Infrastructure
Infrastructure
Lloyds Settled $750,000 With Visa From Jersey, Over a Weekend, Onto a Public Chain Nobody Named
Lloyds Banking Group's September 30 release says it settled US$750,000 of payment obligations with Visa in USDC over seven days, with funds landing in under an hour including over the weekend. The USDC was bought on Archax, the volume was booked through Lloyds' Corporate Markets branch in Jersey, Lloyds ran its own Canton node, and Visa settled on a public blockchain neither company names. It was settlement between the two firms, not a customer payment.
Infrastructure
Lose $100 on Drift, Redeem Today, Get $1.04
The Drift Foundation opened claims on October 1 for DFX, one token per dollar lost in the April 1 theft, against a recovery pool of 3.11 million USDT. That is 1.04 cents on the dollar, and the Foundation's formula says it can only rise. Tether's 127.5 million and partners' 20 million are pledged, not deposited; $9.2 million sits frozen pending law enforcement; and 107,165 ETH, almost the entire loss, sits in three wallets the attacker still controls.
Infrastructure
Blast Put 16,148 stETH Into Lido's Exit Queue Within Hours of Its Shutdown Post
On October 2 the Ethereum layer 2 said the chain costs more to run than it earns and gave users until October 26 to leave through its interface. By 19:21 UTC the contract that backs every bridged ETH held no stETH and 21 Lido withdrawal requests, up from four two hours earlier. L2Beat's count of the canonical bridge fell from $49.7 million to $6.3 million in the same hour. The chain's revenue over the previous day was $110.
Infrastructure
Chainlink's 'Extra Fuzz Testing' Commit Guards Against One Number Stalling Every Node
A pull request titled “Extra fuzz testing” in Chainlink's capabilities repository merged in 15 minutes this morning with an empty description. Ten of its lines cap the exponent on decimal observations in the Runtime Environment's median, and the comment on them says a single extreme value “could stall every node computing the median.” The core repository pulled it in on a branch named consensus-hotfix. There is no changeset, no changelog entry and no statement, and the record shows a week of hardening on the same file that preceded it.
Infrastructure
NEAR Intents Holds $503,000 of the $50 Million It Turned Away
NEAR Intents says its SHIELD system detected more than $50 million of attempted Bitget-hack swaps. Most never got a quote and went to other providers; $503,000 was halted mid-swap and $166,000 got through. Its own documentation describes “allow or delay” decisions at quote time and incident records with a resolvedBy field, and says nothing about who releases a frozen swap or how a wrongly flagged user gets funds back.
Infrastructure
THORChain Says It Never Blacklisted the Thief Who Took Its Own $10.7 Million
Bitget formally asked THORChain to refuse service to the addresses behind its $387.5 million breach. THORChain replied that a halt “is not a selective freeze of specific funds or an individual swap” and that the attacker who drained one of its own vaults in May was never blacklisted. Its documentation lists about thirty halt keys, for chains and for the whole network; the only ones scoped to an address apply to smart contracts. In 2025 its founder said he would accept a static deny list from the FBI or OFAC. No such list names Bitget's attacker yet.
Infrastructure
Cosmos Wrote a Warning Where a Check Should Have Gone
The Cosmos SDK documentation states that removing a validator key type still in use will halt the chain. The governance message that does it is accepted without complaint, and the halt arrives later, on whichever delegation happens to change a stale validator's power. A patch filed September 22 proposes the missing check.
DeFi
Who Watches Balancer's Pools After October 30?
A wind-down proposal posted September 14 would return a treasury of at least $9 million to BAL holders. On October 30, pausable pools go withdrawals-only and the bug bounty "no longer exists." Pools that cannot be paused keep working. In the November 2025 exploit, the pools still inside their pause windows were stopped within 21 minutes. DefiLlama shows about $55 million still in Balancer contracts. The Snapshot vote runs September 25–29.
Desk original
Mysten Rewrote a Sui Verifier for a Feature No Chain Has Turned On
A Mysten Labs engineer rewrote Sui's PTB memory-safety invariant check — 1,301 lines, one file — and a cherry-pick carried it into the v1.80 release branch 48 minutes after it merged. The test he added is named reference_path_explosion, and it chains four calls that each consume and return sixteen references, the maximum protocol version 136 allows. This desk read the protocol config: the feature the check guards, references inside PTBs, is not enabled on mainnet, testnet or devnet, and the new checker does not activate until protocol version 137. Mainnet runs 136. No advisory, no CVE, and no stated reason for the hurry.
Analysis
Osmosis Will Ask Its Voters to Seize an Attacker's 22.65 Bitcoin
A flaw in a custom forwarding mechanism on Nomic let an attacker double-spend nBTC and send unbacked vouchers into Osmosis over IBC. Osmosis said 39.84 nBTC inside the Alloyed BTC contract — about 36% of the alloy's backing — had no Bitcoin behind it. Validators pushed an emergency upgrade that froze 22.65 BTC at an attacker address, leaving roughly 17.19 BTC to be covered from the community pool. Neither Osmosis's contracts nor IBC were compromised; the alloy's per-bridge composition limits capped the damage at roughly a third and no lower. Nomic has published no post-mortem.
Desk original
Bridge Hacks Went From 3 to 26. The Same File Also Says 11 to 39
Coverage of the Liquid hack cites DefiLlama for a jump from three attacks on cross-chain infrastructure in 2025 to 26 in 2026. This desk downloaded the same public file and confirmed those figures — then found a second bridge field beside the first, a boolean flag that counts 11 and 39 instead. Both are defensible: one records what broke, the other what got hit. Fifteen 2026 incidents sit in the gap, including AFX Bridge at $24.15 million and Gravity Bridge at $5.4 million. The trend is real on either measure, and the dollars — $38 million to $739 million — rose faster than any incident count.
Original reporting
The Comment Said the Unwrap Was Safe
A NEAR maintainer found that the optimistic-block path summed chunk-header gas fields across every shard before any block-level check ran — then discarded the arithmetic's own safety with an .unwrap(), on the strength of a comment that had stopped being true. The fix merged in 41 minutes, with an adversarial test that forges the header and proves the crash.
Developing
Ontology Stopped the Chain on a Suspicion
Block production ended at 10:29 UTC over a concern found in a routine check. No breach, no loss, no disclosed vulnerability — and the second chain halted in 48 hours.
Infrastructure · Developing
The Signature Was Valid. The Key Behind It Wasn't
Switchboard halted oracle feeds on Aptos, Sui, IOTA and Movement after a suspected compromise. Full Sail confirmed lost user funds; an attacker priced IOTA at $10 million and minted 4.94M VUSD.
Infrastructure · Governance
Solana's First Real Vote Came Down to Two Firms Changing Their Minds
The inaugural binding governance vote cleared its two-thirds bar by roughly a third of a percentage point. The mechanics of that margin say more than the outcome.
Bridges
LayerZero Delegate Hijack Mints Unbacked SAND on Base
Blockaid flagged automated minting across hundreds of transactions after delegate permissions were compromised — a bridge-trust failure, not a token bug.