This is our weekly review of wallet security: the incidents and disclosures that defined the past seven days, what actually happened in each case, and the one operational habit that would have helped. Every item is based on a disclosed source — security-firm reporting, official statements or on-chain investigators — and we label anything not yet confirmed.
This edition covers September 14–20, 2026.
1. The Week at a Glance
1,552
XRP Ledger wallets swept through one app wallet's signing flaw
2,009,321 XRP, Sept 15
~$7.8M
rsETH drained from a Safe wallet — then taken by a front-running bot
block 25,980,525, Sept 15
2.3B
Unauthorized tokens minted across the ASI cluster
AGIX, NTX, CGV, WMTx, Sept 19–20
6,000 XMR
Ransom demanded from Revolut over ~680 customer files
≈$3M, deadline expired Sept 17
This was the week the attack surface moved closer to the keys. A signing flaw in a mobile app wallet let an automated drain empty 1,552 XRP Ledger wallets in two hours; a $7.8M position left a Safe wallet through a module the owner had enabled, and a front-running bot took the proceeds before the exploiter could; and a stolen bridge signing key minted billions of brand-new AI-ecosystem tokens. Off-chain, seven agencies named the North Korean group that has been recruiting developers with fake job interviews and harvesting their seed phrases, and extortionists put a 24-hour clock on Revolut over leaked identity files tied to crypto holdings.
Key takeaways
Two of the week's largest losses ran through keys that were never stolen: the software signed with them, and the systems accepted the signatures as legitimate.
The seed phrase is the whole wallet. An app that asks for one — even to "restore" a hardware wallet — inherits every key that phrase controls, on every chain.
A multisig wallet's security boundary is everything you have enabled, not just the owners who sign.
Recovery is now a race between three parties: the attacker, an automated bot watching the mempool, and the protocol's pause button. This week the bot won.
2. Story Review
#1Sep 15–20WalletsImpact High
D'CENT App Wallet signing flaw sweeps 1,552 XRP Ledger wallets; exposure spans Bitcoin, Ethereum, TRON and EVM chains
Summary. Between 16:29 and 18:34 UTC on September 15, an automated drain emptied 1,552 XRP Ledger wallets holding 2,009,321 XRP — about $2.86M at that day's price — belonging to users of DCENT (formerly D'CENT), the Korean wallet maker. On-chain analysis described two waves: 204 wallets in the first fifteen minutes with 72 attempts failing, a 33-minute pause while the twelve largest wallets were emptied by hand, then 1,336 more wallets over 77 minutes. DCENT published a preliminary incident report on September 17 describing an App Wallet signing vulnerability and withheld the technical detail on the grounds that it could be reused against others. The company's stated criteria for exposure: the address's recovery phrase was at some point entered into the App Wallet (software wallet), the address has a history of sending or signing, and the signing happened on an app version earlier than 8.1.0, released November 5, 2025. That covers Bitcoin, Ethereum, XRP Ledger, TRON and EVM networks, plus tokens and NFTs sharing the same keys. Hardware wallets are affected only where their recovery phrase was ever entered into the app. DCENT has told users to update to v10.0.0, run the in-app checker, create a new wallet with a new recovery phrase and move everything — staked assets and NFTs included — without reusing the old addresses.
Commentary. Only the XRP Ledger leg has been quantified, so every published figure is a floor: on-chain trackers put the XRP drain near $2.86M, SlowMist's public tracker records about $6.57M, and a later XRPL community count describes 6,160 potentially affected addresses and 9.3M XRP. The important detail is the exposure condition, not the total — a recovery phrase typed into a phone app put every key derived from it, on every chain, in the same blast radius. If you ever restored a hardware wallet by typing its phrase into software, that phrase is now a liability, not a backup.
