Hacked Event Broadcast

The attacker exploited an access-control vulnerability in FlashLoopAdapter by spoofing Safe authentication and bypassing the module authorization check. By controlling the swapRouter and swapCalldata, the attacker targeted the victim Safes with execTransactionFromModule() and executed unauthorized transactions. The attacker also used a Morpho WETH flash loan to repay the affected Safe’s Aave V3 debt and unlock its collateral, ultimately draining weETH from two Safes and retaining approximately 114.09 ETH, worth about $305,000.

NEAR Intents suffered a security incident caused by a bug in the Omni deposit and withdrawal infrastructure’s interaction with its smart contract, with a preliminary loss of approximately $3.8 million. The contract-side vulnerability has been patched, full compensation has been pledged, and the team has reported the incident to law enforcement while working to trace and recover the funds.

The MCN Labs–related LPBonus contract used inconsistent MSN reserve values in reward accounting. Accrual updated the reward index with the reserve at that moment, while withdrawal applied a user weight based on the reserve at claim time. The attacker first lowered the reserve to ~89.33 MSN during accrual, then raised it to ~491.11 MSN before calling UserRemoveLp, allowing a newly registered LP to claim ~1,442,165.71 FIST against only ~940,041.61 FIST of intervening reward funding—about $92,600 in losses.

MUSystem’s deposit() counted the first-deposit bonus in both the immediate ETH refund and the user’s MUS allocation, while withdraw() allowed same-transaction redemption without capping returned ETH to the amount deposited. Sixteen fresh addresses repeated this cycle and drained ETH from the contract, causing about $36,900 in losses.

On September 27, 2026, multi-chain DEX DYORSWAP listed a network presented as GIWA Mainnet with chain ID 9134. That network was a scammer-built fake chain with a fraudulent bridge. Users deposited real Ethereum-mainnet ETH into the fake bridge, and the operators later drained about 766.25 ETH (about $2,000,000). Official GIWA, an Upbit-linked L2, said its mainnet was not live. DYORSWAP said its own contracts were not exploited, began treasury compensation, and has already paid more than 200 ETH, with tracing still ongoing.

Scammers deployed a fake GIWA L2 network using the legitimate Chain ID 9134, complete with a functional bridge and batcher. Approximately 1,335 addresses bridged ~767.65 ETH believing it was the official mainnet launch. The attackers drained ~766.25 ETH (~$2M). The real GIWA mainnet had not launched. DYORSWAP initially listed the fake network due to the matching Chain ID and later compensated affected users from its treasury.

At 18:31 UTC on September 24, 2026, Bitget detected unauthorized transfers from parts of its hot and warm wallet infrastructure. Attackers compromised a critical backend system in the wallet stack, spoofed transaction data, and triggered Bitget’s own authorization process to move funds out. The firm ruled out private-key theft and fake user withdrawal requests. The loss was first put at about $351,600,000 and later revised to about $387,500,000 after Zcash and TRON assets were included. Cold wallets and Bitget Wallet were unaffected. Withdrawals were paused, the User Protection Fund is said to cover the loss, and some attacker addresses have been frozen.

Crypto casino and sportsbook Duelbits had its hot wallets drained across Ethereum, BNB Chain, Tron, Solana and Bitcoin in under an hour. The team confirmed a loss of about $7,000,000 and took the site offline. Security firms assessed the incident as a hot-wallet private-key compromise, not a smart-contract exploit. The attacker then bridged and swapped most of the stolen assets into ETH and consolidated them in one address. Duelbits said user balances were unaffected, relaunched on September 27 with about $8,000,000 across hot and cold wallets for payouts, and no public recovery or freeze of the stolen funds has been reported.

