This is our weekly review of wallet security: the incidents and disclosures that defined the past seven days, what actually happened in each case, and the one operational habit that would have helped. Every item is based on a disclosed source — security-firm reporting, official statements or on-chain investigators — and we label anything not yet confirmed.
This edition covers September 21–27, 2026.
1. The Week at a Glance
$387.5M
Moved out of Bitget's hot and warm wallets through a compromised backend system
revised estimate, Sept 25; cold wallets untouched
$11M+
Lost across Payy, Duelbits and Meter in a single day
Sept 23–24
$20,199
Cost of the NTRN vote that took over contracts on Neutron
$9.3M in losses at Astroport and Drop, Sept 22
>$4.3M
Drained from 145+ addresses in one cross-chain private-key leak
Ethereum, TRON and Bitcoin, attacker still active
This was the week the attacks moved up the stack. The largest loss in our record did not involve a stolen key, a broken contract or a manipulated price: a compromised backend system inside Bitget's wallet infrastructure was used to spoof transaction data and trigger the authorization process itself, and $387.5M left the exchange's hot and warm wallets while the private keys stayed secure. The same seven days produced a governance proposal that cost $20,199 to pass and took over two protocols, a block-validation flaw that minted unbacked tokens on a live chain, and a single day on which a bridge, a casino and a blockchain were hit within roughly 24 hours. The market barely moved.
Key takeaways
An exchange's security boundary is its whole transaction pipeline, not its keys: Bitget's cold storage and private keys were intact, and the money left anyway, through the system that assembles and authorizes transfers.
Chain-level governance is part of every application's attack surface. Neutron's DAO changed the administrators of contracts belonging to apps users thought of as separate services.
Custody is a bundle: the $387.5M was covered by an insurance fund, and what users actually felt was a withdrawal freeze — the principal survived, the access did not.
Recovery worked this week where the chain itself could act: Cosmos Hub validators swept the attacker's remaining ATOM into a multisig on restart. Everywhere else, the funds stayed gone.
2. Story Review
#1Sept 24–26InfrastructureImpact High
Bitget loses $387.5M to a compromised backend system; cold wallets and private keys untouched, withdrawals phased back from September 28
Summary. At 18:31 UTC on September 24, Bitget's security systems detected unauthorized transfers from a portion of its hot and warm wallet infrastructure. The exchange's initial assessment put the affected amount at about $351.6M; on September 25, after further transaction classification, Bitget revised the estimate to about $387.5M, adding affected Zcash and TRON transactions to the initial count. Unauthorized transfers occurred across Ethereum and other EVM networks, the XRP Ledger, Zcash and TRON, involving ETH, XRP, BNB, ZEC, USD0, XAUT, AVAX, TRX, USDT and USDC. According to Bitget's own account, the attacker compromised a critical backend system within the wallet infrastructure, used it to spoof transaction data, and triggered the authorization process for unauthorized transfers; private-key compromise has been ruled out and cold wallets were not affected. Withdrawals were paused as a precaution while deposits and trading continued. On September 25 the exchange said the attack path had been identified and the underlying vulnerability remediated, and engaged Mandiant and SlowMist to support forensics and fund tracing alongside a Recovery Bounty Program; on September 26 it announced a phased withdrawal restoration schedule, with withdrawals resuming progressively from September 28. The exchange says the loss falls within its User Protection Fund, which it puts at over $464M, and that user account balances are unaffected.
Commentary. Read the architecture lesson before the attribution question. Bitget's keys were secure and its cold storage untouched — the failure was in the backend system that assembles and authorizes transfers, which means the system that decides what a key is asked to sign is as much a part of the wallet as the key itself. The second lesson is about what users actually experience: the principal was covered by a fund, but every withdrawal was frozen for four days on the exchange's schedule. Custody risk is access risk, and an exchange balance is not liquid until the exit has been tested.
