đź‘‹ Welcome to the September Edition
We joined Issuant OS to bring security into tokenized issuance from day one, and hosted Tokenized Finance: Rules & Risks in Dubai on what VARA actually expects. Three of our auditors are also heading to DeFi Security Summit to speak.
$740.2M stolen in September. Two incidents, a compromised exchange hot wallet and an unbacked bitcoin peg, account for 95% of it, making September the worst month of 2026. Full story in Hack Watch below.
On research, we launched Quill Findings and covered Coinbase's weekend oracle gap, the Ethereum assumptions that break on Arc, and what VARA demands from tokenization projects in Dubai.
Here's the full September roundup!
QuillAudits Heads to DeFi Security Summit
Three of our auditors are taking the stage at DeFi Security Summit (DSS), November 1-2, to talk about the security problems most reviews never reach. Their sessions cover ZK circuits, the full blockchain stack under quantum threat, and the practice grounds auditors train on.
​Kalp Shah | The Proof Lied: DeFi’s Invisible Circuit Exploits
​Victor Okafor | Quantum-Safe Is Not Just Post-Quantum Signatures: The Five Other Layers Quantum Actually Breaks in Blockchains
​Anu Adeleke | Damn Vulnerable Daml
It’s the same research that goes into our audits, now shared with the room. If you’re at DSS, come find us. We’d love to hear what you’re building.
From the Quill Research Desk
September’s research kept landing on the same conclusion. The code usually does what it says, and the risk sits in the assumption around it: a price that freezes on weekends, a chain that looks like Ethereum but isn’t, or a licence treated as the finish line.
​Coinbase’s Oracle Freezes on Weekends. Your Risk Doesn’t. Coinbase put 13 tokenized US stocks live on Base, each priced by a Chainlink equity feed multiplied by a number Coinbase controls. That feed holds Friday’s close until Monday while Aerodrome keeps trading. Any lending market that skips an updatedAt staleness check is valuing collateral that is two days old.
​VARA’s Compliance and Security Requirements for Tokenization Under VARA there are four compulsory rulebooks, and every control has to work after launch, not just exist in a policy document. We mapped them into one pre-launch checklist for Dubai. It runs from a named CISO and documented key management to 1:1 reserves reconciled daily and audited every six months.
​Ethereum Assumptions That Break on Arc Mainnet Circle’s Arc went live on Sep 16 with USDC as its native token, and that one decision breaks contracts that are safe on Ethereum. Native transfers can revert even when the balance is enough, and SELFDESTRUCT now moves USDC. The same USDC also carries 18 decimals natively but 6 through ERC-20, so any LTV or share-price formula can misprice by twelve orders of magnitude.
​What It Takes to Secure Tokenized Assets in Dubai On Sep 7, a 1,971kg silver bar became the first commodity tokenized under the DMCC and VARA framework. We traced where tokenized assets break: the minter, the vault feed, signers, redemption, and admin keys. Our H1 data shows 82.7% of $935.3M lost came from key compromise and bridge exploits, not contract bugs.
This month we also launched Quill Findings, a weekly series on real bugs our auditors caught in client engagements, each with a working PoC and fix.
​Quill Findings: Eligibility Replay in Tokenized Assets A gold-backed vault handed the custody certificate back on release instead of burning it. Re-depositing that certificate minted 1,000 fresh claim tokens against a bar that had already left the vault. The fix, a single burn() call, was already sitting in the code.
​Quill Findings: Missing Access Control in Tokenized Real Estate A property launchpad held approval over every seller’s listed shares, and its safeTransferFromNFT() had no access check. Anyone could call it to move a seller’s shares into their own wallet, skip buyProperty(), and pay nothing.
​Quill Findings: APY Miscalculation in Staking Rewards A staking contract paid the full 8% yearly APY on every 60-day lock, about 6x the intended reward. Re-locking turned 8% into roughly 49% a year. In the PoC, the first staker drained the reward pool and the second couldn’t withdraw their own principal.
Hack Watch
September totals 14 incidents, $740.2M stolen, across 13 chains. That is fewer incidents than August and five times the losses. Two days did nearly all the damage: Sep 6 and Sep 24 together account for $717.6M, which makes September the worst month of 2026.
Bitget $387M Ethereum, XRP, Tron, Zcash, Sep 24, Hot Wallet Compromise. The funds left straight from Bitget’s hot wallet, with no oracle bug, governance vote, or bridge flaw involved. At 52.3% of the month, it was one incident across four chains. Duelbits lost another $7.0M the same day to the same type of failure.
Liquid Network $320M Liquid, Sep 6, Unbacked Mint. L-BTC was minted with no matching bitcoin deposit and then pegged out, so the reserve paid real bitcoin for tokens nothing backed. No key leaked. Three days later, Nomic hit the same class of bug for $3.15M.
Astroport and Drop $9.3M Neutron, Sep 22, Governance Proposal. Both protocols passed a bad proposal on Neutron on the same day. The $9.3M moved through what governance was allowed to touch, not through a contract bug.
​Notional Finance $1.73M Ethereum, Sep 3, Integer Overflow. The attacker engineered two fCash debts that summed to exactly 2^128, and an unchecked uint128 cast truncated that to zero, so the most insolvent account possible passed its collateral check. The attacker then minted claims equal to Escrow’s full DAI and USDC balances and withdrew them as real tokens.
Key compromise led the month at 3 incidents and $395.5M, 53.4% of losses. Bridges and cross-chain followed with 4 incidents and $325.7M, 44.0%. The remaining five categories made up just 2.6%. September alone outweighed July and August combined and pushed the year past $2.06B. Read the full September 2026 hack report and track the live incident log on QuillMonitor.
If a hot wallet can pay out $387M, signer access is the attack surface. If a peg mints without checking a deposit, the reserve is the prize. If a proposal can move anything, governance is the exploit. This month’s lesson is to audit the money path, not just the contract.
QuillAudits Stats
A quick look at our September audit activity and how we helped secure the Web3 ecosystem.
Where to Find Us Next
We're hosting two events in Mumbai during IBW and Devcon week.
​The Institutional Table | Private Dinner on Tokenization, Stablecoins and Security Nov 2, 7:30 PM, BKC Mumbai. A 41-seat invite-only dinner where banks, asset managers, tokenization platforms and stablecoin issuers talk about what it takes to put regulated assets on public chains. The conversation runs under Chatham House rules, with no slides, press or recording.
​Ship Safe | Devcon Mumbai Security Sessions Nov 6, 4:00 PM, BKC Mumbai. The program covers 2026 exploit teardowns, an audit-readiness clinic, AI-assisted auditing, and a panel on what actually broke this year. Drinks follow from 6:45 PM.
Seats are limited and every registration is reviewed. Request your spot.​
Community Highlights
We joined Issuant OS, bringing audits, testing, incident response and on-chain monitoring into the tokenized issuance workflow from day one.
|
11:30 AM • Sep 18, 2026
|
|
​
On Sep 12 in Dubai, we hosted Tokenized Finance: Rules & Risks, three hours on what VARA expects from audits and monitoring, and where tokenized products break.
September's losses didn't need a clever exploit, just a hot wallet nobody guarded and a mint nobody checked. $2.06B lost so far this year. The baseline isn't improving.
We'll see you next month. Stay paranoid. Audit everything.
Wanna partner up w/ us or want to get your project audited? |
|
|
Have a great day,
Team QuillAudits
