This is our weekly review of wallet security: the incidents and disclosures that defined the past seven days, what actually happened in each case, and the one operational habit that would have helped. Every item is based on a disclosed source — security-firm reporting, official statements or on-chain investigators — and we label anything not yet confirmed.
This edition covers September 28–October 4, 2026.
1. The Week at a Glance
~$9.6M
Gross direct losses across four quantified incidents
the cheapest week this record has printed since the week of September 7–13
$5.4M
Drained from Gravity Bridge through its signing keys
Oct 3; bridge halted, no post-mortem yet
$3.865M
Taken from NEAR Intents — and returned in full
patched in ~1 hour; full return within ~24 hours of a public ultimatum
~523,000 staked ETH, about $1.4B, after ~0.36 ETH of rewards was diverted
After September's record, the ledger finally exhaled: roughly $9.6M in gross direct losses across four quantified incidents, the smallest weekly total since the week of September 7–13, and not one nine-figure event anywhere in it. But the composition is the real story. Every loss still sat at the trust boundary — a bridge's signing keys, a module's authorization check, a staking operator's reward-routing layer — and for the first time in this record the defensive machinery visibly outperformed: NEAR Intents' risk system auto-paused eleven networks and its contract was patched within about an hour; MetaMask contained a live infrastructure compromise to roughly 0.36 ETH by exiting $1.4B of validators; and a public ultimatum brought back every dollar of the week's second-largest theft. The market, meanwhile, spent the week whipsawed by macro data and closed higher anyway.
Key takeaways
Non-custodial design proved itself under fire: the attacker inside MetaMask's staking infrastructure could skim rewards but never touch principal, because the withdrawal keys were never held by the operator.
Signing keys beat code again — Gravity Bridge's $5.4M drain came through valid signatures, not a contract bug, the same authorization-layer pattern as Kelp DAO and Resolv earlier this year.
Speed is a defense dimension: NEAR Intents' SHIELD system paused the incident and the flaw was patched inside an hour, before the ultimatum that recovered the funds could even matter.
Deadlines are security events: Blast users have until October 26 to withdraw through the normal interface, and an operator-led wind-down is now part of the risk that comes with any L2 balance.
2. Story Review
#1Sept 30–Oct 1WalletsImpact High
MetaMask exits 17,000 Ethereum validators — about $1.4B of staked ETH — after an infrastructure compromise diverted 0.36 ETH of rewards
Summary. MetaMask disclosed on September 30 that it was responding to a security incident affecting part of its infrastructure, and updated on October 1 that it had found no sign that MetaMask wallets or user funds were affected. The compromise sat in the Ethereum validator infrastructure behind MetaMask Staking, the non-custodial staking service formerly operated as ConsenSys Staking. As a precaution, the operator began exiting the validators it runs through Lido — roughly 17,000 validators securing about 523,000 staked ETH, close to $1.4B at this week's ether price — with Lido's governance forum confirming the final validators would exit by the end of October 7 and the full exit-withdrawal-re-entry cycle taking up to about 45 days. On-chain researcher 0xKaden's analysis found that block rewards from 18 of the 19 affected validators were paid not to the correct fee recipient but to a Tornado Cash-funded account — roughly 0.36 ETH diverted in total. Because the staking is non-custodial and MetaMask never managed users' withdrawal keys, the intruder could reach reward routing but not the staked principal; Lido proposed setting target limits to zero for MetaMask's node-operator entries so no new deposits are allocated, and stETH holders were told no action is required. A 133,300 ETH transfer (~$360M) from wallets labelled Lubin/ConsenSys hours before the announcement was flagged by on-chain analyst Emmett Gallic and appears unrelated. MetaMask warned users to expect phishing waves and to treat its official channels as the only source of updates.
Commentary. The ratio is the lesson: an attacker with a foothold inside a staking operator's infrastructure — the same class of access that cost Kiln real money in 2025 — came away with less than one ETH, because the architecture routed every valuable decision past a key the operator does not hold. Custody protects principal, not yield: users will pay for this incident in foregone rewards and a 45-day cycle, not in stolen deposits. The second lesson is disclosure speed — MetaMask published, quantified its defensive action, and warned about the phishing wave that follows every incident of this size before the details were even settled.