An attacker exploited a bug in Limit Break’s Payment Processor V2, abusing stale Magic Eden EVM marketplace approvals to steal blue-chip NFTs via zero-price “sales” and to drain WETH in reverse. V2 could not be paused, so Yuga Labs VP of Blockchain @0xQuit led a whitehat rescue that moved 23,155 NFTs worth over $5.7M to safety; about 660 WETH could not be recovered in time. Magic Eden and Limit Break later urged users to revoke V2/V3 approvals immediately.

Blockaid reported an ongoing exploit of Meter.io’s Meter Passport bridge on BNB Chain. An attacker minted a large amount of unbacked wrapped MTRG through the bridge and sold part of it on PancakeSwap. About $2,300,000 of unbacked wMTRG had been minted in roughly two transactions when the alert went out, and the attack was still ongoing.

Payy’s Ethereum bridge contract was exploited and fully drained, with about 1,832,149 USDC leaving the contract. Payy said the stolen funds were users’ non-custodial deposits to Payy Network / Payy Wallet, paused all transactions, and said it is working on fund retrieval and a root-cause analysis.

The personal X account of Nano Labs founder Jack Kong was compromised. Attackers used it to promote a fake AI trading token called Binance World Assets ($BWA), claiming it would use trading fees on BNB Chain to trade bStocks and share profits with holders. Nano Labs’ official account later stated that the posts were unauthorized, that the company had not issued or endorsed any such token, and warned users not to click links or send funds to any contracts.

Astroport (a Cosmos ecosystem DEX) announced a security incident on the Neutron chain that may have resulted in the theft of admin privileges for its contracts. Neutron has halted chain operations for investigation, and the project advised users to immediately withdraw liquidity from all Astroport pools across chains. Terra-side contracts were unaffected.

The Drop project suffered an attack via a malicious governance proposal, through which the attacker transferred treasury funds, resulting in a loss of approximately $4.4 million.

The dormant NFT platform DoinGud was exploited on Polygon via a bug in its Diamond bidding contract: acceptBid paid out but never cleared the bid record, so the same bid could be reused. An attacker flash-loaned USDC equal to the contract balance, bid on themselves, accepted the bid twice, and drained about $35,486 USDC.e on September 21, 2026.

The Polygon contract GaslessReservoirEnabler had an authorization flaw: erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC-20 transferFrom calls to an authorized asset owner. An attacker could therefore spend victims’ existing allowances on whitelisted tokens (WETH and ZED). About 997 token-holder addresses were drained for roughly $23,000. The proceeds were consolidated and deposited into a bridge on Polygon.

Internet Token DAO’s LiquidityUnifier on Base was exploited after it trusted a caller-supplied Uniswap V3 pool address. A fake pool callback minted about 925 million INT out of thin air. The attacker drained 5.847 WETH (about $16,033.55) from the official INT/WETH pool and kept about 764 million INT. The mint role was not revoked in time, copycat exploits inflated supply to about 156 billion, and the attacker submitted a governance proposal aiming to move treasury funds.

The RWC token on BNB Smart Chain was exploited with a flash loan. An unprotected burn function let the attacker destroy RWC sitting in the PancakeSwap RWC/USDT pair and call sync() to rewrite reserves, inflating the price before selling back. The pool lost about 109,460.85 USDT in one transaction. The attacker kept about 39,964.07 USDT; the remaining about 69,496.78 USDT was routed to the project’s company and platform wallets by the token’s fee logic.

Bitcoin Lightning wallet Blink Wallet paused services to investigate a security incident. The team said an attacker accessed a limited number of custodial accounts and withdrew funds. The large majority of funds remain secure, and non-custodial wallets were not affected. The team is currently conducting an in-depth investigation and emergency response to this vulnerability. Further details of the investigation and recovery arrangements will be announced later.

An attacker used a leaked conversion-authorizer / bridge backend signing key to call conversionIn() on Fetch.ai’s Ethereum token-conversion contract and drain about 8,721,530 FET (~$1.53 million). The same wallet cluster then minted about 408.5 million unauthorized NTX via a NuNet deployer key and later expanded the attack to related ASI Alliance bridge/converter infrastructure.