🗡️ The Damage Report (Sept 21) 🚨: Half of this week's damage never touched a smart contract. Some updates covering hacks, a wind-down, a phishing wave, and more: • Balancer proposed an orderly wind-down: no new business, pausable pools dropped to withdrawals-only on October 30, and at least $9M of treasury distributed to BAL holders who burn their tokens. Snapshot runs September 25 to 29. • Trezor's third-party email provider Brevo was breached and used to send phishing mail from Trezor's own domain. Roughly 347k addresses got it, and 2.5k clicked before the domain came down. Check the sender domain is the advice everyone gives, and this week it would have failed you. • Wyoming pulled its FRNT stablecoin off LayerZero and moved it to Chainlink CCIP, citing a "repeated pattern of major operational security failures," including failure to keep proper control of a private key managing a live FRNT deployment. LayerZero's CEO disputes it, saying the authority involved was view-only metadata. • A Safe on Ethereum lost ~$7.73M in rsETH when an attacker used a public keeper multicall to push its Uniswap V4 LP module into a malicious hooked pool that unwrapped aETHrsETH. An MEV bot then extracted the funds in the same block. • Nomic's transaction-forwarding flaw let an attacker double-spend nBTC, minting 40.65 nBTC with nothing behind it back in June. Nobody noticed for 74 days. • ChainFlip lost ~736k USDT on Tron after an attacker attached their own memo to transactions validators had already signed. • Ether fi lost ~15.45 ETH to a missing access-control check in AtomicQueue. SlowMist disclosed it to the team privately before going public, which is why this one stayed a rounding error. • Yam Finance was drained of about $121K after an attacker self-delegated enough YAM to pass proposal #45 and seize the Timelock. Governance capture is still an underappreciated risk. The Trezor one bothers me the most. Hard to keep telling users to “be more careful” when the phishing emails come from the company they’re supposed to trust.