Gravity Bridge drained of ~$5.4M in a suspected signing-key compromise; validators halt the bridge
Summary. Early on Saturday, October 3, on-chain analyst Specter flagged unusual outflows from Gravity Bridge, the Cosmos-Ethereum bridge, and security firm PeckShield corroborated the read: the bridge's signing keys appear to have been compromised, letting the attacker push out a series of unauthorized withdrawals that the system treated as legitimate. PeckShield's tally puts the loss at roughly $5.4M — about $4.3M in USDC, 274 WETH worth near $553K, $434K in USDT and 14.16 PAXG worth about $64K — routed to an address ending 7C62da1F9, from a contract Specter identified as ending 1F2D906. The team acknowledged 'an unfortunate incident on Gravity' and told validators to halt their validators and orchestrators; the bridge is halted while it investigates. PeckShield reported part of the haul already laundered through the instant-swap service ChangeNow and Binance, with the theft wallet still holding around 2,100 ETH — about $4.23M — at the time of its report. No post-mortem has been published and the exact entry point is unconfirmed.
Commentary. The mechanism matters more than the size. Gravity Bridge authorizes transfers with validator signatures rather than a small multisig, and that design held for years — but once signing keys leak, forged withdrawals are indistinguishable from real ones, and no contract audit covers the key ceremony. This is the third 2026 bridge failure in the same category after Kelp DAO and Resolv: the code was not the weak point, the authorization layer was. For a user the practical check is unglamorous — a bridge's security is its key-management discipline, which is exactly the thing no dashboard displays.
NEAR Intents loses $3.865M — and gets every dollar back inside a day of naming the attacker
Summary. Between September 30 and October 1, an exploit at NEAR Intents — the cross-chain trading protocol — drained roughly $3.865M in USDT from a BNB Chain hot wallet through five withdrawals over about six hours, via a bug in the interaction between the protocol's Omni deposit-and-withdrawal infrastructure and its smart contract. Only USDT on BNB Smart Chain was affected; the NEAR chain and token were not. The team's SHIELD risk system detected the suspicious withdrawals and auto-initiated a service pause; the flaw was patched within about an hour, and deposits and withdrawals stayed restricted across eleven networks — including BNB Chain, Polygon, TON and Avalanche — for roughly twelve more hours while remediation completed, with full user compensation pledged from the treasury. On October 2, general manager Alex Shevchenko published three recovery addresses (Bitcoin, BNB Chain, Solana), said the team had identified the attacker, and gave them 48 hours. The stolen funds — which ZachXBT tracked through KuCoin and into Bitcoin — came back in full within about 24 hours, with roughly 34.59 BTC received at the Bitcoin recovery address; the attacker left an on-chain message encouraging bug bounties, and Shevchenko closed the investigation, telling researchers to use official bounty programs instead.
Commentary. Two things happened here and both are rare. First, the defensive sequence worked end to end: automated detection, a patch inside an hour, compensation pledged before anyone asked. Second, a public identification ultimatum produced a complete return inside a day — an outcome the ledger has seen only a handful of times, and never this fast at this size. The caution is generalization: the ultimatum worked because the team could credibly claim identification, and the attacker was recoverable by design choices the victim cannot control. The transferable lesson is the one the attacker's own parting message made — protocols that fund bounties properly are cheaper targets than protocols that don't.
