmed.
This edition covers August 31 – September 6, 2026.
1. The Week at a Glance
~$320M
Withdrawn from Liquid Network
3,996 BTC, Sept 6
$1.73M
Notional Finance legacy escrow
integer overflow, Sept 4
80,689
Hardware-wallet customers re-exposed
Trezor update, Sept 4
15,000+
Machines isolated in botnet action
Sality / EggJagger, Sept 1
This week the largest number came from the least visible place. A settlement layer, not a wallet, produced the week's defining loss: roughly 3,996 BTC left the Liquid Network federation wallet on September 6, and exchanges that rely on it paused L-BTC deposits and withdrawals. Everything else sat in the normal range — a $1.73M legacy-contract overflow, a 9.25 ETH vault double-count, a hardware-wallet shipping breach that tripled in size when the vendor's logistics partner admitted it had not deleted old records. Against that, two enforcement results landed: Ukrainian police dismantled a drainer ring reaching 20+ countries, and a multinational action isolated more than 15,000 machines running a clipboard-hijacking payload.
Key takeaways
Your balance can depend on infrastructure you never chose: L-BTC holders were exposed by a federation wallet bug, not by anything they signed.
Data breaches age badly — a shipping partner's retained 2019–2021 records re-exposed 67,000 more hardware-wallet customers four years later.
Clipboard hijacking is still a live payment risk: malware that swaps a copied address defeats every other verification habit you have.
Enforcement is real but slow and partial: two takedowns this week, and neither removes malware already sitting on infected machines.
2. Story Review
#1Sep 6InfrastructureImpact High
Liquid Network: ~3,996 BTC (~$320M) withdrawn from the federation wallet via a SideSwap peg-out
Summary. Liquid Network confirmed that roughly 4,000 of the ~4,200 BTC held in its federation wallet were withdrawn on September 6 after 4,000 L-BTC was sent to SideSwap, a settlement platform authorised to handle peg-outs. Liquid said the Peg-out Authorization Key was not compromised and no other keys were; the network halted new transactions and disabled public bridge nodes while federation members worked to restore service. The reserve fell from about 4,200 BTC to roughly 200 BTC — approximately 95% of it. Independent analysis pointed to a range-proof cache flaw in Elements, the codebase behind Liquid's confidential transactions, with a merged fix reportedly absent from the tagged build running at the time. Actors claiming to be white hats messaged maintainers on-chain offering to return the funds once the bug is patched; no return had been recorded by 6:15 UTC on September 7. Post-publication update (September 8): after Blockstream confirmed in a signed on-chain message that its bridge nodes were patched, the actors returned 3,400 BTC — roughly $269M, about 85% of the withdrawal — to the federation wallet in Bitcoin block 965,950. Roughly 598.5 BTC, about $47M, remains in their address, with no published agreement on its status. Exchanges were notified and L-BTC deposits and withdrawals were suspended; other Liquid-issued assets were reported unaffected.
Commentary. For wallet users this is the uncomfortable category: nothing was signed, no seed was stolen, and balances still became uncertain — and most of the funds came back only because the actors chose to return them. If you hold a bridged or federated asset, understand who controls the reserve behind it — that is now part of your risk, alongside your own key hygiene.
Coldcard attacker moves 97.09 BTC (~$7.7M) in wave three; 82% of stolen funds still static
Summary. Galaxy Research tracked a third wave of movement from the Coldcard seed-entropy thefts: 20.5 BTC routed through THORChain into Ethereum on September 2, 15.48 BTC sent into a CoinJoin on September 5, and 61.12 BTC from ten vaults the following day — 97.09 BTC in total, worth about $7.7M. The attacker had created 293 two-of-two multisig vaults, one per victim holding, and has now fully drained the eleven largest; the next ten hold 30.81 BTC and vaults ranked 61 to 293 hold 33.77 BTC. Roughly 82% of the stolen bitcoin across all waves still sits at attacker-controlled addresses, with 18% moved into trades. The underlying thefts began July 30, exploiting a flaw that weakened the randomness Coldcard devices used to generate seeds; Coinkite confirmed the flaw and shipped fixed firmware.
Commentary. Two lessons in one chart. For victims, laundering is a schedule, not an event — traceability decays week by week. For everyone else: this theft started at seed generation, so the only real control is generating seeds on patched, established hardware and moving funds if your device was in the affected population.
