BlockThreat - Week 36, 2026
$329M stolen across 14 incidents. Silent patches. Four chains hacked.
Five days. That was the time between a quiet fix published in the public Elements repository and attackers draining 4000 BTC from the Liquid federation wallet. The commit c26d719 titled fix: range proof cache bind to asset and scriptpubkey was merged into master on September 1st, but never made it into an official release. No coordinated disclosure, mass patching or alarm bells going off until the disaster struck. It only took attackers five days to weaponize and execute the hack.
If that sounds familiar, it really should. Just last week, we discussed the very same failure mode in the Cosmos mass compromise incident. A bug deemed not urgent, a quiet fix, reverse engineered patch followed by a weaponized exploit, and then six networks were hit for $12M. The Liquid incident is just another reminder that there is no such thing as a silent patch. Attackers diff open and closed source releases all the time to figure out exactly what is being fixed and why.
What makes 2026 so much worse for this attack path is the sheer speed with which a vulnerability or a published patch becomes an exploit. The old working assumption was you merged the fix, told operators to upgrade "soon", and counted on a few weeks before anyone could reverse engineer the patch, identify the bug, and write a functional exploit. That assumption is dead.
As I covered in BlockThreat - Week 17, 2026, the time from vulnerability disclosure or public patch to a working exploit went from 10 months to just 10 hours in the past five years. The LLM-assisted exploitation has revolutionized the weaponization part of the attack equation.
With these numbers in mind, the five days that Liquid patch sat in public is more than enough time needed for attackers to figure out the vulnerability and exploit it. So just so we are all on the same page: silent patching is no longer a stealth measure and has not been one for at least a year.
What Liquid should have done instead:
- Kept the August fix off any public branch especially when the commit title announced a critical bug to the world.
- Distributed a tagged, signed release privately to the select operators.
- Published the advisory only after every nodes were patched.
This will not be the last time someone lifts a recent patch and weaponizes it, so pay attention to how you run coordinated disclosure. There are plenty of good examples to study. From Bitcoin's duplicate inflation bug to Optimism's SELFDESTRUCT infinite mint that was patched within hours. Reach out for more examples or if you need help designing a playbook that fits your project.
That $47M "Bug Bounty"
At the time of the exploit, Liquid and Elements' idea of a bug bounty program was something fairly common about a decade ago: a security@ mailbox with a public PGP key. A good faith program in a world of weekly multimillion dollar hacks where bad actors set their own "bounties" by stealing first and negotiating later.
So it was no surprise that the Liquid attackers set their own price on a $320M hack, negotiating the record bounty $47M (%15). That is roughly twice the combined bounties paid to every legitimate researcher across Immunefi, HackenProof, Sherlock, Cantina, and other platforms.
The negotiation itself was pure comedy. First an OP_RETURN transaction announced attackers as the "good guys":
we are whitehats, contact us on chain
Then the attackers scolded Liquid for being too slow to patch:
Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.
The irony is that the attackers ran coordinated disclosure on Liquid's behalf complete with patch management and deployment verification.
Now the tragedy part is the one I wrote about in The Breaking Point of Ethical Security Research. A responsible security researcher who found this bug in August and mailed security@blockstream.com would have received a thank you note and maybe a credit somewhere in the release notes. The people who took the chain hostage just needed 48 hours to negotiate the largest ever "bug bounty". No ghosting, no dupes, no escalations, no mediation, none of the usual nonsense. Another slap in the face to every SR choosing to stay on the right side of the law.
Unfortunately Liquid Network was just one of four blockchains exploited this week. I've included detailed post-mortems and attack vectors for all 14 incidents this week including multi-million reward manipulation, function parameter validation, integer overflow and other hacks. The research section has the latest for both aspiring and professional bug hunters such as EVM fuzzer benchmarks, Solana audit tips, vulnerability write ups, and much more.
Let’s dive into the news!
News
- Cyber Game Done Changed by a16z. A collection of charts ranging from the parabolic increase in the number of CVEs, Vulnerability to Exploit rate almost reaching 90%, median time-to-exploit rated in minutes, and more.
- Stopping a blockchain doesn’t always recover stolen funds – What actually happened when 3 networks pulled the plug.
- Trezor Breach Worse Than Reported: Another 67,000 US Customers Exposed.
News - Web2
- FBI Probes Service Selling 153M+ Drivers Licenses. That's more than 63% of all American driver licenses which are now compromised complete with home addresses, signatures, and other PII.
- Armageddon by Anthropomorphism: On Security and the Frontier. by Steven Sinofsky.
Crime - Arrests and Seizures
- Sality Botnet Dismantled After Eight Years of Stealing Bitcoin and Ethereum.
- US officials work with CrowdStrike to fight malware behind crypto theft.
Phishing
Malware
- iOS Safari DarkSword Wallet Asset Theft by SlowMist.
- Don’t Fall for BTC-Stealing Fake Claude Apps as Fable 5.1 and Mythos 5.1 Released.
- 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads by Socket.
Media
- RECON 2026
- Deobfuscation in the Age of Agentic Reverse Engineering by Tim Blazytko and Nicolò Altamura.
