# bridge exploit — X 热门讨论 (2026-09-26 11:51 UTC)
## @CryptoTeca__ (TECA) · 09-25 19:19 · ♥167 ↻1 💬39 Crypto has lost billions to hacks in 2026.
And at this point, it’s getting difficult to ignore how bad things have become.
The biggest lesson isn't simply that smart contracts are broken.
It's that the systems surrounding them can be.
On September 24, @bitget reported approximately $351.6M in unauthorized transfers from a limited number of hot wallets. Bitget says its cold wallets and most platform assets remained secure, while its User Protection Fund covers the affected assets. The exact attack vector is still under investigation, so claims about how the compromise happened should be treated cautiously.
But Bitget is only the latest major incident.
By late September, trackers had recorded 86 major incidents and more than $2.3B in disclosed losses.
Some of the biggest reported losses:
→ Bitget — ~$351.6M → Liquid — ~$319M → Kelp DAO — ~$292M → Drift — ~$285M → Social engineering — ~$282M → Tectonic — ~$120M → Coldcard — ~$114–116M → Echo — ~$77M → Humanity — ~$31M → Step Finance — ~$30–40M
Liquid alone saw roughly $319M drained after attackers exploited validator software to create unbacked synthetic BTC. Around 85% was later returned, leaving roughly $47M outstanding according to TRM.
Earlier in the year, Kelp DAO and Drift suffered attacks worth roughly $292M and $285M respectively.
Kelp involved cross-chain infrastructure.
Drift involved social engineering and compromise of privileged access.
And these weren't isolated technical bugs.
That's what makes the situation even more concerning.
Across 2026, we've seen:
• Oracle manipulation • Bridge and verifier exploits • Governance attacks • Hot-wallet compromises • Weak randomness • Social engineering • Compromised signing infrastructure • Phishing and impersonation • Approval exploits • Fake staking platforms • DEX rug pulls
August brought the ~$120M Tectonic incident involving price manipulation, alongside Moonwell's ~$8.7M oracle exploit and Term Finance's ~$8.5M governance attack. TRM notes that price manipulation accounted for about one in eight hacks in its H1 data.
July saw the Coldcard incident, with roughly $116M linked to weak seed entropy, alongside AFX Trade (~$24M), Ostium (~$24M), BonkDAO (~$20M) and Triple-A (~$9.7M).
April–June included Kelp DAO, Drift, Echo (~$77M), Humanity (~$31M), Rhea Finance, Resolv, Grinex and others.
January–March brought the ~$283–285M social-engineering theft, Step Finance, Truebit (~$27M), SwapNet (~$17M), Blend (~$11M) and numerous smaller exploits.
TRM's H1 data puts the scale into perspective: 207 hacks were recorded in the first six months alone, with $972M stolen. Infrastructure and operational compromises represented only about 15% of incidents but around 76% of stolen value.
That's the pattern.
And it's becoming increasingly difficult to dismiss these incidents as isolated failures.
Attackers don't always need to break the blockchain.
They can attack what the blockchain trusts:
A wallet backend. An oracle. A bridge verifier. A signing system. A governance process. A private key. A developer. A human.
Once a trusted component approves something malicious, the blockchain can execute it perfectly.
That's why crypto security in 2026 isn't just about auditing smart contracts.
It's also about securing the infrastructure, people, permissions and verification systems sitting around them.
Because the uncomfortable reality is this:
The blockchain can remain mathematically intact while billions are lost through everything built on top of it. https://x.com/CryptoTeca__/status/2103564983191880011
## @0xOnyedika (onyedika🪑) · 09-26 08:12 · ♥45 ↻18 💬14 Aave's second act https://x.com/0xOnyedika/status/2103759584947044423
## @BigOsCrypt (Big◎s) · 09-26 08:31 · ♥23 ↻5 💬5 CT WEEKLY RUNDOWN
A lot happened as usual, but here are a few for you to catch up on.
1. The Hack VC partner death
The death of former Hack VC partner Hsin-Ju Chuang became a major conversation on CT this week.
She was found dead on August 24 near I-15 in California at age 37. Her cause of death is still under investigation.
Before her death, she had publicly made allegations against Hack VC and was planning to release more evidence on August 26. Hack VC disputed her account.
There has been no established connection between her allegations and her death, so this is still an open investigation.
2. NFT hack
Limit Break’s Payment Processor V2 was exploited, allowing NFTs to be purchased for 0 ETH.
Around $1.7M worth of NFTs were affected in the first wave, while a whitehat managed to rescue 23,155 NFTs worth over $5.7M.
The attacker also got away with 660 WETH, worth around $1.7M at the time.
Revoke later estimated at least ~$2.8M stolen across ETH, Polygon, Base, Arbitrum and ApeChain.
