This is our weekly review of wallet security: the incidents and disclosures that defined the past seven days, what actually happened in each case, and the one operational habit that would have helped. Every item is based on a disclosed source — security-firm reporting, official statements or on-chain investigators — and we label anything not yet confirmed.
This edition covers September 7–13, 2026.
1. The Week at a Glance
3,400 BTC
Returned to the Liquid federation wallet
≈$269M, block 965,950, Sept 7
$52M+
Restrained in the Xinbi enforcement action
OFAC and DOJ, Sept 9
36%
Share of Osmosis allBTC left unbacked
Nomic double-spend, Sept 9
46.1B
Fake syBTC minted on the Symbiosis bridge
≈$336k realized, Sept 11
This was the week the money came back — and the week the pattern behind the theft became impossible to ignore. Roughly $269M of the Liquid Network withdrawal returned to the federation wallet on September 7, five days after roughly 4,000 unbacked L-BTC was converted through a valid peg-out. But while that story resolved, two more bitcoin wrappers broke the same way: a double-spend in Nomic's forwarding mechanism left about 36% of Osmosis's alloyed BTC without backing, and an unauthorized mint on Symbiosis's Bitcoin bridge created 46.1 billion synthetic tokens. Off the chain, US authorities moved against Xinbi Guarantee — a marketplace that had processed an estimated $24 billion for the scam economy — restraining over $52M and seizing its coordination channels.
Key takeaways
Bitcoin itself was not attacked in any of the three wrapper incidents — the flaws sat in the software that issues receipts for bitcoin held elsewhere.
Recovery took three different shapes this week: a negotiated return (Liquid), a validator freeze pending seizure (Osmosis), and a partial recovery plus bounty (Symbiosis).
Enforcement reached infrastructure this time, not just individuals: messaging channels, payment apps and 49 wallets.
An unbacked token can trade normally for weeks before anyone notices — backing is a claim you should verify, not assume.
2. Story Review
#1Sep 7InfrastructureImpact High
Liquid Network: 3,400 BTC (~$269M) returned in block 965,950; roughly 598.5 BTC still held
Summary. After Blockstream sent a cryptographically signed on-chain message confirming that its bridge nodes had been patched, the actors behind the September 6 withdrawal returned 3,400 BTC — about $269M, roughly 85% of the ~3,996 BTC taken — to the Liquid federation wallet in Bitcoin block 965,950 on September 7. Roughly 598.5 BTC, about $47M, remains in their address, and no public agreement establishes that the retained share is an approved bounty. The on-chain negotiation had been explicit: in an earlier block the actors wrote 'Please fix the bug first… Make sure every node is patched. Then we will transfer the money back safely after confirming the fix', with technical details encrypted to Blockstream's published PGP key. Liquid's incident report on September 8 described a range-proof verification cache flaw in Elements that let unbacked L-BTC pass checks; the network remained paused while a chain split was resolved and a coordinated restart prepared, and an emergency Elements release (v23.3.4) was readied. SideSwap, whose valid peg-out authorization moved the funds, returned its 0.1% fee — about 4 BTC — to the federation.
Commentary. The return vindicated the negotiation mechanics but not the holders' position: for six days, backing for L-BTC was at 5%, and its restoration depended entirely on the actors' choice. If you hold a federated or bridged asset, the reserve behind it is part of your risk model — and the honest label for these actors remains the one Liquid itself used: purported white hats.
US strikes Xinbi Guarantee: $52M+ restrained, Telegram channels seized, a $24B laundering marketplace sanctioned
Summary. A coordinated US action dismantled the infrastructure of Xinbi Guarantee, a Chinese-language marketplace that US Treasury said has processed more than $24 billion in crypto and fiat since around 2022 for the Southeast Asian scam economy. On September 7 a federal court authorized the seizure of the Telegram channels hosting the marketplace; on September 9 the Justice Department's Scam Center Strike Force seized two wallets holding about $12M and sought restraints on 47 more, bringing restrained crypto above $52M. OFAC designated Xinbi a significant transnational criminal organization and sanctioned SafeW Technology (Singapore) and Anwen Technology (Cambodia), whose encrypted messaging app and XinbiPay wallet had absorbed operations as scrutiny grew. Chainalysis analysis showed DPRK-linked actors — including funds from the $1.5B Bybit and $235M WazirX thefts — moved tens of millions through Xinbi's vendor network using specialized 'Black U' launderers who swap traceable stolen coins for stablecoins from other illicit streams. Tether assisted the investigation; the UK had sanctioned Xinbi in March.