A Safe wallet loses ~$7.8M of rsETH through an enabled module — and a bot takes the proceeds first
Summary. On the morning of September 15, a Gnosis Safe on Ethereum holding a leveraged rsETH position was drained of about 2,900 rsETH, roughly $7.73M–$7.81M. The root cause was not the Safe's core contracts or its owner keys. According to BlockSec, SlowMist, AstraSec and Defimon Alerts, a whitelisted strategy-executor module forwarded fully caller-supplied calldata into the Safe's execTransactionFromModuleReturnData function with the operation flag set to DELEGATECALL and did not gate the external caller; the attacker reached it through a public keeper multicall whose target parameter could be set to the contract's own address to pass the authorization check. The attacker then routed the position through a custom Uniswap v4 liquidity module into a hooked pool that Blockaid described as attacker-created, unwrapping aEthrsETH into freely transferable rsETH. The drain never reached the attacker: an MEV bot publicly tagged "Yoink" saw the pending transaction, paid roughly $47,000 in priority fees to take the first position in block 25,980,525, and captured 2,882.37 rsETH to its own address. Kelp DAO, the rsETH issuer, placed a 24-hour wallet-level pause on the receiving address and said its contracts and backing were unaffected.
Commentary. This is the module problem, not the multisig problem. Every module you enable becomes part of your wallet's security boundary, and a module that executes caller-supplied data on the wallet's behalf is a signing key by another name. The secondary lesson is about recovery: when a bot beats an attacker, the funds do not return to you — they move to a third party who has made no commitment to give them back.
Stolen bridge and mint keys let one actor mint billions of AI-ecosystem tokens across Fetch.ai, NuNet and SingularityNET
Summary. A single on-chain cluster drained and then printed tokens across the Artificial Superintelligence Alliance ecosystem over the September 19–20 weekend. At 20:21:47 UTC on September 19, a call to the conversionIn function on Fetch.ai's TokenConversionManagerV3 contract moved 8,721,530.40 FET — about $1.53M — to an attacker wallet. Twenty-eight minutes later the NuNet deployer account minted 408.53 million NTX, roughly 42% of that token's circulating supply, and sent it to the same cluster. On September 20, PeckShield recorded 260 million AGIX and 53.838 million WMTx minted on Ethereum, putting the cluster's holdings near $16.77M. Fetch.ai's own analysis attributed the event to a compromised signing key for the SingularityNET bridge authorizer plus a separately compromised NuNet mint key. Reported realized proceeds were far smaller than the headline — roughly $2.25M — while NTX fell between 65% and over 90% and WMTx's decline was smaller. Bitquery also reported a prior sweep of ETH and BNB from 16 wallets, four of them previously associated with SingularityNET or NuNet personnel, and $289,575 in USDC taken from a payroll contract.
Commentary. Two numbers matter and they are not the same number: what the attacker held ($16.77M of mostly unsellable new supply) and what they actually got ($2.25M plus payroll funds). Mint authority is the bluntest instrument in crypto — it devalues every holder instantly, and unlike a drain it cannot be undone by returning the coins. It also confirms what the wrapper incidents argued last week from the other direction: privileged keys, not chain security, are the weak point.
Nostra halts its Starknet money market after a manipulated price feed lets one account borrow ~$3.5M
Summary. Nostra Finance paused lending, borrowing, withdrawals and liquidations at 13:28 UTC on September 17 after a manipulated NSTR price let a single account borrow roughly $3.5M in ETH, STRK, USDC, USDT, WBTC and DAIv1 against collateral worth a fraction of that. GoPlus Security traced the spike to a fake NSTR/SolvBTC pool seeded with 1.5 SolvBTC of one-sided liquidity, which hijacked the pool-selection logic of the GeckoTerminal aggregator Nostra's feed relied on; wash trading inside that thin pool moved the quoted price from about $0.006 to $49.5 in a minute, an increase of roughly 8,000 times. PeckShield reported that about $1.92M (234.57 ETH and 1.3M DAI) had been bridged to Ethereum, while CertiK placed roughly $1.55M still on Starknet; 2.2 million STRK left the chain through the NEAR Intents bridge. NSTR's entire circulating market capitalisation was under $600,000 at the time, meaning the borrow exceeded the value of every NSTR in existence by more than five times, and Nostra's total value locked fell from about $4M to $710,632.
