Index
Search
Search the public record. Drafts and scheduled notes are not included.
defi
DeFi hacks, September 2026: the worst month of the year, read through the post-mortems
PeckShield counted 55 major incidents and $766.5M stolen in September 2026; CertiK counted 97 and $768.4M. Two events, Bitget and Liquid, make up most of it. This recap covers eleven incidents ThreatWire has written up, with figures taken from the projects' own accounts and named security firms.
Published 2h ago
defi
Symbiosis's Bitcoin Bridge minted 46 billion syBTC from a 25-cent deposit. Real losses were about 9.97 BTC
On 11 September 2026 an attacker used two flaws in Symbiosis's native Bitcoin Bridge to mint about 46.1 billion unbacked syBTC from a 330-satoshi deposit. Symbiosis's post-mortem puts losses to liquidity providers and users at 9.97 BTC, about $770,000. The bridge is offline for a rewrite and audit.
Published 2h ago
defi
The $20,000 problem: when a protocol's input is cheaper than what it controls
A $20,199 stake purchase passed a vote over contracts worth millions on Neutron. A thin NSTR pool fooled Nostra's collateral price. A wrong conversion halved prices on Vesu. Three September incidents, one design flaw: a value the attacker could cheaply influence decided where large sums went.
Published 2h ago
defi
Unbacked mints: five 2026 incidents, one question the code forgot to ask
Liquid, NEAR Intents, Meter, Symbiosis and Payy failed in different ways this autumn. In each, the system created a claim on real money without checking that real money stood behind it. A look at the common pattern, drawn from the projects' own accounts, and the controls that would have limited it.
Published 2h ago
defi
UNCX Vesting V2 was drained on four chains. The headline said $1.49M, UNCX's own count says about $808K
On 14 October 2026 attackers abused a share-accounting flaw in UNCX Network's Smart Token Vesting V2 and took tokens belonging to ten projects on Ethereum, BNB Chain, Base and Robinhood Chain. Early tallies said about $1.49M. UNCX's report puts realised value near $808K and lists returns by whitehats.
Published 2h ago
defi
FlashLoopAdapter: how a spoofable caller check cost two Safe wallets 114 ETH
On 1 October 2026 an attacker used a flash loan and a fake Safe to make a third-party Aave adapter run their instructions inside two real Safe wallets, taking about 114 ETH (around $305,000). Aave v3 and Safe's own contracts were not at fault, according to analysts and Aave's founder.
Published 2h ago
defi
Meter's Passport bridge minted about $2.3M of unbacked tokens, then the chain was paused
On 23 September 2026 an attacker minted unbacked wrapped MTRG through Meter Passport and sold part of it on PancakeSwap, crashing MTR and MTRG. Meter blamed a block validation flaw, paused its chain and bridge, and has not published a full post-mortem. It is the project's second bridge incident.
Published 2h ago
defi
A $20,000 vote took over Astroport and Drop on Neutron. Here is what the post-mortem says
On 22 September 2026 an attacker bought about 31.6M NTRN for roughly $20,199, passed Neutron governance proposal 9 and took admin control of 11 contracts belonging to Astroport, Drop and Neutron's investor vesting. Ten were emptied. The post-mortem counts about $6.24M taken and about $4.01M secured.
Published 2h ago
defi
Payy's bridge paid out $1.9M after its verifier accepted a forged proof
On 24 September 2026 Payy's Ethereum bridge released about 1.92M USDC against a burn that never happened. Payy's post-mortem says an invalid proof got through its Noir and Barretenberg verifier. The network was paused, and a user claims process has been promised but not yet published.
Published 2h ago
defi
Pragma's 4 September oracle error halved major prices on Starknet and set off 47 liquidations
A faulty USDT conversion in Pragma's publishing software made BTC, ETH and other prices look about half their real value for a few minutes on 4 September 2026. Vesu liquidated 47 positions. Vesu reports 95% of assets recovered at 11 September prices; curator refunds are still in progress.
Published 2h ago
defi
Hemi lost 124.5M unclaimed HEMI to a claim contract bug, says its post-mortem
Hemi says an attacker drained about 124.5 million unclaimed HEMI from its legacy Genesis Drop claim contract on 7 September 2026 by calling back into the contract before it updated its balances. The tokens sold for about $255,000. HEMI, veHEMI and bridges were not affected.
Published 3h ago
defi
Limit Break Payment Processor V2 was abused through a forged sender, taking about $2.8M
An attacker used a flaw in Limit Break's old Payment Processor V2 contract to act as wallets that had left approvals in place. Credora counts about $2.8M in confirmed losses. Whitehats rescued about 23,000 NFTs. V2 cannot be paused, and Limit Break tells users to revoke approvals.
Published 3h ago
defi
Liquid Network lost about 4,000 BTC to a proof cache bug, says Blockstream
Blockstream's assessment says a flaw in how Elements cached proof checks let about 4,000 unbacked L-BTC pass validation on 6 September 2026. The fake L-BTC was redeemed for real BTC through a federation member's peg-out. 3,400 BTC was returned, and about 602 BTC remains outstanding.
Published 3h ago
defi
NEAR Intents lost about $3.8M to a deposit notification bug, says its postmortem
NEAR Intents says an attacker used 23 failed deposits to create about $3.8M in unbacked "ghost funds" in its intents.near contract, then withdrew real tokens between 29 September and 1 October 2026. The postmortem of 16 October says the bug was in the contract, not Omni, and that all funds were returned.
Published 3h ago
defi
Nostra Finance lost about $3.5M after a thin pool price fooled its oracle
On 17 September 2026 an attacker pushed the price of Nostra's own NSTR token through a thin pool and borrowed about $3.5M against it. Pragma says the price response had two sources and that a three-source minimum would have rejected it. Nostra's final loss and any recovery are not known.
Published 3h ago
defi
Notional V1 lost about $1.7M from a deprecated escrow contract, says its post-mortem
Notional says an attacker caused an integer overflow in its deprecated V1 contract on 3 September 2026 and drained about 1.65M USDC and 69K DAI of leftover funds. The contract was paused and nothing has been recovered. The team says no other product is at risk.
Published 3h ago
CVE-2026-66082
DolphinScheduler cross-project schedule and workflow authorization bypass
Auth bypass
Published 11d ago
CVE-2026-66084
DolphinScheduler task definition with-upstream project authorization bypass
Auth bypass
Published 11d ago