Weekly Safety Intelligence — Week of September 14–20, 2026

This is our weekly intelligence briefing. Each edition answers the same five questions about the week in wallet security: how much was lost, what the pattern is, what enforcement did, what a wallet user should actually change, and what to watch next. The discipline matters because weekly noise hides weekly signal.

This edition covers September 14–20, 2026.

1. How much was lost this week?

Roughly $20.9M in confirmed direct losses across nine quantified incidents, with no recoveries inside the window — about eleven times the prior week's ~$1.9M net. Two incidents produced 68% of the total: a $7.8M rsETH position drained from a Gnosis Safe through an enabled executor module, and a signing flaw in the D'CENT App Wallet that a security tracker carries at ~$6.57M, with only the XRP Ledger leg quantified so far — 2,009,321 XRP across 1,552 wallets, against an XRPL community count that has since widened to 6,160 addresses and 9.3M XRP. Nostra's ~$3.5M and about $2.54M in realized proceeds from the ASI cluster mint compromise complete the top of the table. The remaining five incidents were all under $400,000, and four of those were under $53,000 — which is worth stating plainly: the long tail of small failures did not get bigger this week, the top of the table did.

2. What is the pattern this week?

Last week the failures were about software issuing receipts. This week they are about software signing, authorizing and pricing — three functions that sit between a key and a payout, and all three failed with valid credentials. A mobile app signed with a recovery phrase that should never have been in a phone, and 1,552 wallets emptied in two hours. A whitelisted module executed caller-supplied code inside a Safe, so the owners' signatures were never required. A stolen bridge authorizer key produced a signature the system correctly accepted, and mint authority did the rest — 408.53 million NTX is roughly 42% of that token's documented supply, created in one transaction. A lending market priced collateral from a pool the attacker had seeded minutes earlier. Not one of the four required breaking a cryptographic primitive. The uniform weakness is the gap between holding a key and controlling what it is allowed to sign: modules you enabled, apps you typed a phrase into, keys held by a project team, and price feeds nobody cross-checks.

3. What did enforcement do this week?

The week's most consequential action was attribution rather than seizure. Seven agencies — Japan's NPA and National Cybersecurity Office, the FBI, the US Department of Defense Cyber Crime Center, Australia's ASD Cyber Security Centre, and Germany's BND and BfV — published a joint advisory naming WaterPlum (the group the industry calls "Contagious Interview") and tying it, with some North Korean IT workers, to the 313 General Bureau of the Munitions Industry Department. The numbers attached to that name are the point: at least 30,000 infected devices in more than 100 countries, funds or credentials taken from over 7,000 wallets, and about $10.71M — the amount Japanese investigators traced leaving victim accounts — moved to North Korea between December 2025 and July 2026 through fake job interviews. Japanese authorities also dismantled a laptop farm run by a local enabler — the first such takedown in the country, and a move against the revenue infrastructure rather than the theft itself. Elsewhere, enforcement showed its limits: Blockstream stated it would not pay a ransom for the return of the remaining 598.5 BTC, and the UK Information Commissioner's Office opened an investigation into Revolut's data disclosure while a $3M Monero extortion clock ran out without a confirmed payment or a confirmed sale.

4. What should a wallet user change this week?

Four changes cover almost everything that happened this week, and none of them is exotic. Treat a recovery phrase that has touched software as burned. The D'CENT condition is not about which device signed; it is about where the phrase went. If you ever restored a hardware wallet by typing its phrase into a phone or desktop app, generate a new phrase on a clean device and migrate — re-entering the old phrase on a new device recreates the same keys. Audit what your smart wallet is allowed to do. A Safe's security boundary is every module and helper contract you have enabled, and a module that executes caller-supplied data is a signing key. Remove what you do not use. Never run interview, freelance or "testing" code on a machine that holds keys. The advisory's malware set is designed to collect exactly that, and a disposable environment costs nothing compared with a seed phrase. Check the collateral and feeds behind anything you lend into. A market whose collateral price comes from a single aggregator pool, where the collateral token's entire float is smaller than the loan, is mispriced by construction.

5. What is coming next?

Five in-window threads resolve next. First, D'CENT's technical determination: which chains besides the XRP Ledger saw drained addresses, whether the root cause is ever published, and whether the company moves from tracing to compensation — it has committed to neither a total nor a reimbursement so far. Second, the ASI cluster's supply reconciliation: Fetch.ai, SingularityNET and World Mobile Chain still owe a reconciled circulating-supply table across Ethereum, Cardano and BNB Chain, exchanges are holding deposits, and the compromised signing keys were largely unreplaced at last report. Third, Revolut: whether the data is sold, whether the Information Commissioner's Office report adds scope, and whether the affected 680 customers are told anything further. Fourth, the paused venues — Nostra's reconciliation and recapitalisation, Blink's post-mortem amount, Zentra's lapsed deadline, and Liquid's peg-out restoration, which the federation says depends on confirmed 1:1 backing plus independent security reviews, not on a date. Fifth, the follow-on question from last week that still has no answer: whether Nomic's and Symbiosis's technical reports show the same fix-versus-deployed-build gap that Liquid's did.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.