Risk in DeFi: September post-mortem

Overview

This review examines the most notable onchain incidents of September 2026, measuring each against Credora’s risk assessment methodology to assess whether the risk factors around the exploits would have raised any red flags in a review. It serves two ends: to provide an account of how and why each failure happened, and to run a standing test of Credora’s methodology against realized losses. The verdicts that fall short matter as much as the ones that land, since they mark where the framework must evolve. A scorecard follows at the end.

September was crypto’s worst month of 2026 by dollar amount across all incidents. PeckShield counted 55 major incidents and about $766M lost, a 462% jump from August, beating April’s high of $646M. As tracked by DeFiLlama, 2026 is now at $1.4B+ in cumulative losses so far; CertiK, for its part, prices the cryptocurrency industry’s combined losses to hacks at almost $2.7B year-to-date. But details matter. Almost 92% of September’s total losses is split between two events, the Bitget exchange breach (~$387M) and the Liquid Network peg exploit (~$320M). Much of the Liquid loss came back: self-described white hats returned about $272M after the bug was patched. Bitget, for its part, is a centralized exchange, with the hackers reportedly using a vulnerability in its security software, which places the incident beyond the scope of DeFi risks.

---

Risk in DeFi: Shifting attack vectors

September’s highest loss was caused by something an asset rating does not read: a centralized exchange’s internal systems (Bitget). The same applies to many other, smaller incidents, routed via the vendors around a hardware-wallet brand (Trezor) or a wallet-level vulnerability (D’CENT Wallet). September’s second-largest incident (Liquid Network), on the other hand, accounted for roughly 42% of the month’s total and was indeed on the DeFi side. The other onchain protocol failures were comparatively familiar: a governance vote captured for about $20,000 that seized two protocols at once (Astroport and Drop), an oracle feed pushed 8,000x by a poisoned price source (Nostra), a contract that trusted a forgeable sender (Payment Processor V2), and unbacked tokens minted through a block validation flaw (Meter). Unbacked minting was the month’s recurring onchain pattern, and every onchain failure mapped, at least in part, to a risk the framework already prices.

---

1. Liquid Network (L-BTC), est. ~$320M, September 6

About 4,000 BTC, worth roughly $320M, was drained from the federation wallet backing Blockstream’s Liquid sidechain, about 95% of its reserve. The attackers exploited a bug in Elements, the software Liquid runs on: to save computing power, Elements caches the results of range-proof checks it has already done, and a flaw in that cache allowed invalid transaction data to pass as already verified. The attackers used it to create roughly 4,000 L-BTC with no BTC behind it, then redeemed the fake L-BTC through SideSwap’s authorized peg-out, and the federation paid out real BTC from its reserve. After moving the funds, they identified as white hats, negotiated with Blockstream, and returned about 3,400 BTC (~$272M) once the bug was patched, keeping roughly 598.5 BTC (~$47M).

L-BTC is a federated one-to-one peg to BTC: the Liquid functionaries mint L-BTC on deposit and burn it on withdrawal. The failure was in transaction validation, not in the peg: a bug in the chain’s own node software let L-BTC be created outside the peg entirely, so supply grew with nothing behind it. That bug sits below what an asset rating reads, but the controls that turned it into a near-total reserve loss do not.

Methodology mapping

→ Circuit Breaker: the dimension scores whether a protocol can cap or halt outflows once activity turns abnormal. A single peg-out took about 95% of the reserve within about 22 minutes, with no rate limit, delay or size cap to slow it.

→ Reserve Transparency & Management: a one-to-one peg is only sound if every unit in circulation is backed, and that backing is checked. Liquid’s reserve was disclosed, but nothing reconciled L-BTC supply against BTC held before releasing it, so the federation paid real BTC for tokens that had never been backed.

Verdict: PARTIALLY COVERS. The validation bug itself sits beyond the scope of a risk assessment as it lives below the asset layer, and the issuance controls and functionary keys held. What the framework does score is the containment, a peg that allowed one withdrawal to drain nearly the entire reserve with no cap and no supply-to-reserve check. Those controls would have flagged weakness before September and would have limited the loss, though not prevented the bug. The white-hat return reduced the net loss, not the exposure.

