🗡️ The Damage Report 🚨 (Oct 4): A CEX hack, a depeg, a validator exit, two legal fights, and a bridge drain. Here's all the damage from the past week in one post: • Bitget lost ~$351.6M from its hot wallets. It says cold wallets are untouched and the $464M+ User Protection Fund covers users. Withdrawals are paused. • MetaMask is exiting the affected validators in its staking product after a security incident in its infrastructure. It says wallets face no immediate threat. • Abracadabra's MIM fell ~50% below its peg. The protocol is hiking rates on every Cauldron and has paused Curve bribes until the peg comes back. • BlockTower's Ari Paul says Coinbase "lost" $25M of his firm's assets several years ago while covering up repeated hacks, and still hasn't returned it. Coinbase denies hiding any hacks. • KelpDAO is taking LayerZero to court over April's ~$292M rsETH exploit, saying LayerZero signed off on the bridge configuration before blaming Kelp for it. • Payy, a privacy stablecoin payments app, lost ~$1.83M USDC through a forged withdrawal slipped into a verified rollup batch. Verified didn't mean valid Something interesting I noticed is that Ari Paul has been chasing his $25M for years and Kelp is suing over a hack from April. So, if funds this size can't get their money back, you're not getting yours back either. Self custody what you can. \Two of this week's stories end with one party pointing at another Paul at Coinbase, KelpDAO at LayerZero. Both outsourced their security to someone they trusted. As they say, "Not your keys, not your coins."