Weekly Wallet Security Data Report — September 21–27, 2026

This weekly data report tracks publicly confirmed wallet-security incidents and their direct losses for September 21–27, 2026. Figures come from protocol disclosures, security-firm analyses and on-chain investigators; where a number is an estimate or partly frozen, we say so. Indirect costs — token price effects, lost uptime, unrecovered amounts in ongoing investigations — are not included.

This edition covers September 21–27, 2026.

1. Headline Numbers

The ledger broke its own record: roughly $412.3M in gross direct losses across eight quantified incidents, twenty times the prior week's ~$20.9M. The composition matters more than the size. A single incident — the Bitget backend compromise — accounts for about 94% of the total, and it was executed without a stolen private key: the backend that assembles and authorizes transactions was compromised, and the keys stayed secure. Excluding that one event, the week prints at roughly $24.8M, about 1.2 times the week before — a bad but ordinary week. The gap between those two readings is the whole story of late September: the tail did not get fatter, the head got industrial.

2. Incident Ledger

3. Attack-Type Distribution

Share of the week's ~$412.3M in gross direct losses:

For the first time in this ledger, the dominant category is not a key or a contract but the operational layer between them. The pattern that has held since late August — attackers are handed valid credentials rather than breaking primitives — now extends to the machinery that decides what those credentials are asked to do. The Neutron entry deserves its own note: it is the first incident in this record where the entire attack was lawful under the chain's own rules, which is a category no contract audit covers.

4. Five-Week Comparison

The five-week sequence reads ~$7.7M, ~$321.8M, ~$1.9M net, ~$20.9M, ~$412.3M — two regimes again, but the spikes are changing character. The Liquid week was a single minting bug in one protocol; this week's spike is a counterparty failure at the largest scale the ledger has recorded, in infrastructure millions of users share. Excluding each week's single outlier, the baseline has printed at roughly $1.8M, $1.9M, $20.9M and $24.8M across the four most recent weeks — and that baseline is itself now trending up, which is the quieter warning in the table.

5. Recovery Ledger

• Recovered inside the window: one containment action, not yet a user recovery. Cosmos Hub validators coordinated a halt and restart that swept the Neutron attacker's remaining 1,227,121 ATOM — about $2.2M — into a 4-of-6 validator multisig, where it is held for return; the sweep missed a THORChain refund of 168,990.9 ATOM that the attacker sold on Osmosis for roughly 266,841 USDC.
• Fund-covered rather than recovered: Bitget's ~$387.5M falls within its User Protection Fund, published at over $464M; the exchange calls user balances unaffected. A fund disbursement is not a recovery — the attacker holds the assets and the bounty program is the recovery track.
• No recoveries reported: Duelbits (~$7M), Payy (~$1.8M), Meter (~$2.3M) and the Specter leak case (>$4.3M, attacker active) all ended the window with funds outstanding.
• Still outstanding from prior windows: roughly 598.5 BTC (about $50M at this week's bitcoin price) from the Liquid withdrawal, with peg-outs still suspended per Blockstream's status page; the rsETH position held by the front-running bot; the Balancer V1 proceeds (~$234K); Zentra's ~$143K with no publicly confirmed response to its lapsed deadline.
• Containment as a recovery instrument: Neutron's halt trapped an estimated $5M on the chain and Cosmos Hub's protective halt froze an entire blockchain for hours — the strongest demonstration this ledger has recorded that validator coordination can act faster than an attacker can exit, when the chain's operators choose to.

6. The Month: Costliest of 2026, Two Ways to Count It

On our own gross ledger, the four editions covering September total roughly $759M before recoveries (~$321.8M + ~$3.7M + ~$20.9M + ~$412.3M). DeFiLlama's tally — which nets the ~$269M of Liquid funds returned on September 7 and used Bitget's initial $351.6M figure — prints the month past $684M. Whichever scope you prefer, September overtakes April's roughly $645M as the costliest month of 2026, and it does so on a fundamentally different shape: August logged a record 50 incidents but only $136.3M in aggregate (an average of $2.7M per PeckShield's data), while September's losses concentrated in a handful of infrastructure-scale failures — an exchange backend, a governance process, a block-validation rule, a sidechain's peg. The month-end lesson is that loss totals track the size of the trust boundary an attacker crosses, not the number of attacks.

7. What We Count, and What We Do Not

Counting scope is explicit: only publicly disclosed incidents with confirmed direct losses are included, and figures that are floors or estimates are labelled as such. The Bitget figure is the exchange's own revised estimate and may move again as tracing continues; we use the revised $387.5M rather than the initial $351.6M because Bitget itself superseded it. Duelbits is counted at the co-founder's own ~$7M confirmation, with PeckShield's $4.3M and Specter's $5.9M noted as the estimate's progression. The Neutron total is SlowMist's $9.3M estimate; the itemized breakdown published by a former Neutron contributor is lower at roughly $4.4M because the halt contained assets the security firms' totals include — we carry the estimate and state the range. The Specter case is a floor: the attacker was still moving funds at the alert's publication.

Not counted as losses: the Polymarket stolen-card episode (at least $10M attempted, most deposits failed, no confirmed amount taken); the Darksword iOS 26.5 warning (no confirmed victims or theft); the alleged fake Sparrow Wallet litigation ($1.835M claimed by three investors, unproven); and the identity-data disclosures with no asset loss. Prior-window events — Liquid, Balancer, Zentra, the rsETH front-run — are carried only for their recovery status. As always: if a figure in this report is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.