Bitget names the breach vector: a zero-day in a third-party security product — and restores withdrawals across three days
Summary. The follow-up week to September's largest breach resolved two open questions. On the cause: in a September 29 briefing, Bitget's leadership disclosed that the attacker exploited a previously unknown zero-day vulnerability in a third-party security product the exchange used, obtained high-privilege internal credentials, and sent fake withdrawal instructions into the wallet backend disguised as routine administrative operations — using legitimate credentials throughout, testing with two small transfers at 18:31 UTC on September 24 that fell below risk-control thresholds, then escalating about thirty minutes later and deleting traces. Private keys and cold wallets were untouched. CEO Gracy Chen said preliminary indicators point toward a DPRK-linked group while an insider angle was not ruled out, and that full recovery is unlikely — citing the Bybit case, where roughly 3.5% of a $1.5B theft was recovered — with the bounty program offering 5% on frozen funds and 5% on recovered funds; Tether and Circle blacklisted a linked wallet immobilizing about $318,013, and NEAR Intents reported blocking over $50M and freezing about $500,000. On operations: withdrawals were restored in phases — Bitcoin from September 28, ether across five networks from September 29, USDT from September 30 — with the remaining assets, fiat and P2P services following later, and the exchange said it would replenish the User Protection Fund to at least $300M within a week, rebuilding headroom the $387.5M draw had cut to roughly $77M against the published $464M.
Commentary. The disclosure confirms what the architecture lesson implied: the entry point was not crypto at all but a supply-chain vulnerability in a security product — the irony of being breached through the tool deployed to prevent breaches. That reframes the vendor question every operator should now ask: what happens to our authorization pipeline if our security vendor has an unpatched flaw? For users, the week's usable fact is the restoration timeline: a phased exit on the exchange's schedule, three days end to end, with the fund absorbing the principal. The exit rehearsal argument does not need strengthening, but it just got a data point.
A spoofed Safe check turns a lending adapter's flaw into $305K from two wallets
Summary. At 15:08 UTC on October 1, an attacker exploited FlashLoopAdapter — a third-party module used to manage leveraged Aave v3 positions inside Safe multisig wallets — draining two Safes for a net loss of about 114.09 ETH, near $305K. The flaw was caller authentication: the adapter's open() and close() functions accepted a spoofed response to the check that confirms a legitimate Safe has enabled the module, letting the attacker's contract pose as a Safe, supply its own swap router and calldata, and invoke execTransactionFromModule on the victim wallets. A Morpho flash loan of roughly 1,335 WETH repaid the larger position's Aave debt, freeing about 1,306 weETH of collateral — a gross flow, not the theft — of which the attacker netted the 114.09 ETH after unwinding. SlowMist published its analysis on October 2 and classified the incident as a smart-contract vulnerability; Aave founder Stani Kulechov confirmed the protocol's core contracts had 'zero effect' from the exploit, and both affected wallets disabled the module after the attack.
Commentary. The transferable point is what an enabled module means. A Safe module can execute wallet transactions without the owner flow — that is its purpose — so enabling one is a standing delegation, and the delegation is only as strong as the module's own access control. Nothing here touched Aave's audited pools or Safe's core; the failure lived in an adapter nobody audits but the wallet that enabled it. The audit question for any Safe owner is short: list the modules enabled on your wallet, and for each one, ask who verified its caller checks — because this week the answer 'nobody' cost $305K.
Blast announces it is shutting down; users have until October 26 to withdraw through the normal interface
Summary. On October 2, the Ethereum L2 Blast announced it would wind down: the ongoing costs of operating the chain exceed its revenue, with what the team called no credible path to economic sustainability. The operational sequence matters for anyone with funds still on it: Blast first unwinds its Lido positions — roughly a week during which withdrawals are temporarily unavailable — then resumes withdrawals with the delay reduced to 24 hours; the normal withdrawal interface stays open until October 26, 2026, after which assets remain recoverable only by interacting directly with Blast's bridge contracts on Ethereum L1, with instructions promised before the cutoff. The backdrop is a steep decline: per CoinDesk reporting, the chain generated $1,793 in revenue last month, and total value locked had fallen from a peak above $2B in June 2024 to around $32M. The team apologized to users and developers and asked everyone to move assets — including PWA balances — to Ethereum mainnet before the deadline.
