Incidents by month
Crypto hacks and exploits in September 2026
30 incidents. Each links to a full write-up: timeline, OAK Techniques, attacker addresses and fund flow, with sources.
Incidents (30)
- MetaMask Staking hack (Sep 2026) — 2026-09-30 · OAK-T15.003 Operator-Endpoint Compromise (Developer Workstation / Signing Machine)
- Fake GIWA chain hack (Sep 2026): $2.08M — 2026-09-26 · loss $2.08M · OAK-T4.008 Fake-DEX Clone-Frontend Phishing
- Limit Break Payment Processor V2 hack (Sep 2026) — 2026-09-25 · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- Demex exploit (Sep 2026): $191,929 — 2026-09-25 · loss $191,929 · OAK-T10.002 Message-Verification Bypass
- Payy exploit (Sep 2026): $1.92M — 2026-09-24 · loss $1.92M · OAK-T10.002 Message-Verification Bypass
- Meter Passport exploit (Sep 2026): $2.3M — 2026-09-24 · loss $2.3M · OAK-T10.002 Message-Verification Bypass
- Duelbits hack (Sep 2026): $7M — 2026-09-24 · loss $7M · OAK-T11.011 Multi-chain Key-store Co-location
- Bitget hack (Sep 2026): $351.6M — 2026-09-24 · loss $351.6M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- Neutron proposal 9 exploit (Sep 2026): $9.4M — 2026-09-22 · loss $9.4M · OAK-T16.002 Hostile-Vote Treasury Drain
- DoinGud exploit (Sep 2026): $35,486 — 2026-09-21 · loss $35,486 · OAK-T9.002 Flash-Loan-Enabled Exploit
- SingularityNET bridge exploit (Sep 2026): $1.53–1.55M — 2026-09-19 · loss $1.53–1.55M · OAK-T10.001 Validator / Signer Key Compromise
- MultiversX exploit (Sep 2026) — 2026-09-19 · OAK-T9.014 Protocol-Client Consensus Bug
- WaterPlum / Contagious Interview hack (Sep 2026): $10.71M — 2026-09-18 · loss $10.71M · OAK-T15.001 Social Engineering of Operator Personnel
- Likwid (Sep 2026): $55,721 — 2026-09-18 · loss $55,721 · OAK-T7.001 Mixer-Routed Hop
- Nostra exploit (Sep 2026): $3.5M — 2026-09-17 · loss $3.5M · OAK-T9.001 Oracle Price Manipulation
- Flamincome exploit (Sep 2026): $345,900 — 2026-09-16 · loss $345,900 · OAK-T9.001 Oracle Price Manipulation
- D'CENT (Sep 2026) — 2026-09-16
- BonfireSwap exploit (Sep 2026): $50,000 — 2026-09-16 · loss $50,000 · OAK-T9.004 Access-Control Misconfiguration
- Safe strategy executor exploit (Sep 2026): $7.73–7.8M — 2026-09-15 · loss $7.73–7.8M · OAK-T9.004 Access-Control Misconfiguration
- SpiralCom exploit (Sep 2026): $26,800 — 2026-09-14 · loss $26,800 · OAK-T9.001 Oracle Price Manipulation
- Long exploit (Sep 2026): $118,000 — 2026-09-14 · loss $118,000 · OAK-T10.002.001 Off-chain Observer Source-Event Forgery
- Chainflip exploit (Sep 2026) — 2026-09-12 · OAK-T10.002 Message-Verification Bypass
- Symbiosis exploit (Sep 2026): $336,000 — 2026-09-11 · loss $336,000 · OAK-T10.002 Message-Verification Bypass
- ether.fi hack (Sep 2026): $38,000 — 2026-09-11 · loss $38,000 · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- Hemi Network (Sep 2026) — 2026-09-07 · OAK-T7.003 Cross-Chain Bridge Laundering
- Liquid Network exploit (Sep 2026): $320M — 2026-09-06 · loss $320M · OAK-T10.001 Validator / Signer Key Compromise
- RedSonic Vault exploit (Sep 2026): $23,000 — 2026-09-05 · loss $23,000 · OAK-T9.001 Oracle Price Manipulation
- Dream Health Chain exploit (Sep 2026): $71,800 — 2026-09-05 · loss $71,800 · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- Notional Finance hack (Sep 2026): $1.73M — 2026-09-04 · loss $1.73M · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- XRPH Wallet hack (Sep 2026): $452,000 — 2026-09-03 · loss $452,000 · OAK-T11.002 Wallet-Software Distribution Compromise