In two weeks, the crypto market was hit by 12 major security incidents, and lost about $422 million in assets.
Bitget, a centralized crypto exchange lost $387.5M alone, and the attackers, who many rumour claim to be the North Korean hackers, the Lazarus group never stole a private key. Rather, they got in through a zero-day in third-party security tooling and made the exchangeโs own signing system approve the withdrawals.
If youโve used Magic Eden, a DโCENT wallet, Meter or MetaMask Staking, some of these incidents may have touched you.
Below is top10 crypto security incidents, what broke in each one, plus the exact steps to take now to protect your funds.
| Metric | Number |
| Quantified losses, 12 incidents(sum of low-end figures) | ~$422M |
| September total | $766.5M across 55 major incidents per PeckShield; CertiK counted 97 incidents and $768.4M |
| MoM change | ~462% jump from Augustโs $136.3M |
| 2026 YTD | 656 incidents, $2.68B (CertiK) |
| Recovered in-window | NEAR Intentsโ $3.8M came back in full, so the total is now roughly $6M. Thatโs NEARโs $3.8M plus Neutronโs ~$2.2M, with Bitgetโs frozen funds on top. |
Full incident table
| Date | Target | Loss | What broke | Status |
| 17 | Nostra (Starknet) | ~$3.5M | Oracle price of a thin token pushed ~8,000x and used as collateral | Money market paused |
| 15โ20 | DโCENT app wallet | ~$6M | Signing vulnerability in app versions before 8.1.0 | Hardware wallets not confirmed affected |
| 22 | Neutron โ Astroport, Drop | ~$9.3M (4.9 + 4.4) | Malicious governance proposal handed the attacker admin control of contracts | Cosmos Hub halted ~25h, 1.2M ATOM secured |
| 23โ24 | Meter.io | ~$2.3M minted | Block validation flaw let the attacker mint unbacked MTR and MTRG | Mainnet and bridge paused. MTR down ~80% |
| 24 | Payy Network | ~$1.83M | Ethereum rollup contract drained through its verify Rollup function | Says it was not a key, social engineering or off-chain breach. Report pending |
| 24 | Duelbits | $5.9M โ 7M | Suspected private-key compromise of hot wallets | Offline, co-founder says user funds are safe |
| 24 | Bitget | $387.5M | Third-party zero-day, forged withdrawals | Phased withdrawals resuming |
| 25 | Limit Break Payment Processor V2 (old Magic Eden listings) | ~530โ660 WETH | Flaw in a contract that once settled Magic Eden trades | Whitehats rescued 23,155 NFTs worth over $5.7M |
| 30 / Oct 1 | MetaMask Staking | ~0.36 ETH so far | Undisclosed infrastructure compromise | Validators exiting by Oct 7 |
| 1 Oct | NEAR Intents (Omni) | ~$3.8M stolen (cross-chain exploit) | Vulnerability in Omni deposit/withdrawal logic. | Core fixes applied; withdrawals on BSC/Polygon/Optimism/TON paused ~12h. Hackers make full reimbursement. |
What Next To Do
- Magic Eden users: Revoke Payment Processor V2 approvals on Ethereum, Polygon and Base.ย
- DโCENT app users: Move assets if you ever entered the same recovery phrase in the app wallet.ย
- Meter holders: Donโt bridge, send or buy MTR or MTRG until the team says otherwise.ย
- Lido / MetaMask Staking users: MetaMask hasnโt asked for any action. Expect exits through Oct 7.ย
- Exchange and protocol teams: Treat your security vendors and signing pipeline as attack surface.ย
Watchlist
- Cosmos Hub: A live proposal would move the 1.227M recovered ATOM to Neutronโs recovery multisig. Neutron governance then decides distribution.
- NEAR Intents: Post-mortem pending.
- Bitget: Investigation and attribution ongoing.
- Meter: Post-mortem and restart status pending.
- Liquid: Peg-outs remain suspended pending an audit.
- Payy: A validated root-cause report is promised.
In a busy world overflowing with information, Cryptopolitanโs tailored newsletters curate the most important updates, daily crypto news, Web3 jobs, events, and airdropsโdelivered straight to your inbox.
Stay informed without the noise.
Sign up here: https://www.cryptopolitan.com/newsletters