Notional Finance: $1.73M drained from a legacy V1 escrow contract through an unsafe downcast
Summary. Attackers drained approximately $1.73M from Notional Finance's legacy Version 1 escrow contract — 1,658,524 USDC and 69,257 DAI. The preparatory transaction landed at 23:58 UTC on September 3 and the withdrawal completed at 00:01 UTC on September 4. According to CertiK, the attacker used two mintfCashPair() calls to create a -2^128 liability that an unsafe uint128 downcast in the free-collateral calculation truncated to zero, so the account was read as holding no active debt. SlowMist traced the root cause to the conversion helper used when balances are normalised to ETH. The stolen assets were swapped into 689.2 ETH and sent to Tornado Cash in batches of 100, 10 and 1 ETH. About $60,600 remained in the affected contract.
Commentary. Legacy contracts are the longest-lived attack surface in DeFi: this code was superseded, yet it still held a withdrawable balance. If you still have positions in a protocol's deprecated version, migrating is a security action, not a housekeeping task.
Trezor's shipping-partner breach grows from 13,689 to 80,689 customers
Summary. Trezor said on September 4 that shipping provider ShipMonk had informed it on September 2 that an earlier breach was far larger than first disclosed: an additional ~67,000 US customers who ordered between November 2019 and August 2021 had their names, emails, phone numbers, shipping addresses and order numbers exposed, bringing the total to 80,689. The first disclosure on August 13 covered 13,689 customers from a breach ShipMonk reported on August 10. Trezor said ShipMonk had ignored a data-retention policy requiring shipping details to be deleted after 90 days, despite written assurances that the data had been removed. Devices and wallet security were not affected, and Trezor said it is working toward anonymous delivery.
Commentary. Nothing about your keys leaked — but your name, phone and home address did, four years after purchase. That is a physical-security and spear-phishing exposure. Treat any message referencing a hardware-wallet order as suspect, and never confirm a seed phrase to anyone who contacts you first.
Ukraine dismantles a fake-investment drainer ring reaching victims in 20+ countries
Summary. Ukraine's National Police and Security Service said on September 1 that they had shut down a network of fake cryptocurrency investment platforms that drained wallets belonging to people in more than 20 countries, identifying 62 victims so far from Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada, Israel and others. A 25-year-old IT specialist organised the operation, recruiting more than 46 people and running offices in Kyiv and the surrounding region, with monthly turnover of up to $1M at its peak. The flow: Telegram ads led victims to a platform, deposits were met with manually simulated trading and fabricated balance growth, and withdrawal attempts were blocked pending a 'verification' step that asked the user to connect their main wallet and approve a small test transaction — which activated a wallet drainer. The sites also harvested passports, phone numbers, emails, logins, passwords and photographs. Investigators traced servers to the Netherlands, recovered victim and transaction records, and conducted 34 searches, seizing more than 100 computers and phones, 79 SIM cards, a GSM gateway and 15 vehicles.
Commentary. The test-transaction trick is the whole scam: a tiny approval that looks harmless is the actual theft. No legitimate platform needs you to connect your main wallet and approve anything to release a withdrawal.
FBI, DOJ and CrowdStrike disrupt the Sality botnet and its clipboard-hijacking payload
Summary. The FBI, the US Department of Justice and the Defense Criminal Investigative Service announced on September 1 a multinational operation — supported by CrowdStrike and partners in Bulgaria, Hungary and Romania — that disrupted the Sality botnet, isolating more than 15,000 infected machines. Active since 2003 and peer-to-peer in design, Sality's primary payload for the past eight years was EggJagger, a clipjacker that monitored copied cryptocurrency wallet addresses and silently replaced them with attacker-controlled addresses. CrowdStrike attributed at least 12.1 million rubles (roughly $150,000) in stolen crypto to EggJagger, with the associated portfolio peaking near 147 million rubles (about $1.35M) in January 2025. CrowdStrike's counter-adversary team used the botnet's peer lists against it, inserting sinkholes to cut machines off from operator tasking.
Commentary. Clipboard hijacking defeats address verification: you check the address, and the address changes after you copy it. CrowdStrike was explicit that disruption is not remediation — malware already installed stays active until removed. Keep endpoint protection current, and for large sends confirm the destination through a second channel.