Three platforms in roughly 24 hours: Payy's bridge drained, Duelbits loses ~$7M, Meter mints and burns
Summary. Three separate platforms were hit within about a day of each other. First, at 04:21 UTC on September 24, the bridge connecting Payy Network — a rollup for on-chain payroll and treasury services — to Ethereum was drained of its full balance, about $1.8M in USDC that the attacker, funded through the privacy protocol Railgun, swapped for ETH. Payy paused all deposits and withdrawals and said the affected funds were users' non-custodial deposits; on September 25 it said initial root-cause analysis was complete, that it was not a compromised key, social engineering or an exploit of off-chain infrastructure, and that a top audit firm was validating the findings before release. Second, the crypto casino Duelbits lost approximately $7M in what is suspected to be a private-key compromise across Ethereum, BSC, Bitcoin and TRON, with additional affected addresses found on Solana: PeckShield's first tally was $4.3M, on-chain analyst Specter revised it to $4.9M and then $5.9M, and the co-founder's own confirmation landed at roughly $7M, with the platform kept offline pending investigation. Third, on September 23 at 21:14 UTC an attacker exploited a block-validation flaw on Meter, an EVM-compatible blockchain, to mint unbacked MTR and MTRG, dumped them on PancakeSwap and bridged the proceeds out — about $2.3M. Meter paused its mainnet and bridge, said it had preserved the chain state with the recovery method still undecided, and both tokens crashed roughly 80% and 75%.
Commentary. Three failures in one day, three different layers: a bridge contract, a hot key, a consensus rule. What they share is that none of them required breaking cryptography — and two of the three projects had been hacked before, Duelbits for $4.6M in 2024 and Meter for $4.4M in 2022, both times through the same categories. A platform's second breach is usually the first one's unresolved lesson, and the practical check for a user is not the audit badge but whether the operator publishes what changed after the last incident.
A $20,199 governance vote takes over contracts on Neutron; $9.3M in losses at Astroport and Drop, $2.2M swept back by validators
Summary. On September 22, Neutron DAO voters passed proposal #9, titled 'AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration' — eleven Update Admin actions that handed administrative control of contracts used by the Astroport exchange and the Drop liquid-staking protocol to attacker-controlled code. The voting power needed to pass the expedited proposal cost about $20,199. Security tracker SlowMist recorded estimated losses of $4.9M at Astroport and $4.4M at Drop — $9.3M combined — while an itemized breakdown published by a former Neutron contributor put the initial impact at roughly $4.4M: about $3M in ATOM, $1.2M in USDC and around $100,000 in DYDX, with rate limits and the subsequent halt protecting more than $1.6M in USDC plus significant NTRN and ASTRO. Neutron halted, trapping an estimated $5M on the chain, and Cosmos Hub validators halted their own chain at block 33,086,740 after part of the stolen ATOM crossed over IBC. On restart at 12:00 UTC on September 23, on Gaia v28.3.0, a one-time state change moved the attacker's remaining 1,227,121 ATOM — about $2.2M — into a 4-of-6 validator multisig; the Cosmos Hub stressed that it was not itself exploited and no other balance was touched. The sweep missed a THORChain refund of 168,990.9 ATOM that reached the attacker seven blocks after the restart and was sold on Osmosis for roughly 266,841 USDC. By September 24, Neutron contributors had prepared a new binary to restore the affected contracts, tighten governance and move the remaining attacker-controlled assets into a multisig, with a post-mortem promised.
Commentary. The cheapest hostile action of the year was a governance vote. Users experience Astroport and Drop as applications, but the administrator of those contracts sat one level down, in chain governance that anyone with $20,199 and an expedited proposal could redirect — and nothing in either app's own security posture could stop what the chain itself made lawful. The counterweight is also structural: where the chain could act, it did, and the Cosmos Hub's coordinated halt-and-sweep returned more value in one restart than most incidents see in a year. The residual lesson is uncomfortable: governance power is a key, and it is held by whoever shows up to vote.
