October 2026 delivered one of the strangest weeks in DeFi security history: the $12.5M 79thVault exploit on October 7, followed just two days later by the attacker's return of roughly $11M — about 92% of the haul. Add in NEAR Intents' full $3.8M recovery and major updates on the Drift, Kelp DAO, and Bitget cases, and it was a week of exploits and, unusually, comebacks.
Key Takeaways
- 79thVault was drained of ~$12.5M on October 7, 2026: a wallet holding the OPERATOR_ROLE over the 79AU token made seven privileged calls between 07:25 and 08:19 UTC on BNB Chain, pulling 2.01M 79AU from the 79AU/USDT PancakeSwap pool; USDT reserves fell from $15.2M to $3.9M. CertiK and GoPlus flagged a suspected private-key compromise or insider job — not a code bug — and noted the absence of multisig or timelock controls.
- In a rare twist, the 79thVault attacker returned 15,000 BNB (~$11M, ~92%) on October 9 to a project-designated wallet, according to PeckShield; 79thVault plans pool restoration and an LP token burn.
- NEAR Intents recovered the full $3.8M from its October 1 exploit: GM Alex Shevchenko publicly identified the exploiter with an October 4 deadline, and the attacker returned 34.69 BTC plus ~$850K by October 2.
- In an October 1 update, the April 1 Drift Protocol hack (~$295M) was attributed by Mandiant and TRM Labs to North Korea's UNC6862; ~$9.2M was frozen in transit, all recoveries flow to the DFX recovery pool, Tether committed a $127.5M recovery fund, Drift rebranded as Velocity DEX, and Solana DeFi TVL is back above $6.5B (+38% in two months).
- Kelp DAO's rsETH was fully restored around October 7, with the final 20,373.7 rsETH sent to the LayerZero contract — completing recovery from the April 18 $293M exploit by the Lazarus Group's TraderTraitor unit via a 1-of-1 DVN bridge misconfiguration. Meanwhile, Bitget's September 24 $388M exchange hack was attributed to North Korean actors as "very likely" per Bitget and Elliptic, confirmed by Chainalysis in early October, with CEO Gracy Chen "not very optimistic" about recovery.
79thVault: $12.5M Out, $11M Back
How the Exploit Happened
The 79thVault attack, on October 7, was not the classic smart-contract bug. According to security firms CertiK and GoPlus, a wallet holding the OPERATOR_ROLE over the 79AU token executed seven privileged calls between 07:25 and 08:19 UTC on BNB Chain, pulling 2.01M 79AU out of the 79AU/USDT PancakeSwap pool. The pool's USDT reserves collapsed from $15.2M to $3.9M — roughly $12.5M gone in under an hour.
The diagnosis was damning in a different way than usual: this looks like a suspected private-key compromise or an insider, not a code vulnerability. The project had no multisig and no timelock on its privileged roles — a single compromised key was enough to drain the pool.
The Rare Return
Then October 9 brought the week's strangest plot twist. The attacker returned 15,000 BNB — roughly $11M, about 92% of the stolen value — to a project-designated wallet, a transfer flagged by PeckShield. Attackers returning funds is rare, and a 92% return is rarer still; it usually follows negotiation, identification pressure, or both. 79thVault says it plans to restore the pool and burn LP tokens as part of its recovery plan.
NEAR Intents' Full Recovery
NEAR Intents pulled off the week's cleanest recovery. After its October 1 exploit, general manager Alex Shevchenko publicly identified the exploiter and set an October 4 deadline. The pressure worked: by October 2, the attacker had returned 34.69 BTC plus approximately $850K — the full $3.8M. Two full recoveries in one week is almost unheard of in DeFi, and the NEAR Intents case is already being held up as a playbook: identify fast, set a public deadline, and give the exploiter a face-saving path to return the funds.
Older Hacks, New Chapters: Drift, Kelp DAO, and Bitget
October also brought closure — or at least clarity — on three of the year's biggest cases.
Drift becomes Velocity DEX. In an October 1 update, investigators at Mandiant and TRM Labs attributed the April 1 Drift Protocol hack (~$295M) to UNC6862, a North Korean threat actor. About $9.2M was frozen in transit, all recoveries are flowing into the DFX recovery pool, and Tether committed a $127.5M recovery fund. Drift has rebranded as Velocity DEX, and Solana DeFi TVL is back above $6.5B — up 38% in two months — suggesting the ecosystem is moving on.
Kelp DAO closes the book. Around October 7, the final 20,373.7 rsETH was sent to the LayerZero contract, fully restoring Kelp DAO's rsETH after the April 18 $293M exploit — an attack by the Lazarus Group's TraderTraitor unit that exploited a 1-of-1 DVN bridge misconfiguration. Full restoration of a nine-figure exploit is a genuine milestone for DeFi resilience.
Bitget's grim outlook. The September 24 Bitget hack ($388M, revised up from $351.6M) came from a zero-day in third-party security products — not compromised private keys or cold wallets — hitting 12 hot and warm wallets. Attribution to North Korean actors is "very likely" according to Bitget and Elliptic, and Chainalysis confirmed the link in early October. The exchange saw ~$463M in net outflows on September 29 and rebuilt its protection fund to ~$309M by October 2–4, but CEO Gracy Chen said she is "not very optimistic" about recovering the stolen funds.
What This Week Teaches DeFi Users
The DeFi hacks of October 2026 tell two stories at once. The 79thVault case is a warning about operational security: no audit saves you if a single key controls everything — multisig and timelocks are non-negotiable. But the week's recoveries also show the ecosystem maturing: fast attribution, public deadlines, and coordinated freezing (as in the Drift case) are turning some would-be total losses into comebacks. For users, the lesson is evergreen: diversify across protocols, watch how a project handles its keys, and treat unaudited operator roles as the red flag they are.
Frequently Asked Questions
How was 79thVault hacked on October 7?
A wallet with the OPERATOR_ROLE over the 79AU token made seven privileged calls between 07:25 and 08:19 UTC on BNB Chain, draining 2.01M 79AU from the 79AU/USDT PancakeSwap pool (~$12.5M). CertiK and GoPlus assess it as a suspected private-key compromise or insider action — not a smart-contract bug — enabled by the lack of multisig or timelock controls.
Did the 79thVault attacker return the funds?
Yes — remarkably, on October 9 the attacker returned 15,000 BNB (~$11M, ~92% of the stolen value) to a project-designated wallet, according to PeckShield. 79thVault plans pool restoration and an LP token burn.
How did NEAR Intents recover the full $3.8M?
After the October 1 exploit, GM Alex Shevchenko publicly identified the exploiter and set an October 4 deadline. The attacker returned 34.69 BTC plus ~$850K by October 2 — the complete amount.
Who was behind the Drift Protocol hack?
In an October 1 update, Mandiant and TRM Labs attributed the April 1 ~$295M Drift Protocol hack to UNC6862, a North Korean threat actor. About $9.2M was frozen in transit, Tether committed a $127.5M recovery fund, and Drift has rebranded as Velocity DEX.