Fake Google Docs invites and counterfeit Ledger apps: 16 malicious browser extensions found draining EVM, Solana and TRON wallets
Summary. Security firm Huntress reported on September 1 that attackers impersonated senior CoinDesk staff on X, sending victims Google Docs 'meeting invitations' containing malicious code, with malware hosted on GitHub and counterfeit Claude.ai pages promoted through Bing search ads. Mac users were pushed toward Atomic macOS Stealer, which targets browser passwords, encrypted wallet data and Telegram files; Windows users were shown fake Google API Connector updates that installed NetSupport RAT and counterfeit Ledger hardware-wallet applications. Associated malware families MacSync and SectopRAT were reported to steal cookies, saved passwords, seed phrases and payment card data. Separately, Socket identified 16 malicious Chrome and Edge extensions capable of draining EVM, Solana and TRON wallets.
Commentary. Two habits carry most of the weight here: install browser extensions only from a vetted shortlist and re-audit them periodically, and never install wallet or 'connector' software from a link in a message. Counterfeit Ledger apps are designed to harvest a recovery phrase you would otherwise never type.
Reddio's RedSonic Vault: 9.25 ETH drained by double-counting the same stETH twice
Summary. Blockchain security firm ExVulSec traced a September 5 exploit that drained 9.25 ETH from Ethereum's RedSonic Vault in a single transaction. The vault's registerErc20 function had no access restriction, so the attacker registered stETH as a second share class (rsvstETH) drawing on the same underlying stETH balance that already backed rsvETH. After flash-loaning 1,139 WETH from Balancer, the attacker deposited 1,130 ETH for close to 99% of outstanding rsvETH, added 9.34 stETH to inflate the share price without minting new shares, then redeemed 1,139.5 ETH and repaid the loan. The exploit contract self-destructed on completion, and the recovered stETH was swapped for ETH on Curve.
Commentary. Small in dollars, textbook in structure: share price read from a raw balance, plus a permissionless registration path. Before depositing into a vault, ask what the share price is derived from and who can register new assets into it.
Olas faces a malicious governance proposal disguised as a treasury migration, 40.196 ETH at risk
Summary. A malicious governance proposal targeting Olas, formerly Autonolas, put about 40.196 ETH (roughly $100,000) of treasury funds at risk. The attacker used the ENS name 'autonolas-deployer.eth' to make the proposal look like a routine treasury ownership migration, while executing it would have transferred control to an attacker-controlled contract. The community had roughly three days to reject it.
Commentary. Governance is an attack surface with a countdown timer. If you hold governance tokens, delegate to someone who actually reads proposals, and treat any 'routine migration' proposal touching treasury control as requiring independent verification of the target address.
Summary. Base co-founder Jesse Pollak warned that a compromised third-party application connected to his account posted scam content on his behalf. In the same cluster of incidents, the X account of Neuralink executive Shivon Zilis was used to promote the SLINK memecoin; an emoji response from Elon Musk made the post appear legitimate and fuelled buying. Reporting noted four distinct scam incidents surfaced within a twelve-hour span in the first week of September.
Commentary. A verified account is not proof of a legitimate link, and an influencer's emoji is not an endorsement. Check the token contract and the platform domain yourself before acting on anything promoted in a feed.
Ledger faces a class action over its 2023 breach; Harmony begins a mainnet wind-down
Summary. Ledger is facing a class-action lawsuit alleging it downplayed a December 2023 data breach — separate from a 2020 breach that exposed roughly 270,000 customers. The suit claims the exposed data was later used in social-engineering attacks that stole crypto, and that Ledger failed to disclose the incident in time. Separately, Harmony began shutting down its mainnet: a final snapshot will trigger an automatic ONE airdrop to Ethereum addresses, and smart contracts must be exited by September 10.
Commentary. Two practical deadlines: if your contact details were in any hardware-wallet vendor breach, assume targeted social engineering is permanent; and if you hold funds in a contract on a chain that is winding down, exit before the cut-off — an airdrop is not a substitute for positions left behind.
Context: annual losses, a falling drainer total and rising per-victim severity
Summary. DeFiLlama data cited this week put total crypto losses between September 2025 and September 2026 at $1.732B, with first-half 2026 theft and fraud losses above $1B against $2.3B in the first half of 2025. Scam Sniffer figures cited in a September 4 analysis show wallet-drainer phishing losses fell 83% year over year, from $494M in 2024 to $83.85M in 2025 — while the average loss per victim rose as attackers shifted toward 'whale hunting', including a $50M address-poisoning loss in December 2025 and a $12.25M loss in January 2026. Security firm Genians separately reported that the North Korean group Kimsuky is using AI to improve its operations.