Commentary. An operator-led wind-down is the rare failure mode where nothing is stolen and users can still lose access through inaction. The mechanics are the point: the exit has stages, one of them pauses withdrawals for about a week, and after October 26 the easy path closes — anyone who has never interacted directly with L1 bridge contracts should not plan to learn on their own funds under deadline pressure. The standing rule this column keeps applying to custodians applies to chains too: hold on any platform what you can afford to have frozen, and when an operator publishes a wind-down schedule, treat the early deadlines as the real ones.
The SEC proposes a crypto custody framework — including limited adviser self-custody with two-person key authorization
Summary. On October 1, the SEC proposed new rules and amendments — File No. S7-2026-35 — establishing how registered investment advisers and regulated funds may custody crypto assets. Two provisions stand out for wallet holders. The proposal would, for the first time, permit limited self-custody by an adviser when no eligible third-party custodian is available, conditioned on a written determination made before taking self-custody and quarterly thereafter, documented private-key-management expertise, joint authorization of crypto transactions by at least two people, client assets held in segregated on-chain addresses, annual cybersecurity reviews, internal control reports from an independent accountant, and quarterly client statements. It would also let state-chartered trust companies serve as crypto custodians, largely codifying existing no-action positions, and would deem receipt of airdropped assets not to violate the custody rule under stated conditions. Chair Paul Atkins framed the package as 'a clear regulatory framework for the custody of crypto assets', with publication in the Federal Register on October 6 opening a comment period due December 7.
Commentary. The two-person authorization requirement is the private-sector version of a control this site has argued for all year: no single credential should be able to move funds. What makes this worth a wallet holder's attention is the direction of travel — the same week a bridge lost $5.4M to signing-key compromise and an exchange disclosed a credential-based breach, the regulator's answer to custody risk is key-management discipline, segregated addresses and joint control, which is the self-custody checklist in rule form. It is a proposal, not a rule; the comment clock runs to December 7.
OFAC adds seven TRON addresses tied to a Tren de Aragua ATM-jackpotting network — all of them exchange deposit addresses
Summary. The Treasury's OFAC designated a Tren de Aragua-linked financial network that allegedly hacked ATMs in the United States and laundered proceeds through crypto, adding seven TRON addresses to the SDN List alongside eight individuals and two Mexico-based companies. Per TRM Labs' analysis, the seven addresses received roughly $6.1M in total inflows since March 2022, with the largest single address at about $2.1M — and every one of them was a deposit address hosted at a centralized exchange, not a self-custody wallet. Treasury's account ties the network to ATM jackpotting attacks with $40.73M in reported US losses across more than 1,500 incidents as of August 2025, and to onward transfers of about $35M to a network charged with laundering roughly $1B. The designations carry secondary-sanctions exposure, and follow a pattern that now includes prior TRON designations from ISIS-K to the Xinbi Guarantee marketplace.
Commentary. Two details matter to ordinary TRON users. First, the sanctioned addresses were exchange deposit addresses — the laundering rail of choice was still a VASP account, which means screening and freezes work exactly where the funds concentrated. Second, the action is another entry in the standing list of reasons USDT's issuer-freeze capability exists: on TRON, a stablecoin balance is always one designation away from immobilization, which is a feature for enforcement and a risk factor for anyone holding large USDT balances in jurisdictions with sanctions exposure. For compliance teams the item is homework; for individuals it is context for why transfers to unknown addresses deserve the verification habit.
A macro whipsaw week ends higher: BTC closes near $86,500, ETF flows cool to $241M
Summary. The week's price action was driven by two macro prints. September 30's August PCE came in cooler than expected — core at 3.0% against a 3.3% consensus — pushing bitcoin to about $85,600, though ETF flows that day saw a $148.7M outflow that ended a nine-session inflow streak. October 2's September payrolls then collapsed to +29K against roughly 90K expected, with unemployment rising to 4.2% and October hike odds falling from above 70% to roughly 20–30%; bitcoin spiked to a weekly high near $87,200 before shedding more than $3,000 within hours to dip below $84,000, then rallied through the weekend to close near $86,500 — up about 2.2% on the week against the prior Sunday's close and its strongest weekly close since August. US spot bitcoin ETFs took a net $241M for the September 28–October 2 sessions — a third consecutive positive week but roughly 90% below the prior week's $2.39B — on a daily sequence of +$31.07M, +$66.19M, −$148.69M, +$102.67M and +$189.84M, with IBIT at +$450M, ARKB at +$25.5M and FBTC at −$168M; ether ETFs printed −$138M for the week.