One leaked key drains 145+ addresses across Ethereum, TRON and Bitcoin — and the attacker is still moving
Summary. On-chain analyst Specter reported on September 22 that an unknown victim's private key had apparently leaked, with losses exceeding $4.3M across EVM chains, TRON and the Bitcoin network. The attacker emptied more than 145 Ethereum addresses, most of which held USDC, converted the stablecoins into ETH, and bridged the proceeds across chains; Bitcoin taken from at least five additional addresses was consolidated into the same infrastructure. Specter's alert describes the case as a suspected key leak and does not determine how it happened — insecure storage, malware and phishing all remain possible — and warns that the final total will keep rising while the attacker remains active.
Commentary. This is the standing risk that never makes a headline: one key, many addresses, several chains, and a laundering path that was planned before the first wallet was touched. The conversion of USDC into ETH is the same move seen in the Bitget outflows — stablecoins can be frozen by their issuers, ether cannot — and it tells you the attacker's first planning assumption is that tracing and freezing will follow. Nothing here required the victim to click anything on the day; whatever exposed the key happened earlier, which is why the audit that matters is of every place a key has ever been.
SlowMist warns the Darksword iOS exploit chain may have been adapted to iOS 26.5
Summary. SlowMist's chief information security officer, 23pds, warned on September 22 that attackers may have adapted the Darksword exploit chain to compromise devices running iOS 26.5 and extract private keys from self-custody wallets. The warning builds on Google Threat Intelligence Group's published research, which documented Darksword as a full iOS exploit chain combining six vulnerabilities, tracked from at least December 2025 through March 2026 against iOS 18.4 through 18.7 — including CVE-2025-43529 in JavaScriptCore, patched by Apple in iOS 18.7.3 and 26.2. Delivery is social engineering: a link received through a social network or messaging app and opened in Safari, after which successful exploitation can escape the browser sandbox, gain elevated privileges and reach data on the device, including wallet information and private keys. Google documented separate operators using different final payloads, with victims in Saudi Arabia, Turkey, Malaysia and Ukraine. The iOS 26.5 adaptation has not been independently confirmed by Apple or Google, and no confirmed victim total or theft amount has been published.
Commentary. Treat this as a warning, not a confirmed breach — that is exactly how SlowMist frames it, and neither Apple nor Google has corroborated the newer version's exposure. But the structure of the threat does not depend on the version number: a browser visit is enough to put keys at risk if the device is unpatched, because a sandbox escape reaches credentials belonging to apps the link never touched. The two defenses are unchanged and cheap — install operating system updates as they ship, and never open unsolicited links on a device that holds keys.
Polymarket's $10M stolen-card episode draws a CFTC inquiry — the safeguard it removed was the one that stops this
Summary. A Wall Street Journal investigation published September 20 — the day before this window opens — reported that fraudsters used stolen debit cards across thousands of Polymarket's US accounts starting in February, attempting to move at least $10M through deposits, bets and withdrawals. Payment processor Checkout.com flagged the surge and at one point rejected more than 80% of the platform's US deposits as fraudulent, against an industry norm near 1%; roughly seven users drove most of the activity, one attempting around 4,000 deposits. The consequential disclosure is internal: with fraudulent deposits piling up, Polymarket's leadership removed the requirement that funds be withdrawn to the same payment source that deposited them — the standard control that blocks stolen-card proceeds from reaching a clean account — over employee warnings that it invited laundering. US compliance chief Andrew Clifford resigned in April, US CEO Justin Hertzberg was fired, and an internal review by Sullivan and Cromwell concluded the company had complied with regulations. The in-window development is the regulatory response: the CFTC is investigating and staff have been told to preserve records. Polymarket says fraud rates returned to normal by May after it capped linked cards and brought in screening vendor Riskified.
