ZeroTech's monthly security event highlights are here! According to statistics from multiple blockchain security monitoring platforms, the security landscape in the cryptocurrency sector in September 2026 showed a distinct characteristic: "exchange backends and underlying infrastructure have become new attack targets." The total losses caused by security incidents during the month were approximately $730 million, of which a single backend system manipulation attack on Bitget's hot wallet caused approximately $387.5 million in losses, and an attack exploiting a vulnerability in Liquid Network's validation software caused approximately $319 million in losses. Together, the two incidents accounted for more than 95% of the month's total losses, making September the month with the highest losses so far in 2026.
It should be specially noted that the $730 million represents the scale of incident reports/fund outflows and does not equal the final net losses that cannot be recovered. Among these, the Liquid Network attacker has already returned approximately 85% of the stolen funds (about $272 million), and approximately $47 million has still not been returned.
Attack methods have shown significant changes: exchange backend system manipulation, validation software vulnerabilities, governance proposal manipulation, oracle price manipulation, cross-chain bridge balance draining, DEX liquidity pool attacks, and other multidimensional attack methods are occurring concurrently, with attack targets accelerating their shift from the smart contract layer to the infrastructure layer.
Hacker Attacks
6 typical security incidents
• Bitget hot wallet backend system manipulation attack
Time: September 25
Loss amount: approximately $387.5 million
Incident details: The attacker exploited a zero-day vulnerability in a third-party security product to obtain high-privilege internal credentials, forged withdrawal instructions, and bypassed risk control checks, transferring approximately $387.5 million in assets from Bitget's hot wallet and warm wallet infrastructure, involving multiple chains including Ethereum, XRP, BSC, Arbitrum, and Avalanche. Bitget confirmed that private keys were not leaked, the cold wallet was unaffected, all user balances were not harmed, and the losses were covered by a user protection fund of more than $464 million. The platform has isolated the affected systems, reset internal credentials, and jointly launched an investigation and on-chain tracing with multiple security institutions.
• Liquid Network validation software vulnerability attack
Time: September 6
Loss amount: approximately $319 million
Incident details: The attacker exploited a range proof cache collision vulnerability in Elements, the validation software of Liquid Network, to mint approximately 4,000 L-BTC without real asset backing, and then redeemed real Bitcoin through SideSwap's peg-out mechanism. The attacker, self-identifying as a white hat, negotiated with Blockstream through on-chain messages and returned approximately 3,400 BTC (about 85%) after the vulnerability was fixed, while approximately 598.5 BTC (about $47 million) has still not been returned.
• Neutron governance proposal manipulation attack
Time: September 22
Loss amount: approximately $4.4 million
Incident details: The attacker spent only about 20,199 USDC to purchase approximately 31.6 million NTRN and completed staking about 12 minutes before voting ended, causing a malicious governance proposal to pass with about 82% support. Subsequently, the attacker obtained administrative permissions for 11 contracts and migrated the relevant contracts to malicious code, ultimately stealing approximately $4.4 million in assets. Cosmos Hub validators then coordinated to pause the network for about 25 hours and transferred approximately 1.23 million ATOM from addresses associated with the attacker for asset recovery.
• Duelbits platform hot wallet private key leakage attack
Time: September 24
Loss amount: approximately $7 million
Incident details: The hot wallet of crypto gambling platform Duelbits was attacked, suspected to be caused by private key leakage rather than a smart contract vulnerability. The attacker directly gained control of the hot wallet and transferred approximately 836 ETH, 1.62 million USDT, 97,000 USDC, 31,500 DAI, 12.4 billion SHIB, and 8.1 BTC to new addresses, after which most of the assets were swapped into ETH and concentrated into a single address. Duelbits' co-founder confirmed losses of approximately $7 million, stated that user funds were safe, and said the platform would remain offline until the investigation is completed and the hot wallet is replenished.
• Nostra oracle price manipulation attack
Time: September 17
Loss amount: approximately $3.5 million
Incident details: The attacker created a fake liquidity pool and, combined with wash trading, pushed the quoted price of the NSTR token from about $0.006 to about $49.5, an increase of nearly 8,000 times. Because Nostra's lending protocol relied on a third-party price source to read the pool's quote, the attacker used the severely overvalued NSTR as collateral to borrow approximately $3.5 million in ETH, STRK, USDC, USDT, WBTC, and DAI from the Starknet money market. The attacker then bridged approximately $1.92 million in stolen assets (including 234.57 ETH and 1.3 million DAI) to Ethereum. Nostra suspended lending, withdrawals, and liquidation functions after the incident.