Commentary. The security-relevant read is the same as last week with the sign flipped: volatility without a security shock. A week that traded an $82,600-to-$87,200 range on macro prints — while the year's costliest month's cleanup proceeded in the background — is the environment where scam volume rises, because every dramatic candle is an excuse for fake airdrops, fake restoration notices and urgency messaging. The number to keep is the flows decay: $2.39B to $241M in one week is a reminder that liquidity, like access, can be repriced faster than positions can be moved.
The carried threads: Liquid's status page still frozen in time, D'CENT silent, ASI unreconciled — and October opens cheap
Summary. None of the open files from prior editions moved materially this week. Blockstream's Liquid incident status page still carried its September 10 update at this edition's cutoff: block production and L-BTC transfers running, PAK-authorized peg-outs suspended while the BTC/L-BTC reserve restoration continues, with no date given and roughly 598.5 BTC still outstanding. DCENT has published no technical report on the App Wallet signing flaw and no quantification for any chain beyond the XRP Ledger, where 2,009,321 XRP across 1,552 wallets remains the only measured leg against a tracker figure near $6.57M. The ASI cluster's circulating-supply reconciliation across Ethereum, Cardano and BNB Chain has not appeared, and the FET deposit halts that Bitget and KuCoin imposed after the mint-key compromise remained in place. Nostra's Starknet money market and Zentra's lending markets remained closed with no reopening date.
Commentary. Absence of movement is information, and this week it reads differently against the calendar: September 28 marked the third week without a Liquid update, and the pattern across this ledger — quantified totals move up, not down — has not produced a counterexample yet. The week's own bookkeeping, by contrast, closed unusually clean: roughly $9.6M gross, $3.865M of it already returned, one incident contained at less than one ETH of actual loss, and no nine-figure event. October's opening week is the cheapest this record has printed since the week of September 7–13; whether that says more about attacker behavior or about operator defenses is exactly the question next week's edition should answer.
Three weeks ago the failures were about systems that decide what keys are asked to do; this week was about what happens when the defenders use the same systems at full speed. The largest defensive action in this record — 17,000 validators and $1.4B of staked ETH exited over a reward-routing compromise worth 0.36 ETH — is Bitget's backend story inverted: there, a compromised authorization pipeline moved $387.5M before anyone could react; here, an operator moved faster than the attacker could monetize and the loss printed at rounding error. NEAR Intents ran the same playbook in miniature — automated pause, hour-scale patch, full return. Gravity Bridge is the reminder that none of this is solved: signing keys leaked, $5.4M left, and the entry point is still unpublished. Meanwhile the regulatory side moved toward the same conclusions the incidents keep demonstrating — the SEC's custody proposal reads like the incident ledger converted into rule text: segregated addresses, two-person authorization, documented key management.
As always: if an incident in this review is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.
Frequently Asked Questions
I have funds on Blast. What exactly should I do and by when?
Move your assets to Ethereum mainnet through Blast's normal withdrawal interface before October 26, 2026 — that includes any balances in the Blast PWA. Expect one complication: Blast first unwinds its Lido positions, which takes about a week and during which withdrawals are temporarily unavailable even after the delay is reduced to 24 hours. After October 26, your funds are not lost, but they are only recoverable by interacting directly with Blast's bridge contracts on Ethereum L1, which is a technical process you should not attempt for the first time under deadline pressure. Use the official Blast channels for the promised instructions and verify any address before sending.
Was my MetaMask wallet affected by the staking incident?
