Wallet Security Data Report — August 31 – September 6, 2026

This is the weekly data report: what was taken, from whom, by what method, and how that compares with the weeks before it. Every figure is traced to a public disclosure or security-firm analysis, and where a number is an estimate we say so.

This edition covers August 31 – September 6, 2026. Cost and price figures are indicative reference values from public marketplaces, verified on September 8, 2026.

1. Headline Numbers

One incident dominates everything. Roughly 3,996 BTC — about $320M at ~$80,000 per bitcoin — left the Liquid Network federation wallet on September 6, after roughly 4,000 L-BTC was sent to SideSwap's authorised peg-out service. Liquid said the Peg-out Authorization Key was not compromised and that no other keys were; the network paused new transactions and disabled public bridge nodes while federation members responded. The federation reserve fell from about 4,200 BTC to roughly 197 BTC.

Everything else was ordinary. On the protocol side we track two further confirmed drains inside the window: Notional Finance at ~$1.73M (a legacy V1 escrow contract, September 4) and Reddio's RedSonic Vault at 9.25 ETH (September 5). Combined tracked direct losses for the window: approximately $321.8M, of which the Liquid incident is about 99.5%. Excluding it, the week's tracked losses come to roughly $1.8M — about 77% below the prior week's ~$7.7M.

2. Incident Ledger

Two rows are deliberately not counted as losses. The Coldcard movements are laundering of thefts that began on July 30, not new losses inside this window. The Olas proposal placed 40.196 ETH at risk but was not executed, and the Trezor exposure is contact data rather than funds. Counting rules are stated here so the totals can be reproduced.

3. Attack-Type Distribution

Share of the week's ~$321.8M tracked direct losses.

A single category holding 99.5% of the total is unusual and worth naming: it means this week's distribution tells you almost nothing about attack trends and a great deal about concentration risk. The more informative cut is the ex-Liquid view, where the week's two confirmed protocol drains were both accounting and type-handling bugs — an unsafe integer downcast and a double-counted collateral balance — rather than stolen keys, drained approvals or compromised signers.

4. Week Over Week and Against the Baseline

The four-week sequence reads >$37M, then ~$12.3M, then ~$7.7M, then ~$321.8M — with the caveat, detailed above, that roughly $269M of the final figure was returned on September 7, leaving about $47M outstanding from the Liquid incident. The three-week decline that preceded this week is intact in the ex-Liquid series — ~$1.8M would be the fourth consecutive fall — but the headline number is dominated by a single infrastructure event whose final size depends on whether the funds are returned.

For annual context, DeFiLlama data cited this week put losses between September 2025 and September 2026 at $1.732B, with first-half 2026 theft and fraud above $1B against $2.3B in the first half of 2025.

5. What Moved, What Did Not

• Up: tracked losses (one settlement-layer incident); the share of weekly losses attributable to infrastructure rather than user-side theft (~99.5%).
• Down: losses excluding that incident (~$1.8M, about −77%); the number of confirmed in-window protocol drains (2, against 4 the prior week).
• Unchanged: the user-side picture — drainer delivery via fake platforms and malicious extensions, clipboard hijacking, and address-poisoning targeting all continued at their usual pace.
• Operation costs on TRON: the cheapest 65,000-energy, one-hour rentals were quoted near 21 SUN per unit as of September 8, putting a standard USDT transfer at about 1.37 TRX (roughly $0.45 at a TRX price near $0.33) on the cheapest provider and up to about 2.47 TRX (about $0.82) on others — roughly 79% below the 6.5 TRX cost of burning TRX for the same transfer, and up to about 90% below it on multi-day bulk rates. Renting TRON energy keeps test transfers cheap enough to use every time.

6. Reading the Numbers Carefully

Three cautions on this week's figures. First, the Liquid number is a gross withdrawal, not a confirmed permanent loss: roughly $269M of it was returned on September 7, leaving about $47M outstanding, so the week's realized loss sits between those two figures depending on the final outcome. Second, the Coldcard movements inside the window are laundering of an earlier theft, and counting them as new losses would double-count roughly $7.7M. Third, several user-side events this week — a dismantled drainer ring, a disrupted botnet, a batch of malicious extensions — produced confirmed mechanisms but no reliable loss totals, so they are described rather than counted.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.