• Payy Network cross-chain bridge vulnerability attack
Time: September 24
Loss amount: approximately $1.83 million
Incident details: Payy Network's Ethereum cross-chain bridge was attacked on September 24 at 4:21 UTC. The attacker transferred out the bridge's entire balance of approximately $1.8 million in USDC, then used the privacy protocol Railgun to provide funding cover for the operation and swapped the USDC into ETH. Payy Network is a rollup project providing on-chain payroll and treasury services. It confirmed that the lost funds were non-custodial assets deposited by users, but has not yet disclosed the specific cause of the vulnerability. The project team suspended all operations after the attack.
Rug Pull / Phishing Scams
5 typical security incidents
(1) On September 16, a victim at an address beginning with 0xe268 lost $565,768 worth of sUSDat on Ethereum after signing a phishing signature.
(2) On September 25, someone suffered an "address poisoning" attack on Ethereum and lost $67,572 worth of USDT.
Correct address: 0xca16b299700674dda6941baa1bdeeff6d90fd94b
Incorrect address: 0xca166632d25ea74baa93a5303aa73f61e80fd94b
(3) On September 26, someone signed a phishing transaction on the XRP Ledger, resulting in the loss of $37,927 worth of XRP.
Victim address: rGtghKcmYY8gdUQwQerY5Ruww2LvdbgWVh
(4) DYORSWAP fake mainnet phishing incident
Time: September 27
Incident details: A fraud group set up a fake GIWA mainnet and integrated a fake cross-chain RPC into DYORSWAP, inducing users to transfer ETH into a fake bridge contract and stealing approximately $2 million in total. GIWA officially clarified that the mainnet had not yet launched, and the DEX project team initiated fund compensation.
(5) Trezor email provider attacked, 347,000 users face phishing risk
Time: September
Incident details: Brevo, the email service provider used by Trezor, was attacked. After obtaining some customer contact data, the attacker sent phishing emails impersonating official security warnings to approximately 347,000 Trezor users, inducing them to download malicious programs and enter wallet backup passwords. The typical aspect of this attack is that the attacker did not directly attack the wallet itself, but first compromised the wallet manufacturer's upstream service provider and then used the obtained user information to carry out precise phishing.
(6) Robinhood Chain series Meme coin Rug Pull
Time: July 10—September 21, disclosed on September 27
Loss amount: at least $18.43 million
Incident details: On-chain analysis found that the same operating group was suspected to be associated with at least 53 Meme coin issuance projects on a certain chain. The team used a large number of related wallets to concentratedly acquire more than 70% of the token supply in the early stage of token launch, used project hype to attract retail participation, and then concentratedly sold off to cash out; internal wallets in some projects even controlled 82% to 86% of the token supply. The investigation showed that the proceeds cashed out from the previous project would be used to launch the next project, forming a cyclical harvesting model of "issuance—concentrated control—attracting buyers—selling off to cash out—continuing issuance," extracting at least approximately $18.43 million in total.
Summary
In September 2026, the trend of attack targets shifting from smart contract vulnerabilities to lower-level infrastructure became even clearer.Beyond the two headline incidents involving Bitget and Liquid Network, the lightning attack on FastSwap's liquidity pool, the manipulation of Nostra's oracle with 8,000x false quotes, the draining of Payy Network's cross-chain bridge balance, and the leakage of Duelbits' hot wallet private key all point to the same fact: attackers are systematically seeking out weak links at the infrastructure level, rather than directly breaking through contract code.
What is alarming is that "the system being trusted" has itself become a new attack surface. In the Bitget incident, attackers exploited a zero-day vulnerability in a third-party security product to obtain internal credentials, forge withdrawal instructions, and bypass risk controls—all without ever touching the private key. The Liquid Network attack shows that flaws at the validation software level can likewise pry loose hundreds of millions of dollars in assets.
The Zero Time Technology security team recommends:
• Individuals: Be wary of crypto links recommended by AI tools, and always access through official channels; do not sign "infinite approval" transactions, and regularly clean up approvals.
• Project teams: Set higher thresholds and delayed execution mechanisms for governance proposals; conduct dedicated security audits of validation software and caching mechanisms; exchanges should focus on reviewing the data integrity verification of backend authorization systems; DEXs should strengthen abnormal transaction monitoring of liquidity pools.
• Industry: Promote the establishment of backend security standards for exchanges; strengthen monitoring of supply chain risks in third-party security products; and continuously track the evolution of attack methods by nation-state APT groups such as North Korea's Lazarus Group.