Issue #014 · Week of October 04, 2026

This Week’s Verdict

North Korea’s 2026 ledger crossed ten figures on the back of a single exchange breach, which tells you everything about where the real money is lost. Meanwhile two separate exploiters returned funds under pressure, one quadrillion phantom dollars got minted into existence, and a $2.3 billion L2 shut down for the price of a sandwich. The attackers are getting richer, the defenders are getting faster, and the vanity metrics are getting louder.

The Breaches

The headline number belongs to Bitget. Chainalysis traced the September 24 breach, roughly $387 million, back to North Korea, pushing the DPRK’s 2026 haul past $1 billion. The firm detailed chasing stolen funds across four blockchains, with onchain records showing stolen XRP swapped through THORChain. Bitget has since rebuilt its protection fund to $309 million and restored withdrawals on major assets. The money is gone; the optics are managed.

The more interesting story is money that came back. NEAR Intents lost roughly $3.8 million in a Thursday exploit, then its GM identified the attacker, posted three return addresses, and issued a 48-hour ultimatum. The attacker complied, returning about 34.59 BTC in full. Call it a bullish hack if you must; it is really just a reminder that pseudonymity is not anonymity.

Smaller but instructive: an attacker exploited a third-party adapter to drain about $305,000 from two Safe multisig wallets. Aave founder Stani Kulechov was quick to note that Aave v3 itself was unaffected, which is true and also the entire point. The perimeter is never the contract you audited; it is the integration you did not.

Then there is Zano, where an exploiter minted more than a quadrillion fUSD (and some 369 million unauthorized ZANO) that were cryptographically indistinguishable from the real thing. The team’s only remedy was a blockchain rollback, the nuclear option that every maximalist swears is impossible until it is their chain.

Vulnerabilities Worth Your Attention

  • Arbitrum paused new Stylus activations in an emergency security action. Active contracts can still run and renew, and a new BoLD guard can delay unconfirmed withdrawals if contradictory proofs are accepted. Pausing a feature before it bites you is the rarest form of discipline in this industry.
  • Core Lightning warned that attackers are actively targeting unpatched nodes. Anyone running version 26.06.7 or earlier was told to upgrade immediately. Lightning’s attack surface grows every time someone forgets it is real software.
  • Drift opened exploit recovery claims with initial payouts of just over 1% of user losses, no firm timeline for the rest. The gap between “funds recovered” and “funds returned” is where hope goes to die.
  • Beyond crypto, patch anyway: a critical FortiMail zero-day (CVE-2026-104286, CVSS 9.8) is under active exploitation and in CISA’s KEV catalog, two maximum-severity Dell CSM flaws (one CVSS 10.0) give unauthenticated admin and root on Kubernetes nodes, and GitLab patched a 9.9 AI Gateway RCE on self-hosted instances. The infrastructure your exchange runs on does not care that you are decentralized.

Threat Actors & Campaigns

North Korea remains the market mover, full stop. The Bitget attribution is what pushed its 2026 total past a billion, and the laundering pattern (cross-chain hops, THORChain swaps) is the same playbook, just at scale.

Elsewhere, the social layer stayed the weakest link. Microsoft’s official X account, 13 million followers, was hijacked to shill a pump-and-dump token. If Redmond can get its account taken over, your favorite protocol’s intern can too. On the enforcement side, a suspected ShinyHunters member known as “Rey” (Saif al-Din Khader) was reportedly detained in Jordan on September 29 and is cooperating with the FBI to identify other members. Spanish police arrested a 16-year-old accused of running the KillSec ransomware group, with a second suspect facing extradition. And the US Treasury designated Russia’s A7 Network a transnational criminal organization, targeting the front companies behind a ruble token that moved $179 billion. Japan separately added Garantex to its Russia sanctions list, catching up to everyone else.

Offline, the wrench attacks continue: armed men forced a victim to open cold wallets during a home invasion. Self-custody has no password reset, and the attackers know it.

The Bigger Picture

The board shifted most in Washington and Brussels. The Clarity Act stalled in the Senate (ethics disputes over the president’s crypto interests did not help, and a third TRUMP meme coin dinner for the top 185 holders is not helping now). BitGo CEO Mike Belshe warned that Clarity’s failure leaves capital markets exposed to a single firm holding exchange, brokerage, and custody functions, a concentration risk he compared to Lehman. Meanwhile Trump is expected to name Jay Clayton, the SEC chair who sued Ripple, as AI czar. The regulatory memory is long.

On the structural side, the ICBA sued the OCC over crypto trust charters, arguing they are a “side door” into banking without the safeguards. In Europe, Circle pushed back on MiCA’s bank-deposit reserve mandates, and the ECB outlined three models for putting central bank money onchain. Tokenization kept grinding forward regardless: BNB Chain crossed $1 billion in tokenized stocks and ETFs, and Centrifuge put three tokenized funds live on Arc.

As for markets, Bitcoin tapped roughly $87,000 after a weak US jobs report (just 29,000 added, unemployment at 4.2%) erased October rate-hike odds, and spot ETFs logged $2.65 billion in September inflows. The macro did the work, as it always does.

And the quiet obituary: Blast, once a $2.3 billion L2, is winding down after earning $110 in chain revenue in a single day. TVL is a loan; revenue is the rent. Blast forgot to charge rent.

Resources

  • https://decrypt.co/380005/chainalysis-ai-87m-bitget-hack-north-korea
  • https://thedefiant.io/news/hacks/chainalysis-links-387-million-bitget-hack-to-north-korea
  • https://www.reddit.com/r/CryptoCurrency/comments/1wxgusp/bitget_rebuilds_300m_protection_fund_withdrawals/
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.