---

2. Nostra Finance (NSTR), est. ~$3.5M, September 17

Nostra, a lending protocol on Starknet, was drained of about $3.5M after an attacker manipulated the price of its own token, NSTR. The attacker had pre-positioned since March, then spun up a thin NSTR/SolvBTC liquidity pool and pushed its NSTR price to about $99. GeckoTerminal picked up that pool, and Pragma’s NSTR feed, which had only two sources, averaged it with an AVNU quote of about $0.006, marking NSTR at about $49.5, roughly 8,000x. With NSTR marked at the inflated price, they borrowed about $3.5M against it and bridged about $1.9M of it to Ethereum. Nostra froze the market; TVL fell from about $4M to $710K.

NSTR carried a market capitalization under $600,000. A token that thin was accepted as collateral, and its oracle feed ran on just two sources, one of which an attacker could poison with a pool they created. Pragma’s own three-source minimum was not enforced.

Methodology mapping

→ Oracle Risk & Collateralization: the framework scores how a lending market prices its collateral and whether thin, low-cap tokens are onboarded with safeguards. Pricing collateral from a two-source feed that an attacker-made pool could poison, with nothing to reject an 8,000x move, is the collateral-valuation weakness these dimensions assess.

→ Circuit Breaker: whether a protocol can cap or halt borrowing once a feed moves abnormally is scored. Nostra had no automated guard on an 8,000x move and froze the market only after the $3.5M was borrowed, so the brake came too late to stop the loss.

Verdict: COVERS. Whether a market prices collateral from a manipulable source, and whether a sub-$600,000-cap token should be collateral at all, are scored. A money market taking NSTR at an 8,000x-inflated price would have rated poorly in advance, the same lesson as August’s Moonwell and Tectonic. Pragma, the oracle provider, flagged six of its feeds, NSTR among them, as critical risk afterward, which is the dependency the framework reads as its own unit.

---

3. Astroport & Drop (Neutron), est. ~$9M combined, September 22

Two protocols on Neutron, the DEX Astroport and the liquid-staking protocol Drop, lost about $9M combined when an attacker seized admin rights over both through a single governance vote. On September 22, Neutron DAO proposal 9 transferred admin control of the Astroport and Drop contracts to the attacker, who migrated them to malicious code and drained them within about 24 minutes. A linked wallet spent about 20,199 USDC on 31.6M NTRN roughly 11 minutes before voting closed, and attacker-linked wallets supplied about 98% of the YES vote.

No contract bug was involved, and neither protocol’s code was exploited. Both had multisig admins, but Neutron’s chain-level governance could override any contract’s admin, and that governance, voted with staked NTRN, was cheap to capture.

Methodology mapping

→ Governance (Capture Risk): the modifier scores governance that can be captured cheaply relative to what it controls, weighted up where participation is low, including who holds contract admin and upgrade rights. Proposal 9 handed exactly that, admin control of both contracts, for about $20,000 of NTRN, a power Neutron governance held over every contract on the chain, whatever its own admin setup.

Verdict: COVERS. Governance capture is scored, and here it compounded: two protocols sat under a Neutron vote that could override their admins and was cheap enough to buy outright. It is the Term Finance and BonkDAO pattern at the chain-governance layer. An execution delay would have left a window to contest proposal 9, the lever BonkDAO lacked, but the captured right itself, contract admin behind a cheap vote, is scored, so this is a full Covers rather than partial.

---

4. Meter Passport (MTRG), est. ~$2.3M, September 23 

Meter’s network was exploited to mint about $2.3M of unbacked MTR and MTRG, which the attacker sold on PancakeSwap on BNB Chain. MTR fell about 80% and MTRG about 75% as the unbacked supply hit the market. Meter paused its mainnet and its Passport bridge, asked users to stop transacting, and said transactions after block 100731417 may not be honored.

A bridge mints wrapped tokens only against a verified lock on the source chain. Meter attributed the exploit to a block validation flaw that let the attacker mint unbacked MTR and MTRG, which they dumped before the network was paused. No technical post-mortem has been published, and the mainnet-wide pause suggests the flaw may sit at the chain level rather than only in the bridge.

Methodology mapping

→ Bridge Risk & Mint Authority: a bridge’s core job is to verify the source-chain event before minting, and to never create wrapped units without backing. A block-verification flaw that allows unbacked minting is the bridge-validation and mint-authority failure these dimensions score.

→ Circuit Breaker: Meter paused only after the unbacked tokens were minted and dumped. A mint-rate cap or an auto-pause on abnormal issuance would have limited the loss, which is the containment this dimension scores.

