Weekly Wallet Security Data Report — September 14–20, 2026

This weekly data report tracks publicly confirmed wallet-security incidents and their direct losses for September 14–20, 2026. Figures come from protocol disclosures, security-firm analyses and on-chain investigators; where a number is an estimate or partly frozen, we say so. Indirect costs — token price effects, lost uptime, unrecovered amounts in ongoing investigations — are not included.

This edition covers September 14–20, 2026.

1. Headline Numbers

After two quiet weeks, the ledger jumped back into eight figures: roughly $20.9M in confirmed direct losses across nine quantified incidents, with no recoveries at all inside the window. The composition is the story rather than the size. The two largest incidents — a $7.8M drain from a multisig wallet and a $6.6M-plus drain of mobile app wallets — were executed with valid signatures from systems that authenticated correctly. The week's third-largest, Nostra's $3.5M, was priced by an oracle that read a pool the attacker had just built. Not one dollar of the total was lost to a broken chain, a cracked private key or a compromised consensus mechanism.

2. Incident Ledger

3. Attack-Type Distribution

Share of the week's ~$20.9M in confirmed direct losses:

Every category above is an authentication or valuation failure rather than a cryptographic one. The pattern that has held since late August continues to hold: attackers are not breaking the primitives — they are being handed valid credentials, or they are writing the price that a protocol trusts without checking.

One sub-pattern deserves its own line, because it is new this week. Three of the nine incidents — BonfireSwap, Nimiq and Startale — involved code that acted on a caller's instruction without checking who sent it, or whether it was still allowed to run: a router transfer that did not check the caller against the source address, a meta-transaction path that accepted a spoofed sender, and an initializer flag that persisted for the length of a transaction. Their combined loss was just over $103,000, but the same omission at scale is precisely what emptied the Safe wallet.

4. Four-Week Comparison

The four-week sequence reads ~$7.7M, ~$321.8M, ~$1.9M net, ~$20.9M — which is best read as two regimes rather than a trend. The Liquid withdrawal remains a single-event outlier that dwarfs everything around it; excluding it, the ex-Liquid baseline has printed at roughly $1.8M, $1.9M and $20.9M across the three most recent weeks (Aug 31 – Sep 6, Sep 7–13 and Sep 14–20). The honest reading is that the quiet weeks were quiet, not that the risk fell, and that one compromised key or one over-enabled module is enough to produce a tenfold week.

Grouped by month, the three editions covering September total roughly $346M gross, of which about 93% is the September 6 Liquid withdrawal and its immediate aftermath.

5. Recovery Ledger

• Recovered inside the window: nothing. No incident this week produced a confirmed return of funds during September 14–20.
• Pledged but unquantified: Blink Wallet says every affected custodial account — "a few dozen" — has been identified and will be made whole, without users taking action. No amount has been disclosed.
• Paused then released: Kelp DAO placed a 24-hour wallet-level pause on the address holding the drained rsETH position; the pause expired with the funds still in the bot's address and no return commitment reported.
• Still outstanding from prior windows: roughly 598.5 BTC (about $47M) from the Liquid withdrawal, against 4,234.76 L-BTC in circulation and 3,632.23 BTC held as of September 17; the Balancer V1 proceeds (~$234K), whose cooperation deadline lapsed on September 8 in an earlier window and saw no further movement; Zentra's ~$143K with no publicly confirmed response to its September 14 deadline.
• Keys still not rotated: Bitquery reported that most of the signing keys compromised in the ASI cluster had not been replaced at the time of its analysis — the condition that turns one incident into a repeat.

6. Unauthorized Mint Inventory: A Separate Ledger

The ASI cluster produced two different numbers that should not be added together. The realized part — FET sold for ETH, plus $289,575 taken from a payroll contract — is counted above at about $2.54M. The rest is inventory: PeckShield valued the attacker's holdings at roughly $16.77M, including about 198.3M AGIX and 649 ETH, and Bitquery counted about 2.3 billion newly created units across AGIX, NTX, CGV and WMTx. We do not count that inventory as a loss, for the same reason we do not count unbacked tokens at face value: it is unsold supply whose redemption depends on liquidity, freezes and whatever the issuers manage to revoke. What is already certain is the damage it did without being sold — NTX fell between 65% and more than 90% depending on the tracker, and WMTx's decline was smaller.

7. What We Count, and What We Do Not

Counting scope is explicit in the report: only publicly disclosed incidents with confirmed direct losses are included, and figures that are floors are labelled as floors rather than presented as totals. The D'CENT figure is the clearest example — only the XRP Ledger leg has been quantified (2,009,321 XRP across 1,552 wallets), while the company states the same signing condition affects addresses on Bitcoin, Ethereum, TRON and EVM chains, so the real total is higher by an unknown amount. Nostra's $3.5M is the protocol's own estimate of assets borrowed and is still being reconciled pool by pool. Flamincome appears at the lower of two published figures.

Several events reported this week are not counted as losses at all: the Swiss Bitcoin Pay intrusion (customer data, no fund loss reported), the Haruko API token breach across 15 institutional clients (no confirmed amount), the Revolut disclosure and its $3M Monero ransom demand (no funds taken from accounts), and the FomoPeek advisory (no disclosed figure). The WaterPlum attribution is excluded on window grounds: the campaign it describes ran from December 2025 to July 2026 and was disclosed on September 18, and we date events by occurrence, not by disclosure. Prior-window events — the Liquid withdrawal, the Balancer theft, Zentra — are carried only for their recovery status, with the original incident or deadline date kept explicit; none of them is counted as an in-window loss.

As always: if a figure in this report is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.