Commentary. An illiquid token was accepted as collateral, and the price for that collateral came from a third-party aggregator anyone can seed a pool into. The mismatch is the whole failure: no one stopped to ask how a token with a $550,000 float could support a $3.5M loan. If a lending market you use quotes collateral from a single external feed, and that asset trades on pools thin enough to move with a dust swap, the market is priced by whoever shows up first.
FomoPeek shipped an iOS kernel exploit framework inside a free wallet-tracker app
Summary. SlowMist and the OKX security team warned on September 19 that versions 1.1 (released September 9) and 1.2 (released September 12) of FomoPeek — an iOS app marketed as a read-only tracker for whale wallets across Solana, Ethereum and TRON — carried two modules unrelated to its stated function, including a professional iOS kernel exploitation framework with eight exploit methods that selected an attack path by device model and iOS version. The targeted range covered iOS 12.0 through 18.7.2 and iOS 26.0 through 26.1. If an exploit succeeded, the code could escape the app sandbox, read and decrypt Keychain data, and reach files belonging to other applications — private keys, seed phrases, login credentials, chat histories. SlowMist's isolated testing retrieved a collection list aimed at 19 wallet and note-taking apps and demonstrated packaging Apple Notes data for upload. Captured plaintext traffic showed the attack functionality was already enabled and running on a schedule, with a command-and-control system that could toggle it remotely. MistTrack linked a primary attacker address to roughly 579,984 USDT in received funds. Version 1.0 was clean and version 1.3 removed both frameworks.
Commentary. The app never asked for a wallet connection, which is exactly why it looked safe. It did not need one: an iOS Keychain is a shared vault, so an app that breaks out of its sandbox can read credentials belonging to wallets it never touched. Deleting the app does not invalidate a key it may already have copied — the only remediation is new keys generated on a device that never had it installed.
Blink Wallet pauses all services after an attacker drains a few dozen custodial accounts
Summary. Blink Wallet, the Bitcoin Lightning payments app that began as El Salvador's Bitcoin Beach project, shut down all services on September 19 after an attacker accessed a limited number of custodial accounts and withdrew funds. Later updates narrowed the scope to "a few dozen" custodial accounts, said every affected account had been identified and would be made whole without users taking any action, and confirmed that non-custodial wallets — the Spark protocol, introduced in mid-2026 — were not implicated. Services were restored the same day after a patch was deployed and verified, while affected accounts stayed locked. Blink has not disclosed the amount withdrawn, the number of users or the attack path, and has promised a full post-mortem. The incident lands while Blink is already winding down custodial services in some regions under regulatory pressure, with migration deadlines through August and September 2026.
Commentary. A custodial wallet is a shared honeypot: one breach reaches many users at once, and the user's only defense is choosing not to be custodied in the first place. Blink's own architecture contains the honest answer — cold storage limited the blast radius, and the non-custodial product was untouched. If a Lightning wallet holds your key, a compromise is the provider's problem; if it holds your balance, it is yours.
Seven agencies name WaterPlum: 30,000 devices infected and 7,000 crypto wallets stripped through fake job interviews
Summary. A joint advisory published September 18 by Japan's National Police Agency and National Cybersecurity Office, the FBI, the US Department of Defense Cyber Crime Center, Australia's ASD Cyber Security Centre and Germany's BND and BfV formally attributed the multi-year "Contagious Interview" campaign to a North Korean group tracked as WaterPlum. The operators impersonate recruiters at AI, cryptocurrency and NFT companies, then ask candidates to run code — an npm package, a cloned repository, a VS Code project, or a fix for a video call that will not connect. Five malware families are named: BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle. The advisory states the campaign infected at least 30,000 devices across more than 100 countries and took funds or credentials from over 7,000 cryptocurrency wallets, moving 1.7 billion yen — about $10.71M — to North Korea between December 2025 and July 2026. The NPA and FBI assess that the actors, alongside some North Korean IT workers, operate under the 313 General Bureau of the Munitions Industry Department. Japanese authorities dismantled a laptop farm operated by an enabler, the first such takedown in the country.