Magic Eden clarified that this wasn’t an exploit of its live marketplace. It had stopped using the Payment Processor V2 contract back in October 2024, but old approvals could still leave some users exposed.
Most of the rescued NFTs will be returned to their owners, but imagine this was done by the hands of another ruthless hacker? Crazy.
3. MORE HACKS
Bitget got hit for around $387.5M, making it the biggest crypto theft of the year so far.
Duelbits lost roughly $6M–$7M from hot wallets.
Payy’s Ethereum bridge was drained for around $1.83M USDC.
Meter suffered a block-validation issue that led to roughly $2.3M being minted and moved.
There were also smaller incidents involving INT, RWC and Astroport.
People’s funds just gone like that. Crazy!
4. Bitget, more details
The Bitget hack was eventually revised from ~$351M to around $387.5M.
The attacker reportedly compromised a wallet-backend system and manipulated what authorizers saw rather than stealing private keys.
Withdrawals were paused while trading remained live. Bitget says its protection fund is around $464M and user balances are covered.
Bitget also suggested a North Korean connection was very likely, although that attribution remains unconfirmed.
Bruh, I thought North Korea was secluded from the world. You sure it’s not the CIA or anything just claiming that?
Anyways, that’s a sad one and I hope they recover.
5. BTC hit $87K
BTC started the week around $81K before ripping to roughly $87.3K–$87.4K on Monday, its highest level since January.
Spot BTC ETFs saw roughly $2.39B in inflows for the week, with around $999M coming in on Monday alone.
Liquidations hit around $1B during the Monday move and another ~$237M when BTC rejected $87K.
6. HYPE
HYPE reached around $96–$98 before settling around $92 into the weekend.
Binance also listed HYPE spot trading on September 24.
Hyperliquid OI reached around $18B, while whales continued accumulating. One wallet linked to a strategy reportedly added around 494K HYPE worth ~$46M.
7. Regulation and TradFi
The Fed worked on GENIUS Act stablecoin issuer proposals, while the CFTC moved further on tokenized assets and single-stock perps.
The SEC also said pure ETH liquid-staking receipts aren’t securities if they remain receipts.
Binance took a $100M stake in Circle, while SoFi launched Mastercard stablecoin settlement.
MoonPay also agreed to acquire SEC-registered North Capital for $60M.
8. Polymarket vs New York
New York sued Polymarket over alleged unlicensed gambling, including sports markets.
Polymarket moved the case to federal court and sued New York back.
Kalshi separately said it isn’t under a CFTC investigation.
9. ZEC + NFTs
Nothing much here.
The zkSNARKs NFT auction remained the main NFT story from last week, with 8,000 NFTs at 1.5 ZEC each and roughly $17.5M cleared.
Apart from that, nothing much, but we are still on the lookout. https://x.com/BigOsCrypt/status/2103764399525654702
## @Lucky_m_X (Lucky) · 09-25 12:08 · ♥22 ↻0 💬1 🤖 ARTIFICIAL SUPERINTELLIGENCE ALLIANCE (FET) INSANE REBOUND 🤖
#FET is staging an absolute masterclass recovery today, leading the entire decentralized AI narrative with explosive double-digit velocity! 🚀🔥
📊 Market Snapshot (Sept 25, 2026): • Price: ~$0.229 💵 (Up a massive +16% in 24 hours!) • 24H Trading Volume: ~$250 Million 🔥 (Daily turnover hitting a 3-month high!) • Short Positions Wiped: Bears completely liquidated as FET tests the $0.23 resistance zone 📉⚡
📰 Crucial Ecosystem & Security Headliners: 1️⃣ Bridge Exploit Contained: Confidence is fully restored! Following the September 20 infrastructure exploit on the SingularityNET Ethereum-Cardano bridge (which led to an unauthorized $1.56M withdrawal), teams responded instantly. https://t.co/jcGZDTxTpC confirmed its core contracts are 100% unaffected. To ensure safety, AGIX-to-FET conversions are paused while developers review migration contracts. 🔒🛡️
2️⃣ Fetch AI Business Expansion: Moving into enterprise structures, the Alliance has officially deployed "Fetch Business." This specialized layer provides secure digital passports, multi-agent automated payment protocols, and trust boundaries for enterprise-grade autonomous AI agents. 🏦💼
3️⃣ Technical Outlook: After a brief panic-flush down to the $0.19 Fibonacci level, heavy whale buy-walls completely absorbed the dip. With immediate support locked at $0.20, clearing the near-term overhead barrier opens a straight technical path toward $0.28 for "Uptober"! 📊🔮
Are you compounding your ASI tokens or building autonomous AI agents on-chain? 👇
#ArtificialSuperintelligence #FET #ASIAlliance #FetchAI #DeFi #CryptoNews #DePIN #Uptober #Web3 https://x.com/Lucky_m_X/status/2103456563235070280