Commentary. This is enforcement aimed at the layer between thieves and cash: the escrow, the chat channels, the payment apps. It does not recover what already left — but it raises the operating cost of every network that depends on marketplace infrastructure like this.
Nomic double-spend leaves 36% of Osmosis allBTC unbacked; validators freeze 22.65 BTC in the attacker's address
Summary. Osmosis froze minting, redemption, deposits and withdrawals for its alloyed Bitcoin token (allBTC) on September 9 after disclosing an exploit on the Nomic chain, a Cosmos-based bitcoin wrapper. A flaw in Nomic's custom deposit-forwarding mechanism let an attacker double-spend nBTC and send false vouchers across IBC into Osmosis; 39.84 fake nBTC — roughly 36% of allBTC's backing, valued near $3.15M — entered the pool. Neither the IBC protocol nor the Osmosis chain itself was breached. An emergency chain upgrade (v31.1.0) froze 22.65 BTC still sitting in the attacker's address before it could move, leaving a residual gap of about 17.19 BTC that Osmosis proposes to cover from its community pool, with a governance vote to seize the frozen funds. On-chain researcher Rarma traced the main exploitation to June 25 — the fake nBTC had circulated for weeks before disclosure — with about 671.1 ETH ultimately sent to Tornado Cash.
Commentary. The uncomfortable detail is the timeline: the counterfeit receipts were minted in June and nobody noticed until September. A wrapped asset is only as good as the verification behind its deposits — and for weeks, a third of this pool's backing was a bookkeeping fiction.
Summary. At approximately 04:28 UTC on September 11, an attacker exploited Symbiosis's native Bitcoin bridge, with Blockaid detecting an unauthorized call to the BridgeV2 smart contract on BNB Chain that minted roughly 46.1 billion syBTC — over 2,000 times Bitcoin's entire supply — to a fresh wallet. Liquidity limits capped the damage: the attacker converted only about 4.39 WBTC through Uniswap V4 on Ethereum, realizing roughly $336,000, before monitored pools were halted. Symbiosis suspended all native Bitcoin routing — other routes, including TRON and TON networks, remained operational — recovered about 15 BTC (~$1.1M) into a team-controlled multisig, and offered a 20% white-hat bounty with a September 13 deadline. The deadline lapsed without acceptance, and the bounty was redirected to informants providing intelligence leading to recovery. The protocol, with roughly $7M in total value locked, is building a reimbursement framework for affected liquidity providers.
Commentary. The third bitcoin-wrapper unbacking in five weeks, and the smallest realized loss — saved not by the contract but by shallow liquidity. If you provide liquidity to a bridge or hold its synthetic asset, the depth that caps an attacker's exit is also what caps your own.
Zentra Finance: ~$143k drained from its ctUSD reserve on Citrea; bounty offered with a September 14 deadline
Summary. Zentra Finance reported that an attacker drained approximately $143,000 from its ctUSD reserve on Citrea Mainnet at 12:59:37 UTC on September 9, identifying the exploiting transaction and pausing its lending markets. A post-mortem published September 11 traced the affected funds to a specific wallet, offered a bounty with terms to be negotiated, and set a September 14, 12:00 UTC deadline for the holder to respond — after which the protocol said it may pursue technical, on-chain and legal measures, with the bounty redirected to informants. The protocol has not yet disclosed the specific vulnerability or how the reserve was compromised.
Commentary. Small in dollars, but note the response template now standard across incidents: freeze, trace, on-chain offer, deadline, escalation path. Borrowers should assume lending markets stay shut until the post-mortem lands — a paused market is the protocol protecting the remaining reserves.
GoodDollar, the UBI protocol paying 963,000 users daily, loses ~$107k of reserves to a Superfluid bug
Summary. GoodDollar disclosed on September 9 that a malicious Super App had bypassed Superfluid's liquidation safeguards on Celo, keeping insolvent G$ balances alive so the excess tokens could be exchanged against the protocol's reserves: 86,588 cUSD left the Celo reserve and roughly $20,857 the XDC reserve, with external G$ liquidity pools also affected at undisclosed amounts. Superfluid's Security Council said the vulnerability was specific to its Celo deployment; it had detected insolvent accounts on September 3, traced the failure on September 4, and deployed a hotfix the same day. GoodDollar said its reserves were not depleted thanks to monitoring alerts and emergency pauses, but reserve operations and bridging remain paused while both teams prepare incident reports — including one explaining how a Celo-only bug produced an outflow on XDC, which remains unexplained.