Commentary. Note what the malware actually collects: browser credentials, keystrokes, screenshots, files — and the private keys and seed phrases stored on a developer's machine. There is no vulnerability to patch, because the vulnerability is the professional obligation to run the code you were handed. Interview code belongs on a disposable machine that holds nothing, and a job-hunting laptop should never hold a wallet.
Revolut: falsified government requests exposed ~680 customers, then a $3M Monero ransom clock started
Summary. A group calling itself "iamnotavillain" published a demand for 6,000 Monero — about $3M — from Revolut with a 24-hour countdown that expired on September 17, threatening to sell customer records to other criminal groups. The disclosure it rests on sits outside this window: Revolut confirmed on September 12 that fraudulent information requests sent from what appeared to be a legitimate government email domain had passed its technical authentication checks, and that it released customer information before identifying the requests as fake, then blocked the address and notified law enforcement and regulators. The in-window development is the extortion clock, not the disclosure. At least 680 accounts were affected. Exposed data includes names, dates of birth, addresses, emails, phone numbers, passports, driving licences and verification selfies, plus bank account numbers, account-opening dates, transaction histories and Bitcoin wallet reference numbers; Revolut says private keys, passwords, security codes and full card details were not exposed. The attackers told the Financial Times they used blockchain analysis to select customers with large crypto holdings. As of September 18 no independent confirmation had emerged that the data was sold or that a payment was made, and Revolut said it received no direct ransom demand. The UK Information Commissioner's Office is investigating.
Commentary. This is the incident that links a leaked passport to a public blockchain. Identity documents plus on-chain history is exactly the dossier used for targeted extortion and physical threats, which is why the affected group skews toward large holders. The practical response for anyone in that overlap is not only phishing vigilance but a review of how much of your net worth is publicly visible and personally attributable — and Monero as the ransom currency is a reminder that traceability is a property of the chain, not of the crime.
Liquid's peg-outs stay frozen as Blockstream refuses the hackers' bounty demand
Summary. Eleven days after the September 6 withdrawal, Liquid's redemption path remained closed. Blockstream stated on September 11 that it "will not pay a ransom for the return of stolen funds" and later offered to pursue law enforcement, exchanges, service providers and forensic specialists, while maintaining publicly that the 1:1 L-BTC peg will be covered. The September 17 ecosystem update confirmed that block production and L-BTC transfers have run normally since the September 10 restart, but that peg-ins and peg-outs stay suspended and will resume only after full 1:1 backing is confirmed and all software updates, testing and independent security reviews are complete — with no date given. The September 17 ecosystem update put 4,234.76 L-BTC in circulation against 3,632.23 BTC held, a hole of roughly 602 BTC that corresponds closely to the 598.5 BTC the actors retained. SlowMist attributed the original failure to a cache-key collision in Elements range-proof verification, and reported that the patch had been public on GitHub since September 1 — five days before it was used. SideSwap acknowledged that insufficient sanity checks and time delays turned a reversible event on Liquid into an irreversible payment on Bitcoin.
Commentary. Holders are stuck in a queue they cannot see the end of, and the price of L-BTC on secondary venues is now the market's only estimate of when it clears. Two structural points are worth keeping: an automated peg-out pipeline with no delay converts a minting bug into an irreversible payout, and a fix that exists in a repository but not on production nodes protects nobody.
