Crypto Security Under Pressure: Three Incidents Raise New Risks
Three separate developments are putting different parts of crypto security under scrutiny this week.
Summary:
- Notional faces a suspected $1.7 million escrow exploit.
- The attacker moved about 689 ETH through Tornado Cash.
- Curve selected Resupply developers for its new risk mandate.
- Pocket Bitcoin confirmed data exposure affecting 5,411 users.
Together, the cases highlight risks that extend beyond smart-contract code to governance decisions and the handling of sensitive customer data.
Notional escrow loses $1.7M in suspected exploit
The most immediate financial loss comes from Notional Finance, where blockchain security researchers identified suspicious withdrawals from an escrow contract.
According to analysis cited by PeckShield, approximately $69,000 in DAI and $1.66 million in USDC were removed, bringing the suspected loss to roughly $1.7 million. The stolen stablecoins were subsequently converted into approximately 689.2 ETH and deposited into Tornado Cash.
#PeckShieldAlert Specter has reported that the Notional Finance escrow contract may have been exploited, resulting in $1.7M in ethereum:0x6b175474e89094c44da98b954eedeac495271d0f and $USDC lost.
The exploiter has swapped the stolen funds into 689.2 $ETH and deposited them into… pic.twitter.com/Wd5Dc3MWtL— PeckShieldAlert (@PeckShieldAlert) September 4, 2026
Initial analysis suggests the attacker was able to create a fraudulent fCash claim corresponding to the escrow’s available balance and settle it as if it represented a legitimate claim.
The distinction is important because the incident appears to concern how the escrow validated and settled claims, rather than a straightforward compromise of a user’s wallet.
Notional had not publicly confirmed the precise technical root cause or issued its own final loss estimate at the time of reporting. That leaves open questions around whether the vulnerability was isolated to the affected escrow contract and whether additional positions could have been exposed.
The rapid conversion into ETH also makes recovery more difficult. Once the assets entered Tornado Cash, following subsequent movements became considerably harder through conventional on-chain tracing.
For Notional users, the next meaningful update will therefore be a technical post-mortem establishing which validation or authorization mechanism failed and whether the vulnerable path has been disabled.
Curve’s new risk provider comes with an unusual history
Curve DAO faces a different security question.
Rather than responding to a new exploit, the DAO has approved yRisk as its full-scope risk provider for crvUSD and Llamalend, replacing LlamaRisk after the previous provider ended its engagement early. According to the Defiant Curve’s governance process selected yRisk from a broader group of applicants before approving its mandate.
The decision is notable because yRisk’s two principal contributors, Wavey and Dudesahn, are also primary developers of Resupply.
Resupply suffered an approximately $9.6 million exploit in June 2025 after an attacker manipulated the exchange rate of a low-liquidity market through a donation attack. The manipulation allowed collateral to receive an artificially inflated valuation before funds were borrowed from the protocol.
Their connection to Resupply was disclosed in yRisk’s proposal. The proposal, however, did not explicitly discuss the $9.6 million exploit, and Curve’s comparative assessment also did not specifically highlight it. Curve’s original call for proposals did not require applicants to list every security incident involving protocols they had developed.
That context changes how the appointment should be interpreted.
Previous involvement with an exploited protocol does not by itself establish that a developer is unsuitable for risk work. Experience investigating and responding to failures can also produce valuable expertise.
The more concrete concern is capacity.
yRisk has only two principal contributors, and reviewers questioned whether a small team with responsibilities elsewhere could provide continuous monitoring as Curve’s lending markets expand.
Its mandate includes monitoring collateral quality, liquidity, oracle dependencies, concentration and bad debt across crvUSD mint markets and Llamalend.
Curve has retained a practical safeguard: yRisk’s compensation is structured through revocable one-year vesting streams, allowing the DAO to terminate future payments if the engagement fails to meet expectations. The package consists of 125,000 frxUSD and 568,181 CRV.
The appointment will therefore be judged less by the Resupply incident itself than by whether yRisk turns that experience into better monitoring, parameter recommendations and incident response for Curve.
Pocket Bitcoin breach exposed more than support emails
The third incident did not compromise a blockchain or smart contract.
It compromised information surrounding Bitcoin users.
Swiss non-custodial service Pocket Bitcoin disclosed that a sustained cyberattack against its customer-support infrastructure exposed information associated with 5,411 customers. The attack unfolded over roughly a week in August before the company contained the intrusion.
The affected customers fall into two groups.
For 5,120 customers, exposed information came primarily from support communications and related records.
READ MORE: Cronos Halts Network as Tectonic Exploit Hits Estimated $75M
Another 291 customers had more sensitive information stored in correspondence with Pocket Bitcoin’s partner banks. Depending on the individual case, that information could include names, postal addresses, Bitcoin addresses, identity documents and source-of-funds documentation.
The distinction matters because Pocket Bitcoin says its primary customer and transaction databases were not breached.
Most importantly, Bitcoin and private keys were not compromised. Pocket Bitcoin operates as a non-custodial service and does not hold customers’ private keys.
That limits the immediate risk of direct asset theft but does not eliminate the consequences of the breach.
Information connecting a real identity with financial activity or a Bitcoin address can create phishing, impersonation and privacy risks even when an attacker never obtains custody credentials.
Pocket Bitcoin said it closed the vulnerability, added further security protections and notified relevant Swiss authorities and police. It has also contacted the 291 customers affected by the more extensive exposure individually.
Three incidents, three different security failures
The week’s developments show why crypto security can no longer be evaluated only by counting smart-contract exploits.
Notional represents the traditional protocol risk: a suspected flaw or validation failure appears to have enabled an attacker to extract assets directly from a contract.
Curve presents a governance and operational risk question: DAOs must evaluate not only technical credentials but staffing, previous incidents, monitoring capacity and accountability when selecting the teams responsible for protecting lending markets.
Pocket Bitcoin demonstrates off-chain data risk. Self-custody protected customer funds and private keys, but it could not protect personal information stored in a compromised support system.
The next developments will be different for each case. Notional still needs to establish the technical root cause and scope of its suspected exploit. Curve now has to assess yRisk through its actual performance rather than its résumé. Pocket Bitcoin’s priority shifts toward preventing leaked customer information from becoming a second-stage phishing or impersonation threat.
For users and investors, those outcomes will provide more useful evidence about security quality than the initial loss figures alone.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