Commentary. Read the two trends together: fewer victims, larger individual losses. Mass-blast phishing is being replaced by targeting, which means the value at stake in your single decision to verify an address in full is going up, not down.
Six of the twelve items this week are not attacks on keys at all — they are attacks on the layers around them: a federation wallet, a shipping vendor's database, a browser extension store, a governance process, a clipboard, a social feed. That is the pattern worth carrying forward. The defenses that mattered were correspondingly boring: verify a destination through a second channel, keep unused legacy contracts empty, re-audit extensions, exit deprecated contracts, and treat any unsolicited 'verification' step that asks you to connect a wallet as the theft itself.
As always: if an incident in this review is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.
Frequently Asked Questions
Was my wallet affected by the Liquid Network incident?
Only if you hold L-BTC or another Liquid-issued asset. Liquid said the withdrawal came from the federation wallet that backs those assets, not from individual user wallets, and that the Peg-out Authorization Key was not compromised. Exchanges were notified and suspended L-BTC deposits and withdrawals while the network was paused. Other Liquid assets were reported unaffected.
How do I protect myself from clipboard-hijacking malware?
Keep your operating system and endpoint protection current, avoid installing wallet software from links in messages, and for large transfers confirm the destination address through a second channel entirely — a saved address book entry or a voice call — rather than trusting what you pasted. CrowdStrike noted that disrupting a botnet does not remove malware already installed on a machine.
Should I stop using a hardware wallet after the Trezor shipping breach?
No. Trezor said devices and wallet security were not affected; what leaked was contact and shipping data for 80,689 customers, which raises phishing and physical-security risk. Never enter a recovery phrase into any app or site that contacted you first, and treat messages referencing a hardware-wallet order as hostile until verified.
What is a 'peg-out' and why did it move $320M?
On a sidechain or federated network like Liquid, a peg-out is the process of converting a network-issued asset back into the underlying bitcoin and releasing the reserved coins. Liquid said roughly 4,000 L-BTC was sent to SideSwap's authorised peg-out service and about 3,996 BTC left the federation wallet; the network was paused and public bridge nodes were disabled while federation members responded.
This article is based on public data and official disclosures. Figures were last reviewed on September 07, 2026. Values change with network conditions; always verify against the primary source before making decisions.
Liquid Network's own incident report (September 8, 2026), with The Block, Bitcoin Magazine and Decrypt: recovery of 3,400 BTC after the bridge exploit, the on-chain negotiation and the block 965,950 return.
Liquid Network's own incident report, CertiK's Notional Finance analysis and ExVulSec's RedSonic Vault analysis (September 1–7, 2026): the week's confirmed drains.
Liquid Network's own statements and Blockstream's incident status page (September 6–7, 2026): federation wallet withdrawal, paused network, reserve reduction.
International Business Times (citing Galaxy Research, September 7, 2026): Coldcard wave-three fund movements, vault structure and remaining balances.
CertiK's and SlowMist's own analyses (September 4–5, 2026): Notional Finance integer-overflow exploit and fund routing.
Trezor's own disclosure (September 4, 2026): Trezor and ShipMonk breach expansion to 80,689 customers.
Ukraine's National Police and SBU joint statement (September 1, 2026): action against fake investment platforms.
CrowdStrike's own disclosure and the FBI, DOJ and DCIS announcement (September 1–2, 2026): Sality botnet disruption and EggJagger clipboard hijacking.
Huntress's and Socket's own advisories (September 1, 2026): fake Google Docs and Claude.ai campaign, counterfeit Ledger apps, 16 malicious browser extensions.
Olas's own governance record, the affected account holders' own notices, DeFiLlama's tracker and Genians' report (September 5, 2026): Olas malicious governance proposal; the compromised accounts of Jesse Pollak and Shivon Zilis.
Harmony's own wind-down notice and the Ledger class-action filing (September 6, 2026).
OSW
The OpSecWallet Research Team
We are an independent research desk focused on wallet security and safe on-chain operation. Every report is written from public data and official security disclosures, cross-checked against primary sources, and reviewed for accuracy before publication. We never ask readers for keys, seeds or transfers.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.