The service layer: Swiss Bitcoin Pay and Haruko disclose intrusions, while legacy contracts leak $0.5M in small pieces
Summary. Swiss Bitcoin Pay, a non-custodial Bitcoin payment processor used by more than 1,000 merchants in 21 countries, took its servers offline on September 14 after a malicious user likely gained access to internal systems, potentially exposing customer email addresses, Bitcoin addresses, IBANs, transaction histories and hashed passwords; the company said customer funds were safe and amounts owed would be returned in full, with no reopening date announced. On September 18, crypto technology provider Haruko disclosed an API token breach affecting 15 institutional clients, with exchange API credentials and trading data exposed and no confirmed loss figure published. The week's smaller DeFi failures were the familiar kind: Flamincome's legacy contracts lost about $345,900 to an $18M USDT flash loan that inflated the VaultYUSDT share price (DeFiLlama records a higher $595,000), BonfireSwap's router lost roughly $50,000 because its transfer function never checked that the caller was the source address, affecting about 41 approved holders, Nimiq lost about $50,463 through a spoofed meta-transaction sender, Startale lost roughly $2,876 across pre-funded counterfactual accounts, and Spiral's hook was drained of about 10.7 ETH because it valued collateral from a spot price with no time-weighted average.
Commentary. None of these made a headline, and three of them were preventable with a single check — a caller identity test, a sender signature check, a time-weighted price. The pattern across the week is worth naming precisely: the losses that scale are not the cleverest attacks but the ones against code that assumed nobody would call it that way.
Last week's lesson was that the wrapper software issuing receipts for bitcoin is the weak layer. This week the failures moved one step closer to the user: an app wallet that signs with a phrase it should never have held, a Safe module the owner enabled and forgot, a bridge authorizer key held by one team, an oracle price pulled from a pool anyone can seed. In every one of the four largest incidents, the signatures were valid — the systems authenticated correctly and paid out against something that was not real. Meanwhile the two disclosures that involved no stolen crypto at all, Swiss Bitcoin Pay and Revolut, may carry the longest tail: leaked identity data paired with public blockchain history is a physical-security risk, and it does not expire when the news cycle does.
As always: if an incident in this review is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.
Frequently Asked Questions
I used the DCENT App Wallet. What do I actually need to do?
Assume any address whose recovery phrase was ever entered into the App Wallet is compromised if it also signed a transaction on an app version earlier than 8.1.0. Update the app to v10.0.0 or later, run the in-app checker, then create a completely new wallet — new recovery phrase, generated on a device that never ran the affected app — and move everything to it, including tokens, NFTs and staked positions. Do not reuse the old addresses, and do not reuse the old phrase on new hardware: the same phrase recreates the same keys.
My hardware wallet is fine because it never touched an app, right?
Only if its recovery phrase was never typed into software. The DCENT exposure condition is about where the phrase went, not which device signed. A hardware wallet whose phrase was restored into a phone app, or whose phrase was created in one, is inside the same blast radius. If you ever typed a hardware seed into any app as a backup or recovery test, treat that phrase as burned and migrate.
What is the lesson from the Safe wallet incident — do I need to stop using multisig?
The failure was in an enabled module and a helper contract, not in Safe's core contracts or the owners' keys. Safe itself was not compromised. What changes is your audit scope: list every module and helper contract your wallet has authorized, remove anything you do not actively use, and treat any module that executes caller-supplied data or takes arbitrary external calls as equivalent to handing out a signing key.
Did I lose anything from the FomoPeek app if I only used it to watch wallets?
Possibly, and you would not necessarily know. The exploit framework targeted iOS Keychain data, which includes credentials belonging to other applications, and testing showed a collection list aimed at 19 wallet and productivity apps. If you installed version 1.1 or 1.2, check your wallets for unauthorized transactions, then generate new keys on a clean device and move remaining assets there. Uninstalling the app inverts nothing that was already copied off the device.
Is the revoked or paused service still the safest place for my funds?
No — a pause protects the protocol's remaining reserves, not your access. Zentra's lending markets, Nostra's money market, Liquid's peg-out path and Blink's custodial accounts all remained closed to users at this edition's cutoff, in some cases with no reopening date. Treat an indefinite pause as a liquidity event: the asset may still show a price on a venue you cannot exit through, and swapping a paused or depegged claim into thin liquidity usually locks in the discount.
This article is based on public data and official disclosures. Figures were last reviewed on September 22, 2026. Values change with network conditions; always verify against the primary source before making decisions.