Commentary. The reserve behind a daily-income program is a custody pool like any other, and its failure lands on the least sophisticated users. The unresolved XDC outflow is the part to watch: an unexplained loss in a 'specific-to-Celo' incident means the accounting is not yet closed.
Balancer V1: the September 8 cooperation deadline lapses with no public response from the exploiter
Summary. The deadline Balancer set for the wallet behind the August 31 V1 pool exploit — roughly $234,000 taken through a rounding bug that let 4,408.8 pool tokens be minted for a single satoshi of WBTC — passed at 21:00 UTC on September 8 with no public indication the operator responded. Balancer's September 3 on-chain notice had offered a bounty for returning the funds, with contact via Blockscan and verification involving SEAL911, Hypernative and Balancer's legal team; failing that, it committed to 'technical, on-chain, and legal measures' and redirecting the bounty to informants. The affected V1 contracts are immutable and non-pausable — liquidity providers had to exit themselves — and the same rounding-logic risk was documented in a Balancer GitHub issue back in January 2020, six years before this exploitation.
Commentary. Legacy does not mean safe: this code was known-fragile since 2020, unfixed because immutable, and still holding money in 2026. If your funds sit in a deprecated contract, nobody can patch or pause it for you — the exit is the security action.
Core Lightning Docker images shipped without their fixes — and reported the patched version anyway
Summary. A packaging flaw in the Core Lightning project's Docker distribution left node operators exposed: four published image tags served containers whose software reported version v26.06.7 but did not actually contain that version's security fixes. The project advised operators to verify image digests rather than trust version strings before a planned source disclosure. The issue follows the project's late-August emergency lock-down of its repository amid a security investigation, and it lands on the same population that most needs timely patches — routing-node operators whose channels are directly exposed to the network.
Commentary. Version strings are claims, not proofs. If you run financial infrastructure from container images, pin and verify digests — a container that reports the right version but carries the wrong code defeats the entire patch-verification habit.
Harmony proposes abandoning its own chain for Ethereum — and the September 10 exit deadline lands this week
Summary. Harmony, a layer-1 blockchain launched in 2019, published its proposal to migrate to Ethereum and wind down its independent network on September 6 — one day before this review's window opens — but the operative deadline falls squarely inside it: smart-contract holders must exit multisig safes, liquidity pools and on-chain applications by September 10, when validators can also begin shutting down their nodes. The plan takes a final network snapshot and airdrops replacement ONE tokens to the same wallet addresses on Ethereum, with no claim required; tokens inside smart contracts cannot be migrated. The proposal follows an August exploit in which an attacker minted trillions of unauthorized ONE and the chain was rolled back to a checkpoint, discarding over 109,000 regular transactions.
Commentary. Chain shutdowns are a wallet-user risk that never makes the loss tables: bridges close, DEX liquidity evaporates, and positions that cannot be exited in time are simply stranded. If you hold assets on any chain showing wind-down signals, treat the exit deadline as the only deadline that matters.
On-chain ripples from the Xinbi action: outflows surge and rival marketplaces start purging launderers
Summary. Enforcement pressure showed up in the flows within days. Bitrace reported that daily USDT withdrawals from a Xinbi sub-guarantee platform, which had run about $389,000–$564,000 between September 1 and 7, jumped to roughly $1.28M on September 8 and $1.81M on September 9 as merchants rushed to exit ahead of further freezes, with another $708,125 leaving by September 10. Telegram independently banned Xinbi's main business channels and invalidated large numbers of its TNS domains following the Tether-assisted action. The panic spread to competitors: Fulilai Guarantee began removing money-laundering merchants — including 'card-to-USDT' and 'cash car' services — from its public groups, and its wallet recorded about $9.3M in outflows after the sanctions. Reporting also noted Xinbi had been exploring greater use of USDD as USDT freezes tightened.
Commentary. Sanctions change behavior on a schedule you can watch on-chain. For compliance teams and exchanges the practical read is the same as for investigators: money fleeing a designated network has a destination, and the destinations are identifiable.
Three incidents this week — Liquid's return aside, Nomic and Symbiosis — belong to one family: attacks on the software that issues receipts for bitcoin held somewhere else. None of them broke Bitcoin; all of them broke the accounting between the deposit and the token. That distinction is now the most important thing a holder of any bridged or wrapped asset can internalize, and it is the subject of this week's deep dive. Meanwhile the enforcement side showed it can reach coordination infrastructure — channels, wallets, payment apps — even when the stolen funds themselves are long dispersed.