No, based on everything disclosed: MetaMask states it found no indication that wallets or user funds were affected, because the compromise sat in the validator infrastructure behind its non-custodial staking product — not in wallet custody. MetaMask does not manage withdrawal keys for staked ETH, so the intruder could not move principal. If you staked through MetaMask, your cost is potential foregone rewards during the exit and re-entry cycle, which Lido estimates at up to about 45 days; no action is required from you. The one real risk right now is phishing: expect fake 'security refund' or 'wallet verification' messages, never share your seed phrase, and use MetaMask's official channels for updates.
What does the Gravity Bridge hack mean for anyone who used the bridge?
The bridge is halted while the team investigates, and no post-mortem has been published, so the exact entry point is unconfirmed — the early read from Specter and PeckShield is compromised signing keys rather than a contract bug. If you held bridged assets, your exposure runs through the bridge's own remediation. The general lesson is about bridge selection: a bridge that authorizes transfers with validator signatures is only as secure as those keys' custody, which no audit badge captures. Size cross-chain positions to what you can accept losing to a key-management failure at the bridge, and prefer routes where the bridge operator publishes its key ceremony and incident history.
Should I trust exchanges more or less after Bitget's zero-day disclosure?
Neither — price the two risks separately, as before. The disclosure actually completes the picture: the breach came through a third-party security product's unpatched flaw and high-privilege credentials, not through keys or cold storage, and the response ran from freeze to phased restoration in three days with the fund absorbing the principal. What did not improve is access risk: users still could not withdraw for days on the exchange's schedule. The practical posture is unchanged — keep working balances on the venue, self-custody the rest, and rehearse a quarterly withdrawal so that a freeze is an inconvenience rather than a crisis.
Did anything actually get recovered this week?
Yes — the week's second-largest theft came back in full. NEAR Intents' $3.865M was returned within about 24 hours of the team publicly identifying the attacker and setting a 48-hour deadline, with roughly 34.59 BTC arriving at the published recovery address; the team closed its investigation and pointed researchers at bug bounties. Everywhere else, the picture is the usual mix: MetaMask's loss was contained at roughly 0.36 ETH by design rather than recovery, Gravity Bridge's $5.4M is outstanding with part of it laundered through ChangeNow and Binance, and the carried items — Liquid's 598.5 BTC, the rsETH held by the front-running bot, Balancer and Zentra — remain outstanding.
This article is based on public data and official disclosures. Figures were last reviewed on October 05, 2026. Values change with network conditions; always verify against the primary source before making decisions.
MetaMask's own user updates (September 30 and October 1, 2026): security incident affecting part of its infrastructure, no indication wallets or user funds affected, precautionary exit of validators in its non-custodial staking business, withdrawal keys never managed on behalf of clients, phishing warning. Lido's own governance-forum disclosure (research.lido.fi, October 1, 2026): exits completing by end of October 7, exit-withdrawal-re-entry cycle up to ~45 days, target-limit proposals (targetLimit = 0) for MetaMask Staking's node-operator entries, ad hoc reserve fund above 6,750 stETH, no action required from stETH holders. On-chain analysis by researcher 0xKaden (October 2026): block rewards from 18 of 19 affected validators paid to a Tornado Cash-funded account, ~0.36 ETH diverted.
Specter's own alert and PeckShield's breakdown (October 3, 2026): Gravity Bridge signing-key compromise, ~$5.4M total — ~$4.3M USDC, 274 WETH (~$553K), $434K USDT, 14.16 PAXG (~$64K) — destination address ending 7C62da1F9, drained contract ending 1F2D906, laundering via ChangeNow and Binance, theft wallet holding ~2,100 ETH (~$4.23M) at report time; Gravity Bridge's own X statements (October 3, 2026) halting validators and the bridge; The Block's report (theblock.co, October 2026).
NEAR Intents' own statements and GM Alex Shevchenko's posts (October 1–3, 2026): Omni deposit/withdrawal and smart-contract interaction bug, ~$3.865M USDT from a BNB Chain hot wallet in five withdrawals over ~six hours, SHIELD auto-pause, patch within ~1 hour, eleven networks restricted ~12 hours, treasury compensation pledge, 48-hour ultimatum with three recovery addresses, full return within ~24 hours, ~34.59 BTC received, investigation closed; ZachXBT's tracing through KuCoin into Bitcoin; carried by Cointelegraph and CoinDesk (October 2026).