Commentary. The detail worth holding onto is which control was removed. Same-source withdrawal is the rail that makes stolen-card deposits fail to monetize, and it was dropped for payout speed while the fraud was live — an operational decision, not a technical one. For wallet users the transferable point is that the most consequential security failures are usually policy changes, not exploits: when a venue loosens a control that exists to stop exactly the fraud that is happening, your funds are exposed to its governance before any attacker acts.
SEC staff clarify that staking does not itself make a token a security — the week's positive regulatory datum
Summary. On September 25, the SEC's Division of Corporation Finance issued new staff guidance stating that staking activities associated with crypto assets do not, by themselves, make those assets securities, and that token buybacks on sufficiently functioning networks do not automatically classify tokens as securities either. The clarity landed on a market already rotating: Ethereum gained through the week, and spot ether ETFs attracted about $690M of inflows across the same trading week while bitcoin ETFs took a record $2.39B. The guidance is administrative rather than a rulemaking, and it does not immunize any particular token; it draws the perimeter within which staking — the activity most wallet holders perform directly, often from a self-custody wallet — sits.
Commentary. Most security coverage treats regulation as weather, but this one touches the wallet directly: staking is the interaction through which ordinary holders delegate custody or sign validator transactions, and ambiguity about its status pushes users toward custodial shortcuts. Clearer perimeters reduce the pressure to hand keys to a platform just to earn a yield. The security-relevant reading is narrow but real — regulatory clarity is one of the few forces that moves activity out of custodial pools and back into wallets the user actually controls.
September becomes the costliest month of 2026: past $684M with Bitget counted
Summary. Earlier in the month — before the September 19 Fetch.ai exploit and this week's incidents — DeFiLlama had recorded roughly $331M across 17 September incidents. DeFiLlama's tally puts the month past $684M once the exchange breach is included — overtaking April's roughly $645M to become the costliest month of 2026. The shape of the month is as notable as the size: August saw a record count of 50 attacks but only $136.3M in aggregate losses, an average of $2.7M per incident, with validators freezing affected networks before funds moved. September inverted that pattern — fewer, much larger failures aimed at centralized infrastructure and chain-level trust: an exchange backend, a governance process, a block-validation rule, a casino's hot keys. On our own gross ledger, the four editions covering September print at roughly $759M before recoveries.
Commentary. Two tallies, one direction. DeFiLlama's figure nets the returned Liquid funds and uses Bitget's initial estimate; our ledger counts gross and uses the revised $387.5M — the honest summary is that whichever scope you prefer, September is the year's worst month by a wide margin. The structural reading matters more than the ranking: August's many-small-attacks regime and September's few-huge-failures regime both trace to the same root, keys and authorization paths, and the difference is only which operator held them.
The carried threads: Liquid's status page unchanged, D'CENT silent on other chains, ASI's supply still unreconciled
Summary. None of the open files from prior editions moved materially this week. Blockstream's Liquid incident status page still carried its September 10 update at this edition's cutoff: block production and L-BTC transfers running, PAK-authorized peg-outs suspended while the BTC/L-BTC reserve restoration continues, with no date given and roughly 598.5 BTC still outstanding. DCENT has published no technical report on the App Wallet signing flaw and no quantification for any chain beyond the XRP Ledger, where 2,009,321 XRP across 1,552 wallets remains the only measured leg against a tracker figure near $6.57M. The ASI cluster's circulating-supply reconciliation across Ethereum, Cardano and BNB Chain has not appeared, and the FET deposit halts that Bitget and KuCoin imposed after the mint-key compromise were still in place — the former venue now managing its own breach. Nostra's Starknet money market and Zentra's lending markets remained closed with no reopening date.
Commentary. Absence of movement is information. Every one of these threads is waiting on a disclosure the affected party controls — a root cause, a supply table, a restoration date — and each week without it extends the period in which holders cannot verify the thing that determines their position. The pattern across our ledger is that posts eventually arrive but floors rarely hold: quantified totals move up, not down. Treat every 'only one chain measured' figure as provisional and price your exposure to the disclosure, not to the number.
