Weekly Wallet Security Data Report — September 28–October 4, 2026

This weekly data report tracks publicly confirmed wallet-security incidents and their direct losses for September 28–October 4, 2026. Figures come from protocol disclosures, security-firm analyses and on-chain investigators; where a number is an estimate or partly frozen, we say so. Indirect costs — token price effects, lost uptime, unrecovered amounts in ongoing investigations — are not included.

This edition covers September 28–October 4, 2026.

1. Headline Numbers

The ledger reset. Roughly $9.6M in gross direct losses across four quantified incidents is about 2.3% of the prior week's ~$412.3M and the smallest weekly total since the week of September 7–13 — after the two most expensive weeks this record has printed. The composition matters as much as the size: no nine-figure event, no exchange breach, no drainer wave in the quantified file — every loss sat at an authorization boundary, from a bridge's signing keys down to a single module's caller check. And for the first time in this ledger, a full recovery outran the week's losses in speed rather than amount: NEAR Intents' $3.865M came back inside about 24 hours of the team naming the attacker, which puts the week's effective net loss near $5.7M.

2. Incident Ledger

3. Attack-Type Distribution

Share of the week's ~$9.6M in gross direct losses:

Two observations on a four-row table. First, the authorization layer holds the top two slots again — keys and infrastructure bugs, not drainer kits or phishing, produced essentially all of the week's losses; the quantified file contains no consumer-facing scam at all this week. Second, the bottom two rows are the interesting ones: a module flaw and a reward-routing diversion together account for about 3% of losses because both were contained by architecture (wallet-level module control) or by defensive speed (an operator exiting its own validators). The distribution is small this week, but its shape is the same shape September's $759M printed at 75 times the scale.

4. Five-Week Comparison

The five-week sequence reads ~$321.8M, ~$1.9M net, ~$20.9M, ~$412.3M, ~$9.6M — the sawtooth continues, but this week's trough comes with a feature the earlier troughs lacked: a complete recovery and two architecturally contained incidents. Excluding each week's single largest incident, the baseline has printed at roughly $0.6M, $13.1M, $24.8M and now $4.2M across the four most recent weeks — the first down-move in that baseline series since mid-September, worth one more week of confirmation before calling it a trend.

5. Recovery Ledger

• Recovered inside the window: the full $3.865M taken from NEAR Intents, returned within about 24 hours of the team's public ultimatum — roughly 34.59 BTC to the published Bitcoin recovery address plus the BNB Chain and Solana legs, with the attacker leaving an on-chain message urging bug bounties. The fastest complete return this record has printed.
• Contained by architecture rather than recovered: the MetaMask staking compromise never became a principal theft — the operator's non-custodial design kept withdrawal keys out of the attacker's reach, so the direct loss printed at ~0.36 ETH while $1.4B of validators were exited as a precaution.
• No recoveries reported: Gravity Bridge's ~$5.4M, with PeckShield reporting part of the haul already laundered through ChangeNow and Binance and the theft wallet still holding ~2,100 ETH at report time; no post-mortem or return track published yet.
• Still outstanding from prior windows: roughly 598.5 BTC from the Liquid withdrawal — about $52M at this week's bitcoin price near $86,500 — with peg-outs still suspended per Blockstream's status page; the rsETH position held by the front-running bot; the Balancer V1 proceeds (~$234K); Zentra's ~$143K with no publicly confirmed response to its lapsed deadline. Note the Liquid conversion moves with the bitcoin price: last edition it printed about $50M at $84,600; the same 598.5 BTC prints about $52M at this week's close.
• Fund-covered, not recovered: Bitget's September breach remains a fund absorption rather than a recovery — the bounty program (5% on frozen funds, 5% on recovered) is the live track, with Tether and Circle's blacklist of a linked wallet immobilizing about $318,013 and NEAR Intents' own report of blocking over $50M in related transfers standing as the week's containment follow-through.

6. The Month: October Opens at Roughly $9.6M

October's first quantified week prints at roughly $9.6M gross across four incidents — against September's roughly $759M on our gross ledger (DeFiLlama's tally, which nets the ~$269M of returned Liquid funds and carried Bitget's initial estimate, prints the month past $684M). The first week of a month is a small sample and we do not project from it; what the week does establish is that the September regime — a handful of infrastructure-scale failures at the authorization layer — persisted in shape even as it collapsed in size. The open question for the month is whether October's losses stay at the protocol layer, or whether the phishing and scam volume that historically follows headline incidents (Bitget's restoration, MetaMask's validator exit) starts printing in the quantified file.

7. What We Count, and What We Do Not

Counting scope is explicit: only publicly disclosed incidents with confirmed direct losses are included, and figures that are floors or estimates are labelled as such. NEAR Intents is counted at the team's refined $3.865M figure — the GM's own accounting superseded the initial ~$3.8M estimate — and the recovery is counted in full because the return was confirmed on-chain and by the team. The MetaMask entry counts the ~0.36 ETH of diverted rewards tallied by the on-chain researcher; the $1.4B validator exit is a defensive action, not a loss, and foregone rewards during the up-to-45-day cycle are not quantified by any party yet, so they are excluded. Gravity Bridge is PeckShield's tally with the asset breakdown stated; the exact entry point remains unconfirmed and the figure could move with the post-mortem. The FlashLoopAdapter figure is the net 114.09 ETH — the ~1,306 weETH withdrawal was gross collateral flow used to repay a flash loan, not theft.

Not counted as losses: the Blast wind-down (operator-led, assets remain recoverable through the October 26 interface deadline and L1 bridge contracts afterward); the SEC's custody proposal and the OFAC TRON designations (regulatory actions, no direct asset loss); and the Gracy Chen social-engineering attempt, which was detected and defeated. Prior-window events — Liquid, Balancer, Zentra, the rsETH front-run, the Bitget breach — are carried only for their recovery status. As always: if a figure in this report is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.