Issue #010 · Week of September 06, 2026

This Week’s Verdict

The week’s honest exploits were boring by design: no reentrancy poetry, just funds that quietly walked out a side door while an audit was the only thing paying attention. Meanwhile the crowd chased tokenized AMC shares onto the “Robinhood chain” and argued about which flavor of synthetic equity is the least bad. When your biggest custody failure is discovered by an auditor rather than a block explorer, the call is coming from inside the house.

The Breaches

The clean number this week is $7 million. Orionx, the Tether-backed Latin American exchange, is shutting down permanently after an audit found that more than $7 million in customer assets had moved to wallets outside its custody. Note the mechanics: this is not a clever contract drain, it is assets leaving controlled addresses, which is the oldest failure mode in the book and the hardest to spin. The exchange is closing rather than clawing back, which tells you what the recovery math looked like.

The larger financial number belongs to the Trump and Melania meme coins, resurfacing this week in the accounting: roughly 50 wallets in profit against about 2 million wallets in loss. Not a hack, just the designed outcome of a launch where the house holds the supply. It priced in the moment it launched; the rest was distribution.

On the recovery side, Ukrainian police dismantled a crypto scam operation that was pulling in as much as $1 million a month, and a Massachusetts man, Luciano Schipelliti, was sentenced for the Superstar Fund and TTM Fund investment scams. Both were frauds, both are now case numbers.

Vulnerabilities Worth Your Attention

  • Trezor’s ShipMonk breach widens. Another 67,000 US customers had names, emails, phone numbers, shipping addresses, and order numbers exposed via shipping provider ShipMonk, with records dating from 2019 to 2021. The hardware is fine; the metadata is not. Some records predate the 90-day retention window that partners supposedly agreed to, which is its own quiet failure. A hardware-wallet customer list is a phishing target list, full stop.
  • ClickFix payloads stored on-chain. Over 5,400 hacked sites are serving ClickFix payloads hosted in smart contracts on BNB Smart Chain. Putting the malware delivery layer on an immutable ledger is takedown-resistant by design; the chain is now the C2.
  • Invisible Unicode phishing. Microsoft flagged a high-volume campaign splitting lure words like “funding” with invisible Unicode tag characters to slip past email filters. Cheap, effective, and aimed squarely at anyone whose inbox is their weakest key.
  • REVSTEALER’s persistence modules. Four programs (ProManager, WinUpdate, SoftManager, and one more) linger after the stealer self-deletes, with one disabling Windows Update and Defender before running a crypto miner. See below.

Threat Actors & Campaigns

The scam-compound economy got official numbers this week. FinCEN tied roughly $12.7 billion to crypto scams run largely from Southeast Asian compounds by transnational criminal organizations, with monthly reported sums up 18% on average and the model now spreading beyond the region. The Lights in Dark Rooms documentary is a useful reminder that many of the people running pig-butchering scripts are themselves trafficking victims held in those compounds. The Bulkoil/TVF “unlisted in public markets” pitch circulating this week is the retail-facing end of exactly this machine.

On the malware side, REVSTEALER and its miner-dropping modules are the familiar quiet drain: infect, disable defenses, mine, persist. No headline theft, just borrowed compute. Elsewhere, attackers are hijacking MikroTik routers over internet-exposed SSH with no authentication, and exploiting an unpatched Magento/Adobe Commerce zero-day (StyleSmuggler) to backdoor stores. None of it is crypto-native, all of it feeds the same credential-and-wallet supply chain.

The Bigger Picture

The board moved on rails, not on hacks. August payrolls printed 162,000 jobs, roughly five times the prior year’s average, and Bitcoin shed about $1,430 in five minutes as Polymarket traders flipped a September rate hike to the majority outcome. BTC slid back below $80,000 after briefly clearing $81,000. Worth noting: CoinDesk checked six years of data and found NFP is not historically a big Bitcoin mover, so treat the reflex sell as positioning, not prophecy. US spot Bitcoin ETFs still drew $731 million in a single day, the largest since January.

The structural story is tokenized equity. AMC’s CEO Adam Aron called Robinhood’s stock tokens “contemptible” and “vile” and threatened securities counsel; Robinhood’s Dan Gallagher replied “Send your lawyers and we’ll educate them.” Meanwhile a meme coin called BONER cornered half of Hims & Hers tokenized shares, which tells you how seriously the market treats the “equity” part. The Defiant documented that Robinhood Chain’s transaction data went missing from Ethereum for 14 minutes while blocks kept coming every 101 milliseconds — availability without settlement, which is the whole risk in one sentence.

On the plumbing: OpenReserve (a16z-backed) and Revolut secured preliminary OCC approval for national bank charters with crypto and stablecoin plans, and a Bank of Korea study warned dollar-backed stablecoins can push local currencies lower. The banks-are-the-bottleneck thesis is becoming banks-are-the-product. And the G7 is now urging post-quantum migration while QuFi ships a verification platform on Bitcoin testnet, a reminder that Satoshi’s dormant coins remain the single most valuable unpatched attack surface in the space. This week, 600 BTC of Satoshi-era rewards moved after 16 years, with no confirmed link to Satoshi. Already priced, until it very suddenly is not.

Resources

  • https://www.reddit.com/r/CryptoCurrency/comments/1w8wut3/how_2000000_investors_got_wiped_out/
  • https://www.coindesk.com/business/2026/09/06/ukrainian-police-took-down-a-crypto-scam-that-stole-up-to-usd1-million-a-month
  • https://www.reddit.com/r/CryptoCurrency/comments/1w7obxd/massachusetts_man_luciano_schipelliti_sentenced/
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.