Weekly Wallet Security Data Report — September 7–13, 2026

This weekly data report tracks publicly confirmed wallet-security incidents and their direct losses for September 7–13, 2026. Figures come from protocol disclosures, security-firm analyses and on-chain investigators; where a number is an estimate or partly frozen, we say so. Indirect costs — token price effects, lost uptime, unrecovered amounts in ongoing investigations — are not included.

This edition covers September 7–13, 2026.

1. Headline Numbers

After a week distorted by the Liquid Network withdrawal, the incident ledger returned to a small, unglamorous size: roughly $3.7M compromised across four confirmed incidents, or about $1.9M net once frozen and recovered assets are set against them. The week's defining number was not a loss at all — 3,400 BTC, about $269M, returned to the Liquid federation wallet on September 7, restoring most of the backing that had disappeared on September 6. Roughly 598.5 BTC (about $47M at the week's prevailing bitcoin price near $77,700) remains with the actors from that incident, and the network itself was still paused at the edition cutoff while a chain split was resolved and a restart coordinated.

2. Incident Ledger

3. Attack-Type Distribution

Share of the week's ~$3.7M in compromised funds:

One hundred percent of this week's compromised value sits in accounting and issuance logic — not one incident involved a stolen key, a phished seed phrase or a signed malicious approval. That is unusual even for a quiet week, and it reinforces the wrapper-layer pattern described in our weekly review: the receipt-issuing software around bitcoin is currently the most reliably broken layer in the stack.

4. Four-Week Comparison

The four-week sequence reads ~$12.3M, ~$7.7M, ~$321.8M, ~$1.9M net — but the honest comparison excludes the Liquid distortion: against the prior week's ex-Liquid figure of roughly $1.8M, this week's ~$1.9M net is essentially flat. The market's real baseline since late August sits near $2M per week of confirmed direct losses, with single mid-sized protocol bugs capable of moving that number by an order of magnitude in either direction.

5. Recovery Ledger

• Returned: 3,400 BTC (≈$269M) to the Liquid federation wallet on September 7, in Bitcoin block 965,950, after Blockstream's signed confirmation that bridge nodes were patched.
• Frozen pending seizure: 22.65 BTC locked in the Nomic attacker's address by Osmosis's emergency upgrade v31.1.0; a governance vote to seize the funds is planned.
• Recovered by the team: roughly 15 BTC (≈$1.1M) secured by Symbiosis in a multisig after the September 11 bridge exploit.
• Still outstanding: roughly 598.5 BTC (≈$47M) from the Liquid withdrawal; the $234k Balancer V1 exploit proceeds (deadline lapsed Sept 8); Zentra's $143k (deadline Sept 14).

6. What We Count, and What We Do Not

Counting scope is explicit in the report: only publicly disclosed incidents with confirmed direct losses are included, and frozen or recovered assets are shown against gross figures rather than assumed recovered. Some events reported this week are not counted as confirmed losses — for example, the external G$ liquidity-pool losses in the GoodDollar incident remain undisclosed, and the Zentra exploit method is unpublished, so its figure rests on the protocol's own estimate. Prior-week events, including the original Liquid withdrawal and the Balancer V1 theft, appear only where an in-window development (the return, the deadline) moved their status.

As always: if a figure in this report is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.