Verdict: COVERS, provisionally, pending Meter’s post-mortem. Whether a bridge rigorously verifies the source-chain event before minting, and whether wrapped units can be created without backing, are scored. A bridge whose verification can be bypassed to mint unbacked tokens would have rated poorly in advance. Like Liquid, it ended in unbacked supply, though the exact mechanism is not yet public.

---

5. Payment Processor V2 (Limit Break), est. ~$2.8M, September 24

Limit Break’s Payment Processor V2, an NFT-marketplace settlement contract that Magic Eden routed trades through until October 2024, was exploited through approvals users had never revoked, with about $2.8M in confirmed losses: 660 WETH (~$1.7M) plus 3,832 NFTs bought at zero price. The attacker took blue-chip NFTs, including Meebits, Otherdeeds, World of Women, and Desperate ApeWives. A white-hat rescue led by Yuga Labs’ 0xQuit then secured about 23,155 more NFTs (~$5.7M) that were still exposed through those legacy approvals. Limit Break paused Payment Processor V3, which carried the same bug, but V2 had no pause and could not be stopped.

The flaw was in how the contract handled meta-transactions, where a relayer submits a transaction for a user and the contract treats it as coming from the original signer. Payment Processor V2 trusted a sender address passed to it by an approved forwarding contract, and that address could be forged, so the attacker could act as any wallet that still held an approval to the contract.

Methodology mapping

→ Smart Contract Risk: the framework assesses a protocol’s own code in depth, including how it authenticates the caller and handles forwarded or delegated transactions. Trusting a forgeable sender from a forwarder is an authentication flaw in the contract’s own logic, and outstanding legacy approvals turned it into a drain.

→ Circuit Breaker: the dimension scores whether a failing contract can be halted. Limit Break paused V3, which shared the bug, but V2 had no pause, so once the exploit began there was no way to stop it.

Verdict: COVERS. How a contract authenticates who is acting, whether forwarded transactions can be spoofed, and whether a live contract can be paused are all part of the assessment. A settlement contract that trusts a forgeable forwarded sender, with approvals still outstanding and no pause, would have rated poorly in advance. That approvals from a service users left in 2024 were still live is the standing exposure a rating reads, separate from the specific bug.

---

Summary

Incident	Date	Estimated loss	Root cause	Primary Credora dimensions	Verdict
Liquid Network (L-BTC)	Sep 6	~$320M (~$272M returned)	Validation bug created unbacked L-BTC; redeemed for reserve BTC via peg-out	Circuit Breaker, Reserve Transparency	Partially Covers
Nostra Finance (NSTR)	Sep 17	~$3.5M	Two-source NSTR feed poisoned via a thin pool (~8,000x); borrowed against it	Oracle Risk, Collateralization, Circuit Breaker	Covers
Astroport & Drop (Neutron)	Sep 22	~$9M combined	~$20K of NTRN captured a Neutron vote that seized both protocols’ admin	Governance (capture)	Covers
Meter Passport (MTRG)	Sep 23	~$2.3M	Block validation flaw minted unbacked MTR/MTRG; dumped on PancakeSwap	Bridge Risk, Mint Authority, Circuit Breaker	Covers
Payment Processor V2 (Limit Break)	Sep 24	~$2.8M (~$5.7M in NFTs rescued)	Forgeable forwarded sender in meta-tx path drained live legacy approvals	Smart Contract Risk, Circuit Breaker	Covers
Other events…
Bitget	Sep 24	~$387M	Third-party vendor flaw gave internal credentials; fraudulent withdrawals	None (CEX custody and operations)	Out of scope
Trezor (vendor breaches)	Sep 4-9	No protocol loss; ~347K phished	ShipMonk and Brevo vendor breaches; phishing campaign	None (off-chain vendor layer)	Out of scope
Duelbits	Sep 24	~$6–7M	Hot-wallet drain (suspected key compromise) at a centralized gambling platform	None (CeFi custody)	Out of scope
D’CENT Wallet	Sep	~$6M (estimates $2.8M–$20M)	Suspected key-generation flaw in older app versions	None (wallet layer)	Out of scope

The five incidents above are the month’s onchain asset and protocol failures, each mapped to a dimension the framework scores. The out-of-scope events under Other events are where most of the dollars sat: Bitget was the largest crypto theft of 2026, a centralized-exchange breach that ran through compromised internal credentials rather than any token’s logic; Trezor was two vendor breaches and the phishing they enabled; Duelbits and D’CENT were a centralized hot-wallet drain and a suspected wallet key-generation flaw. Smaller onchain exploits that the framework would also read, but that were too minor to carry a section, include Payy Network (~$1.8M, a bridge rollup-verification exploit) and a MultiversX VM exploit that paused the network. Separately, April’s $292M KelpDAO/rsETH exploit returned to headlines when its operator sued LayerZero over the bridge’s single-verifier configuration; that was an April loss, not a September one.