D'CENT's own preliminary incident report (September 17, 2026) and in-app notices (September 20, 2026): App Wallet signing vulnerability, pre-8.1.0 signing condition, exposure criteria across Bitcoin, Ethereum, XRP Ledger, TRON and EVM chains.
XRPL community ledger analysis and SlowMist's incident tracker (September 15–19, 2026): 1,552 wallets, 2,009,321 XRP, two-wave drain timing, 72 failed attempts; tracker figure ~$6.57M; XRPL community count of 6,160 addresses and 9.3M XRP.
Blockaid's own alert, Defimon Alerts' technical note and Kelp DAO's statement (September 15, 2026), with PeckShield's independent figure: rsETH Safe-module drain, Multicall authorization flaw, Yoink front-run in block 25,980,525, 2,882.37 rsETH, 24-hour wallet pause. The attacker-created hooked pool is Blockaid's account of the Uniswap v4 leg; no second firm has confirmed that a custom malicious hook was required, so that detail should be read as one firm's finding rather than settled.
Fetch.ai's official statement and preliminary on-chain analysis, PeckShieldAlert and World Mobile Chain's confirmation (September 19–21, 2026): FET converter drain, 408.53M NTX mint, 260M AGIX, 53.838M WMTx, ~$16.77M cluster holdings, ~$2.25M realized, payroll USDC theft.
Nostra's own statement (13:28 UTC, September 17, 2026) with PeckShieldAlert and CertiK (September 18, 2026): NSTR feed manipulation, $3.5M borrowed, $1.92M bridged to Ethereum, 2.2M STRK via NEAR Intents, TVL decline.
SlowMist's own technical write-up and its joint advisory with the OKX security team (September 19–20, 2026): FomoPeek 1.1–1.2 modules (apptrace, libapptracecore), eight-method iOS kernel framework, Keychain access, remote command control, ~579,984 USDT traced, v1.0 clean and v1.3 stripped, remediation guidance.
Blink Wallet's own statements (September 19, 2026): paused services, a few dozen custodial accounts, patch and restoration, reimbursement commitment, Spark protocol powering the non-custodial accounts (launched mid-2026) unaffected.
Joint advisory published by IC3 on ic3.gov with Japan's NPA and NCO, DoD DC3, ASD's ACSC and Germany's BND and BfV (September 18, 2026): WaterPlum attribution, 30,000 devices, 7,000 wallets, $10.71M, five malware families, Japan laptop farm takedown.
Financial Times reporting (September 17-18, 2026), with Revolut's own customer notice of September 12 as carried by Decrypt: Revolut impersonation disclosure dated September 12 (out of window), ~680 accounts, 6,000 XMR demand published September 16 and expired September 17, UK ICO investigation.
Blockstream's own Liquid incident status page and its September 11 statement declining a ransom, with Liquid Network's September 17 ecosystem update and SlowMist's cache-collision analysis: peg-out suspension and reserve figures (4,234.76 L-BTC against 3,632.23 BTC held), SideSwap acknowledgment, Lightning capacity decline.
The projects' own notices and SlowMist's incident tracker (September 14-18, 2026): Swiss Bitcoin Pay server shutdown, Haruko API token breach across 15 clients, Flamincome, BonfireSwap, Nimiq, Startale and Spiral losses.
Source-provenance note: every link in this edition was opened and checked, and each entry is credited to the party that issued the underlying fact — project statements, regulator publications and security-firm alerts — rather than to any outlet that re-reported it. The WaterPlum entry links to the joint advisory PDF published by IC3 on ic3.gov, the issuing agency's own copy; the FomoPeek entry links to SlowMist's own write-up; the Liquid entry links to Blockstream's own incident status page.
OSW
The OpSecWallet Research Team
We are an independent research desk focused on wallet security and safe on-chain operation. Every report is written from public data and official security disclosures, cross-checked against primary sources, and reviewed for accuracy before publication. We never ask readers for keys, seeds or transfers.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.