- RECON 2026 - I have to use AI, so what now? A skeptic guide to vibing RE/VR by Philippe Laulheret.
- DEFCON 34
Vulnerabilities
- We found a critical vulnerability that will drain DeFi vaults the moment they go live by will. Vulnerability reports for IndexedEx / Down To Finance on Robinhood Chain.
Research - Bug Hunting
- Comparison of Security Tools for Soroban Smart Contracts: Why Sunbeam Is Superior by Julian Dolby and Chandrakana Nandi (Certora). We tested cargo-fuzz, Komet, and Certora Sunbeam on the same Soroban contract to compare bug detection with proof of correctness.
- Solidity Testing Handbook. A Comprehensive Guide To Smart Contract Testing Methods.
- Benchmarking EVM Fuzzers Against an Agent-Written Harness by Michal Převrátil (ack3).
Research - Solana
- How to get wrecked via Solana RPC by Arsen.
- How Correct Code Loses Money by Arsen.
Research - Cosmos
- GHSA-367m-g444-9mg3 - Non-atomic StateDB commit. Another critical vulnerability in Cosmos ecosystem.
Research - AI
- Needle in the haystack: LLMs for vulnerability research by devansh.
- dfbench by depthfirst. Benchmark to evaluate frontier models on open-ended defensive security work, across three objectives: detection, validation, and differential analysis.
Research - Defenders
- ValOS by Lido. A must read specification for blockchain node operators that creates a comprehensive risk model and sets mitigations risk to manage it.
- New framework on developer-targeted intrusions by Security Alliance.
Whitepapers
- Automated Vulnerability Injection in Smart Contracts Using Large Language Models.
- Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations.
Tools
- HackViz by Shred Security. Simulate and learn every exploit. Visualize smart contract drains, bridge hacks, flash loans, oracle manipulations, and governance attacks. Learn how to hunt and secure the blockchain.
- Auditvault by Auditware. Obsidian brain for smart contract auditing.
- Bug Bounty SLA Tracker. Anonymous tracking of unresolved SLAs, ghosting, and payment issues. Driven by the community, secured by Proof-of-Work.
- Zaevlad/audit-findings-dataset on Hugging Face. A collection of 23,625 smart-contract security audit findings (bug reports), each with a title, description, proof-of-concept code, recommendation, and severity rating.
Hacks
Detailed indicators of compromise including exploit transactions, attacker addresses, exploit PoCs are available upon request.
Aquifer Compromise
Date: August 31, 2026
Attack Vector: Function Parameter Validation
Impact: $2,500,000
Chain: Solana
https://x.com/Phalcon_xyz/status/2094654751581610363
Injective Compromise
Date: August 31, 2026
Attack Vector: Reward Manipulation
Impact: $4,900,000
Chain: Cosmos
https://x.com/GoPlusSecurity/status/2095119564409651639
More Markets Compromise
Date: August 31, 2026
Attack Vector: Reward Manipulation
Impact: $410,000
Chain: Flow
https://x.com/blockaid_/status/2094518648123842712
Ontology Compromise
Date: August 31, 2026
Attack Vector: Unknown
Chain: Ontology
https://ont.io/news/ontology-mainnet-emergency-pause-for-comprehensivesecurity-review/
Float Protocol Compromise 2
Date: August 31, 2026
Attack Vector: Unknown
Impact: $28,000
Chain: Ethereum
https://x.com/exvulsec/status/2094361997311877399
Reflexer Compromise
Date: September 1, 2026
Attack Vector: Insufficient Function Access Control
Impact: $14,000
Chain: Ethereum
https://x.com/exvulsec/status/2094819509031117198
Yam Finance Attempted Compromise
Date: September 1, 2026
Attack Vector: Governance
Chain: Ethereum
https://x.com/DefimonAlerts/status/2095019159847313766
GEB Proxy Actions Compromise
Date: September 2, 2026
Attack Vector: Insufficient Function Access Control
Impact: $14,000
Chain: Ethereum
https://x.com/SlowMist_Team/status/2094986310683705835
Notional Finance Compromise
Date: September 4, 2026
Attack Vector: Integer Overflow
Impact: $1,730,000
Chain: Ethereum
https://x.com/NotionalFinance/status/2095905726094856391
Longbow Compromise
Date: September 4, 2026
Attack Vector: Price Oracle Manipulation
Impact: $17,800
Chain: Robinhood
https://x.com/JaceHoiX/status/2096390063747903629
Rocket Compromise
Date: September 5, 2026
Attack Vector: Reward Manipulation
Impact: $287,000
Chain: Ethereum
https://x.com/rcktfoundation/status/2096594778863669498
Dream Health Plan (DHC) Compromise
Date: September 5, 2026
Attack Vector: Reward Manipulation
Impact: $71,851
Chain: BSC
https://x.com/exvulsec/status/2096119185621618858
RedSonic Compromise
Date: September 5, 2026
Attack Vector: Logic Error
Impact: $22,800
Chain: Ethereum
https://x.com/SlowMist_Team/status/2096439593403089077
Liquid Network Compromise
Date: September 6, 2026
Attack Vector: Consensus Failure
Impact: $320,000,000
Chain: Bitcoin, Liquid