---

How to read the verdicts

Covers means the failure maps to a risk the framework scores, and a poor score would have been assignable before the event. Every other onchain asset or protocol failure this month qualifies: Nostra, Astroport and Drop, Meter, and Payment Processor V2. Coverage does not mean the rating times the exact transaction, names the defective line, or predicts when a vote is bought; it means the standing weakness was scorable in advance.

Partially covers means the framework sees part of the risk but not the dominant part. The Liquid incident falls here: the exploit itself sat on a layer the framework does not cover, but the loss ran through missing controls, a withdrawal cap and a supply-to-reserve check, that an assessment would have scored.

Not covered is the most consequential verdict: an incident within the framework’s remit that it failed to flag at all, a false negative rather than a boundary. No September incident fell here.

Out of scope means the failure sits on a layer an asset rating does not read, and this month that layer held most of the money. Bitget, the largest loss of 2026, was a centralized-exchange breach: a flaw in a third-party security product gave the attacker high-level internal credentials, which pushed about $387M of fraudulent withdrawals through the exchange’s hot-wallet backend. Trezor was two vendor breaches, at a logistics provider and an email provider, that fed a phishing campaign to roughly 347,000 subscribers. Duelbits and D’CENT were a centralized hot-wallet drain and a suspected wallet key-generation flaw. All sit at the exchange, wallet, and vendor layers, the same boundary as August’s Coinsbuy and July’s Coldcard.

---

Key takeaways

September set the year’s loss record, but not because the asset layer broke. The Bitget exchange hack (centralized) sits outside DeFi proper. The Liquid peg exploit is closer to the asset layer, but there, the failure was largely below what an asset rating would cover. The onchain protocol failures were small by comparison and entirely familiar: unbacked minting (Liquid, Meter), oracle manipulation (Nostra), governance capture (Astroport and Drop), and a contract-authentication bug (Payment Processor V2). Each maps to a risk the June, July, and August editions already covered.

Two patterns are worth marking. The first is unbacked minting. Liquid and Meter both created tokens with nothing behind them, one through a caching-based exploit, the other through a block validation flaw, and in both cases the question a rating asks first, can new units be minted without backing, is the one that broke. Mint authority and reserve integrity are not abstract notches; they decide whether supply in circulation is actually backed. The second is the custody layer. The largest losses of 2026 keep landing on exchanges, wallets, and the vendors around them, Bitget and Trezor this month, Coinsbuy and Ledger last. That layer is out of scope for an asset rating by design, but it is where the dollars increasingly are, and it is worth saying plainly that rating the token does not protect a holder who loses their keys or their exchange.

Frequently Asked Questions

How does Credora assess risk in DeFi beyond the asset layer?

Credora’s methodology accounts for both onchain and offchain risk surfaces, across dimensions including Key Custody Environment, Reserve Transparency, Mint Authority, Bridge Risk, and Oracle Risk. Some layers remain beyond its scope: as September’s Bitget and Trezor cases show, a centralized exchange’s internal systems and a hardware vendor’s supply chain sit below what an asset rating reads, the same boundary as July’s Coldcard.

How does the Probability of Significant Loss (PSL) measure risk in DeFi?

The PSL is Credora’s main risk metric for markets and vaults: the probability that a position loses more than 1% of principal over a 30-day horizon, estimated by Monte Carlo simulation and annualized. A companion metric, the Probability of Default (PD), applies the same logic to individual assets. Both convert qualitative factors, from smart-contract audit quality and key custody to reserve transparency, peg performance, and counterparty dependencies, into a single value that compares markets, vaults, and assets, expressed as a rating from A+ to D.

What were the main DeFi exploit categories in September 2026?

Onchain, the losses were unbacked minting (Liquid’s validation bug and Meter’s block validation flaw), oracle and collateral manipulation (Nostra), governance capture (Astroport and Drop), and a contract-authentication bug (Payment Processor V2). The month’s record dollar figure, though, came from a centralized-exchange breach outside DeFi proper (Bitget) and a Bitcoin-sidechain caching exploit (Liquid), with custody and vendor failures (Trezor, Duelbits, D’CENT) making up much of the rest.