The exit was the week's real product: every major incident ended in a freeze the user did not control
Summary. Strip the headlines from this week's incidents and what users actually experienced was loss of access. Bitget froze all withdrawals for four days and is restoring them on a phased schedule of its own announcement. Duelbits took its entire platform offline. Meter paused its mainnet and bridge with the recovery method undecided. Payy paused all deposits and withdrawals. Neutron's halt trapped an estimated $5M on the chain, and the Cosmos Hub's protective halt froze an entire blockchain for hours to catch one attacker's balance. None of these freezes is wrong — every one was a reasonable containment decision. But the compounding effect is that during the year's most expensive security month, the dominant user experience was not theft: it was being unable to move.
Commentary. This is the operational fact custody decisions are made on. A custodial balance carries two risks stacked on each other — the operator's breach risk and the operator's containment policy — and only the first gets discussed. The self-custody answer is not free either: it trades the freeze risk for key-management risk, and this same week a leaked key drained 145 addresses across three chain families. The honest framing is that neither model removes risk; they position it. What both allow is rehearsal — a small test withdrawal from any venue you depend on, and a clean-device migration for any key that has touched software — and both rehearsals were free this week.
Three weeks ago the failures were about software issuing receipts for bitcoin; two weeks ago about software signing with keys it should never have held; this week about the systems that decide what keys are asked to do — a backend that assembles transactions, a DAO that owns contract administrators, a block-validation rule, a payout policy. The distance between the key and the payout is where the losses now live, and in the week's largest incident that distance was crossed without the key ever being wrong. Meanwhile the market's verdict was delivered by absence of panic: bitcoin ended the week up about 4% near $84,600, ETF inflows set a yearly record, and Bitget's own token fell roughly 3–4% on the day — the industry has learned that a funded insurance fund and a contained architecture can absorb a nine-figure loss. What no fund absorbs is the four days without an exit, and that is the part worth preparing for.
As always: if an incident in this review is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.
Frequently Asked Questions
I had funds on Bitget during the freeze. What should I be doing now?
Your balance was unaffected and the loss is covered by the exchange's User Protection Fund, so the immediate issue is access, not principal. Follow the official phased withdrawal schedule rather than any restoration notice that arrives by message or social media — scam waves follow every incident of this size. When withdrawals reopen, take out anything you do not actively trade with, and treat this as the moment to test whether the exit actually works for your account and your chains.
Was my TRON or Zcash exposure affected by the Bitget incident?
Possibly, if you held assets on the exchange: Bitget's revised estimate added affected Zcash and TRON transactions to the initial count, and the confirmed affected assets include TRX and USDT. If you held those assets on Bitget, your recourse runs through the exchange and its fund, not through the chains — on-chain holdings in your own wallet were never exposed. The revision is a reminder that initial figures in exchange incidents move in one direction as classification continues.
What does the Neutron incident mean for anyone using an app on a Cosmos-chain?
That the chain's governance is part of the app's attack surface. The proposal that drained Astroport and Drop was passed through Neutron's own DAO for about $20,199, and it changed contract administrators lawfully. Before holding significant value in an app, check whether the network's governance can alter the contracts behind it, whether proposals can be expedited, and how much voting power costs — those three numbers tell you the price of a lawful takeover.
Should I worry about the Darksword warning if my iPhone is updated?
The specific iOS 26.5 claim is unconfirmed, but the underlying chain is real and documented by Google against iOS 18.4–18.7, and Apple has patched those flaws. An updated device removes the known vulnerabilities; what remains is the delivery method, which is social engineering. Do not open unsolicited links on a device that holds wallet keys, and keep the device that holds your keys patched — those two habits cover the entire documented threat.
Did anything actually get recovered this week?
One significant recovery action, not yet a user recovery: Cosmos Hub validators swept the Neutron attacker's remaining 1,227,121 ATOM — about $2.2M — into a validator multisig during a coordinated halt and restart, where it is held for return. Everywhere else, nothing moved: Bitget's loss is fund-covered rather than recovered, Duelbits, Payy and Meter reported no returns, and the carried items — Liquid's 598.5 BTC, the rsETH held by the front-running bot, Balancer and Zentra — remain outstanding.