Bitget's own briefing and notices (September 28–30, 2026): zero-day in a third-party security product, high-privilege credentials, fake withdrawal instructions disguised as routine admin operations, two sub-threshold test transfers at 18:31 UTC September 24, traces deleted, private keys and cold wallets unaffected; CEO Gracy Chen's September 29 statements carried on Cointelegraph's Chain Reaction (preliminary DPRK indicators, insider not ruled out, recovery outlook citing Bybit's ~3.5% benchmark, 5% + 5% bounty structure); Tether and Circle blacklisting immobilizing ~$318,013; NEAR Intents' report of blocking over $50M and freezing ~$500,000; phased withdrawal restoration September 28–30 and the pledge to replenish the User Protection Fund to at least $300M within a week.
SlowMist's own analysis (October 2, 2026): FlashLoopAdapter caller-authentication flaw in open()/close(), spoofed Safe module-enabled check, execTransactionFromModule abuse, Morpho flash loan of ~1,335 WETH, ~1,306 weETH withdrawn gross, net ~114.09 ETH (~$305K) from two Safes; Defimon's 15:08 UTC October 1 detection; Aave founder Stani Kulechov's statement that Aave v3 core contracts were unaffected; carried by Cointelegraph and CryptoSlate (October 2, 2026).
Blast's own shutdown announcement on X (October 2, 2026): operating costs exceed revenue, no credible path to sustainability, Lido unwind of ~1 week with withdrawals temporarily unavailable, delay reduced to 24 hours, normal interface open until October 26, 2026, direct L1 bridge-contract withdrawals afterward; CoinDesk's reporting of $1,793 last-month chain revenue and TVL from above $2B (June 2024) to ~$32M; Cointelegraph's confirmation of the withdrawal sequence.
The SEC's own proposing release (October 1, 2026), File No. S7-2026-35, Releases IA-7023 and IC-36353, published in the Federal Register October 6, 2026 (comments due December 7, 2026): adviser crypto custody framework, limited self-custody conditions (quarterly no-custodian determination, documented key-management expertise, two-person joint authorization, segregated addresses, annual cybersecurity reviews, accountant internal-control reports, quarterly statements), state trust companies as custodians, airdrop treatment; Chair Paul Atkins' statement.
The Treasury Department's own OFAC designation announcement (September 30–October 1, 2026): Tren de Aragua-linked ATM-jackpotting network, seven TRON addresses added to the SDN List with eight individuals and two Mexico-based companies; TRM Labs' analysis: ~$6.1M inflows since March 2022, largest address ~$2.1M, all seven hosted as centralized-exchange deposit addresses, $40.73M reported US losses across 1,500+ incidents as of August 2025, ~$35M onward transfers.
SoSoValue's US spot ETF flow table (September 28–October 2, 2026 sessions): +$31.07M, +$66.19M, −$148.69M, +$102.67M, +$189.84M — a $241M week, the third consecutive positive week, ~90% below the prior week's $2.39B; IBIT +$450M, ARKB +$25.5M, FBTC −$168M; ether ETFs −$138M with FETH −$74M. Public market data for the week's bitcoin range ($82,566 low, $87,220 high, ~$86,500 close) and the macro prints: August PCE core 3.0% vs 3.3% expected (September 30) and September payrolls +29K vs ~90K expected with 4.2% unemployment (October 2).
Blockstream's own Liquid incident status page (latest update September 10, 2026) and DCENT's published notices (September 16–20, 2026): carried threads with no material movement by this edition's cutoff.
OSW
The OpSecWallet Research Team
We are an independent research desk focused on wallet security and safe on-chain operation. Every report is written from public data and official security disclosures, cross-checked against primary sources, and reviewed for accuracy before publication. We never ask readers for keys, seeds or transfers.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.