Weekly Safety Intelligence — Week of September 7–13, 2026

This is our weekly intelligence briefing. Each edition answers the same five questions about the week in wallet security: how much was lost, what the pattern is, what enforcement did, what a wallet user should actually change, and what to watch next. The discipline matters because weekly noise hides weekly signal.

This edition covers September 7–13, 2026.

1. How much was lost this week?

Roughly $3.7M in confirmed direct losses across four incidents — about $1.9M net after 22.65 BTC was frozen in the Nomic attacker's address pending a seizure vote. The week's largest single number was a recovery, not a loss: 3,400 BTC (≈$269M) returned to the Liquid federation wallet on September 7, cutting that incident's outstanding amount to roughly 598.5 BTC (about $47M) — which still exceeds every loss this week combined. Set against the prior week's ex-Liquid baseline of roughly $1.8M, this week was essentially flat: the market's quiet-state rate since late August sits near $2M of confirmed direct losses per week.

2. What is the pattern this week?

Three bitcoin wrappers have now broken the same way in five weeks: Liquid (September 6, unbacked L-BTC through a range-proof cache flaw), Nomic (September 9, a double-spend in deposit forwarding that left 36% of Osmosis's allBTC unbacked), and Symbiosis (September 11, an unauthorized BridgeV2 mint of 46.1 billion syBTC). None of the three involved a stolen key, a phished seed or a malicious approval — every flaw sat in the software that verifies deposits and issues receipts for bitcoin held elsewhere. The differences are instructive: Liquid's bug let fake tokens pass a validity check; Nomic's let one deposit be credited twice; Symbiosis's let a signature mint without backing. Same trust boundary, three different failures of it. And the discovery timelines matter as much as the bugs: Nomic's counterfeit nBTC was minted in June and surfaced in September — an asset can trade for weeks with a third of its backing fictional before anyone measures.

3. What did enforcement do this week?

The US moved against infrastructure rather than individuals: OFAC designated Xinbi Guarantee — a marketplace US Treasury said processed over $24 billion for the scam economy since 2022 — while the Justice Department's Scam Center Strike Force seized its Telegram coordination channels and two wallets holding about $12M, restraining over $52M across 49 designated or targeted wallets. Chainalysis analysis showed DPRK-linked actors, including funds from the $1.5B Bybit and $235M WazirX thefts, had moved tens of millions through Xinbi's 'Black U' laundering vendors. The on-chain reaction was immediate and measurable: outflows from Xinbi-linked platforms jumped from roughly $389–564k daily to about $1.28M on September 8 and $1.81M on September 9 as the seizure and designation landed, and a rival marketplace began purging laundering merchants, with about $9.3M leaving its wallet. Sanctions did not recover stolen funds — they raised the cost of the plumbing that cashes them out.

4. What should a wallet user change this week?

If you hold any bridged, wrapped or federated asset, this week's events define a short checklist: classify the backing — know which category your balance falls into (native asset, exchange liability, or a receipt issued against someone else's reserve); treat redeemability as the only claim that counts — allBTC traded normally while roughly a third of its backing was fake, and L-BTC's 1:1 story lasted exactly as long as its software was honest; size the exposure deliberately — a wrapper asset that is 5% of your working balance is a different risk than one that is 95% of it; and watch the issuer's own status page during incidents, because halts, freezes and restarts are announced there first, not in your wallet's interface. For everyone else: nothing about this week changes key hygiene — but it should change how you evaluate the tokens you hold.

5. What is coming next?

Four dated events resolve in the next edition's window. First, the Liquid restart: the network remained paused at the cutoff while a chain split was resolved, with an emergency Elements release (v23.3.4) readied and roughly 598.5 BTC still outstanding — whether the bridge reopens and on what reserve terms is the single most consequential open question. Second, Osmosis's governance vote on seizing the frozen 22.65 BTC and deploying the community pool to close allBTC's gap. Third, Zentra's September 14 bounty deadline for the return of its $143k. Fourth, Symbiosis's redirected informant bounty and reimbursement framework for liquidity providers. Watch items beyond those dates: whether wrapper issuers begin publishing routine reserve attestations, and whether the fix-versus-deployed-build gap seen in Liquid's post-mortem shows up in the Nomic and Symbiosis technical reports.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.