This article is based on public data and official disclosures. Figures were last reviewed on September 28, 2026. Values change with network conditions; always verify against the primary source before making decisions.
Bitget's own security notice (September 24, 2026) and its incident timeline page (September 24–26, 2026): 18:31 UTC detection, $351.6M initial estimate revised to $387.5M on September 25 including additional Zcash and TRON transactions, backend compromise used to spoof transaction data and trigger authorization, private-key compromise ruled out, cold wallets unaffected, Mandiant and SlowMist engaged, Recovery Bounty Program, phased withdrawal restoration from September 28, User Protection Fund above $464M.
Payy's own incident statement (September 24, 2026) and September 25 root-cause update on X (x.com/payy_link): bridge drained of full balance at 04:21 UTC, $1.8M USDC, attacker funded via Railgun, users' non-custodial deposits, not a key compromise or off-chain exploit, audit-firm validation pending. Duelbits' co-founder confirmation (~$7M, platform offline) and Meter's own X statement (x.com/Meter_IO): block-validation flaw at 21:14 UTC on September 23, unbacked MTR and MTRG minted, mainnet and bridge paused, chain state preserved.
SlowMist's incident tracker (September 22, 2026): $4.9M at Astroport and $4.4M at Drop, with the itemized ~$4.4M breakdown (about $3M ATOM, $1.2M USDC, ~$100K DYDX) published by a former Neutron contributor; Cosmos Hub forum, Hub Weekly Update #17: halt at block 33,086,740, restart on Gaia v28.3.0 at 12:00 UTC September 23, 1,227,121 ATOM (~$2.2M) moved to a 4-of-6 validator multisig, THORChain refund of 168,990.9 ATOM sold for roughly 266,841 USDC on Osmosis; carried in CryptoSlate's report (September 24, 2026).
Specter's own alert (September 22, 2026): suspected private-key leak draining more than 145 Ethereum addresses plus TRON and Bitcoin, >$4.3M, USDC converted to ETH and bridged, attacker still active; also Specter's revisions of the Duelbits estimate ($4.9M, then $5.9M).
SlowMist's Darksword warning via CISO 23pds (September 22, 2026), building on Google Threat Intelligence Group's published research: six-vulnerability iOS chain against iOS 18.4–18.7, CVE-2025-43529 in JavaScriptCore patched in iOS 18.7.3 and 26.2, Safari link delivery, sandbox escape reaching wallet data; iOS 26.5 adaptation unconfirmed by Apple or Google.
The Wall Street Journal's investigation (September 20, 2026): Polymarket stolen-card episode beginning February, at least $10M attempted, Checkout.com rejecting over 80% of US deposits at peak against a ~1% norm, removal of the same-source withdrawal control, compliance and US-CEO departures, Sullivan and Cromwell review; CFTC inquiry and records preservation reported September 21.
The SEC Division of Corporation Finance's own staff guidance (September 25, 2026): staking activities do not by themselves make crypto assets securities; buybacks on sufficiently functioning networks not automatically securities.
DeFiLlama's hack tally (September 2026): September past $684M including Bitget, against April's ~$645M; August at 50 incidents and $136.3M with PeckShield's average-loss data.
Blockstream's own Liquid incident status page (latest update September 10, 2026): operations resumed with transactions, PAK-authorized peg-outs suspended pending reserve restoration, no date; DCENT's published notices (September 16–20, 2026) stand as its latest word, with no further chains quantified by this edition's cutoff.
OSW
The OpSecWallet Research Team
We are an independent research desk focused on wallet security and safe on-chain operation. Every report is written from public data and official security disclosures, cross-checked against primary sources, and reviewed for accuracy before publication. We never ask readers for keys, seeds or transfers.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.