NEAR Intents got back all $3.8 million drained through a bug between its Omni deposit-and-withdrawal layer and its contract, after encrypted talks. Whether that layer is safe now rests on the patch, since every user who lets the protocol choose a bridge depends on it.
Perspective Coverage
4 publishers
- Builder
- Builder 31%
- Operator
- Operator 45%
- Investor
- Investor 24%
Reality
- Evidence74
- Adoption55
- Hype gap+15
- Incentives60
- Confidence72
443 blockchains together collected less than $440 in fees on October 3
DefiLlama's October 3 snapshot shows 399 of the 558 blockchains it tracks earned zero fees in 24 hours, while only seven cleared $100,000. For most of the field, user fees are too small to support a token price.
Reality
- Evidence55
- Adoption30
- Hype gap+15
- Incentives
- Not scored
- Confidence55
Solana and Robinhood Chain take nearly half of onchain app revenue in 2026's best month
Solana and Robinhood Chain took 49% of the $467.66 million onchain apps earned in September, the best month of 2026 in DefiLlama's data. Memecoin launchpads account for Solana's share, but Robinhood Chain's near-tripling has no reported source, so one month cannot show fees settling there.
Reality
- Evidence55
- Adoption60
- Hype gap+10
- Incentives
- Not scored
- Confidence50
One Bitget breach supplied half of September's record $766 million in crypto hack losses
Crypto hacks drained $766.49 million in September, a 2026 monthly record, and $387.5 million came from one breach of Bitget's hot wallets. After the money returned from the Liquid Network exploit, that one exchange accounts for about 80% of what stayed stolen.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher Chainalysis counts a more than fivefold rise in malware that pulls its instructions from public blockchains
Chainalysis says blockchain-assisted cyberattacks, driven mostly by North Korean and Iranian state actors, have risen more than fivefold since last year. The malware reads server addresses or code from public chains, and no seizure or hosting takedown can delete those records.
Reality
- Evidence40
- Adoption40
- Hype gap+20
- Incentives50
- Confidence45
buildOne report1 publisher Three wallets round-tripped two thirds of the volume in CoinMarketCap's top Uniswap v2 pair
A keyless detector built to catch sandwich attacks on public DEX data found two in 8,000 swaps. In the pool CoinMarketCap ranked first by 24-hour transactions, three wallets were buying back what they had just sold inside single transactions.
Reality
- Evidence55
- Adoption12
- Hype gap+20
- Incentives50
- Confidence45
Chainalysis puts state hackers behind two of every three blockchain dead drops
Chainalysis says writes of malware instructions to public blockchains have climbed from about 2.06 a day to 11.1 since July 2025, with groups tied to North Korea and Iran behind most of the increase. Its research lead could not confirm AI models helped.
Reality
- Evidence42
- Adoption48
- Hype gap+30
- Incentives68
- Confidence40
Talos ties a fake Google CAPTCHA to a DLL executing from a remote WebDAV share
Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.
Reality
- Evidence68
- Adoption38
- Hype gap−12
- Incentives55
- Confidence60
Talos found ClickFix operators moving their skimmer into a Tampermonkey userscript
The lure is a fake leaked vulnerability report promising 38% higher payouts to anyone greedy enough to paste the code. The command channel is a public Google Sheet that Talos reported twice and that stayed up.
Reality
- Evidence64
- Adoption68
- Hype gap−8
- Incentives62
- Confidence60
5,400 hacked WordPress and PrestaShop sites pull their ClickFix payload from a BNB testnet contract
The contract cannot be deleted. Every injected site has to reach a public BNB Smart Chain testnet RPC endpoint to read it. Netskope recommends blocking that pool. The payload has already changed once.
Reality
- Evidence52
- Adoption64
- Hype gap+14
- Incentives58
- Confidence55
A fake GTA 6 countdown page loads a seven-chain wallet drainer on arrival
Malwarebytes has now documented three different GTA 6 scam payloads since June, so awareness copy written around one lure is describing a page the operators have already rebuilt. The drainer arrives before any click.
Reality
- Evidence68
- Adoption30
- Hype gap−8
- Incentives65
- Confidence58
One address-poisoning operator drained $9.4M from 15 Tron wallets in four weeks
MetaMask and Trust Wallet both ship poisoning detection, and both keep it on EVM chains, which leaves Tron users doing the character-by-character checking themselves. The two largest victims paid $2.5M each.
Reality
- Evidence42
- Adoption55
- Hype gap+18
- Incentives62
- Confidence45
BSC gives node operators until 02:30 UTC on August 25 to be running v1.7.7
Pasteur bundles a bridge signature-counting fix, a retired-key cleanup, and a pre-executed-block change that took testnet throughput from 1,237 to 2,324 TPS.
Reality
- Evidence58
- Adoption38
- Hype gap+12
- Incentives62
- Confidence55