As always: if an incident in this review is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.
Frequently Asked Questions
Is my Liquid Network (L-BTC) position safe now that 3,400 BTC was returned?
The federation wallet's backing improved from roughly 5% to most of the withdrawn amount after the September 7 return of 3,400 BTC, but the network remained paused while a chain split was resolved and a coordinated restart prepared, and roughly 598.5 BTC (~$47M) remains with the actors with no published bounty terms. Full 1:1 redeemability is not restored until the bridge restarts and the reserve gap is closed — follow official Liquid channels before sending new funds.
I hold allBTC on Osmosis. What happened and what should I do?
A double-spend flaw on the Nomic chain let an attacker inject 39.84 fake nBTC — about 36% of allBTC's backing. Osmosis froze minting, redemption, deposits and withdrawals, froze 22.65 BTC in the attacker's address via an emergency upgrade, and plans a governance vote to seize those funds and cover the remaining ~17.19 BTC gap from the community pool. Trading in existing pools stayed open while redemptions were paused; the protocol has advised holders to await the governance outcome rather than swap into thin liquidity.
What is a bitcoin 'wrapper' and why did three of them fail in five weeks?
A wrapper is software that holds real bitcoin (or claims to) and issues a token representing it on another chain. The wrapper — not Bitcoin — verifies deposits and controls issuance, so that verification and issuance logic is the attack surface. Liquid's flaw let unbacked L-BTC pass range-proof checks, Nomic's forwarding mechanism let one deposit be credited twice, and Symbiosis's BridgeV2 accepted an unauthorized mint. Three different codebases, one shared weakness: the trust boundary sits in code most users never see.
Does the Xinbi action affect ordinary wallet users?
Indirectly and mostly positively. Xinbi was infrastructure for laundering stolen funds — including money from major exchange hacks — so disrupting it raises attackers' cash-out costs. The immediate on-chain effects were defensive: merchants moving funds out of designated networks and rival marketplaces purging laundering services. Ordinary users' wallets were not a target of the action.
This article is based on public data and official disclosures. Figures were last reviewed on September 15, 2026. Values change with network conditions; always verify against the primary source before making decisions.
Liquid Network's own incident report (September 8, 2026) with The Block, Decrypt and Bitcoin Magazine: recovery of 3,400 BTC after the bridge exploit, block 965,950 return, PGP-signed on-chain negotiation.
Liquid Network's own incident report (September 8, 2026, 19:10 UTC) and Blockstream's incident status page: network paused, chain split resolution, coordinated restart preparation.
Cointelegraph (September 10, 2026): DOJ Scam Center Strike Force seizures, OFAC designation of Xinbi, SafeW and Anwen Technology; Tether assistance; TRM Labs commentary.
CryptoSlate (September 10, 2026): Bitrace outflow data for Xinbi sub-guarantee platforms, Fulilai merchant purge, USDD exploration.
Osmosis's own governance proposal and freeze notice (September 10, 2026) with Nomic's disclosure: allBTC freeze, double-spend, 39.84 nBTC compromised, 22.65 BTC frozen, community-pool plan; BlockFence's Rarma tracing: June 25 minting, 671.1 ETH to Tornado Cash.
Symbiosis's own recovery and bounty notices with Blockaid's detection alert (September 11–13, 2026): Symbiosis Bitcoin Bridge exploit, 46.1B syBTC mint, ~$336k realized, 15 BTC recovered, 20% bounty and September 13 deadline lapse.
Zentra Finance's own post-mortem (September 11, 2026): ctUSD reserve exploit on Citrea and the September 14 bounty deadline.
CryptoSlate (September 10, 2026): GoodDollar reserve losses via Superfluid Celo bug; Superfluid Security Council timeline (detected Sept 3, hotfix Sept 4).
Balancer's own on-chain notice (September 3–4, 2026): V1 pool exploit, bounty terms and the September 8 deadline; the project's own January 2020 GitHub issue documenting the same rounding-logic risk in immutable, non-pausable legacy pools.
CryptoSlate (September 9–10, 2026): Core Lightning Docker image version mismatch.
Harmony's own announcement (September 6, 2026) with Decrypt's coverage: mainnet shutdown and ONE-to-Ethereum migration proposals, September 10 exit deadline for smart-contract holders.
OSW
The OpSecWallet Research Team
We are an independent research desk focused on wallet security and safe on-chain operation. Every report is written from public data and official security disclosures, cross-checked against primary sources, and reviewed for accuracy before publication. We never ask readers for keys, seeds or transfers.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.