September 2026 closed as the most expensive month of the year for crypto security. Crypto security firm CertiK put the total at roughly 766.4 million USD in exploit and phishing losses, the highest monthly figure and the highest incident count it had recorded in 2026. Counterparty risk is the thread running through most of that number, and it is worth being precise about what the term covers before drawing a lesson from the month.
What counterparty risk means when you hold crypto
Counterparty risk is the chance that the other party in an arrangement fails to do what you are relying on them to do. In traditional finance it describes a bank that cannot return your deposit or a trading partner that cannot settle. Applied to crypto, it has a narrower and sharper meaning: when your coins sit on an exchange, you do not hold them. You hold a database entry saying the exchange owes you, and that entry is worth exactly as much as the company's ability to honour it.
Nothing about that arrangement is unusual or sinister, and most of the time it works fine. The problem is that the failure mode is not gradual. An exchange that gets compromised on a Tuesday can suspend withdrawals on the same afternoon, and the people affected find out at the same moment as everyone else.
The September numbers, and where each failure sat
Three incidents carried most of the month, and they failed in three different places.
The largest was Bitget. The exchange confirmed a loss of 351.6 million USD, with CEO Gracy Chen describing the mechanism as spoofed internal transfers following a backend compromise rather than stolen private keys. That distinction matters and tends to get lost. The cryptography held; the company's internal systems were the thing that gave way, and customer withdrawals froze while it was sorted out.
Second was Blockstream's Liquid Network, where around 320 million USD in bitcoin left the federation wallet in early September, roughly 4,000 of the 4,200 BTC held. The withdrawal came from a wallet controlled by a group of functionaries rather than by the people whose bitcoin it was, which is counterparty risk wearing a decentralised-sounding name.
Third, and smallest in dollars, was the one that should worry self-custody holders most. An attack on the D'CENT App Wallet, built by Korean manufacturer IoTrust, drained about 12.4 million XRP from 6,678 wallets across six separate waves between the middle and end of the month. The company's hardware devices were not the point of entry. The app was, and a number of the drained wallets belonged to people who had typed a hardware wallet's recovery words into software at some point and left them there.
What self-custody removes
Holding your own keys deletes the first two categories outright. There is no company balance sheet between you and your coins, no withdrawal queue to join, and no announcement to wait for. Bitget's backend and Liquid's federation are both arrangements you can decline to participate in, and declining costs you nothing except the convenience of someone else running the infrastructure.
What it does not do is reduce your total surface to zero. It moves the surface, and the D'CENT incident is the clearest illustration of the month: those holders had already taken the self-custody step and still lost money, because the responsibility that came with the keys landed on software they had trusted with their recovery words.
The four things you now own
Once you hold your own keys, four surfaces become yours to defend, and they are worth naming separately because people tend to secure the first and forget the rest.
- The keys themselves. Where they are generated, whether they ever touch an internet-connected machine, and what chip they live inside.
- The recovery method. What restores the wallet if the device is lost, and how many objects have to survive for that to work.
- The software. Every app you connect, every wallet you import into, and every piece of code that has ever seen your words.
- The interactions. What you sign, what you approve, and whether you can read the destination before you confirm it.
September hit the third of those hard. The attackers behind the D'CENT drain reused keys they had already obtained, which is the signature of a software compromise rather than a cryptographic one, and the stolen funds were swapped across chains quickly and routed toward off-ramps while the incident was still being investigated.
What our recovery system does about the second surface
The backup question is the one most people answer badly, and the standard advice does not help much. Write twelve or twenty-four words on paper and the words become a single object that has to survive fire, flood, moving house, and every person who might come across it. Stamping them into steel is a sensible upgrade from paper, since metal survives a house fire, and the shape of the problem is untouched: your entire wallet still depends on one item staying both intact and secret for as long as you hold crypto.
We built TapSafe Recovery to remove that concentration. Recovery is divided into shares using a Shamir's Secret Sharing implementation we wrote: your Recovery Tag holds half, your paired phone holds the other half encrypted into your own iCloud or Google Drive rather than sitting on the handset itself, and optional Recovery Contacts hold a quarter each while learning nothing about your holdings. No single component opens the wallet alone, so losing any one piece is an errand rather than a disaster. Your seed phrase stays available on the device as a last resort and follows the BIP-39 standard, which means you keep the option of leaving for other hardware whenever you want.
One caution that follows directly from September: a recovery phrase you have typed into a software wallet is no longer protected by the device it came from. If you have done that, treat those words as compromised and move the funds to a wallet whose keys have never left hardware.
Where this leaves the two risks
Keeping coins on an exchange means accepting that a company's internal systems stand between you and your money, and September priced that acceptance at well over half a billion dollars across two platforms. Holding your own keys closes that gap and opens a smaller one you control directly, which is a trade most people should take, provided they treat the second half of it with the same care they gave the first and secure their backup and their software as deliberately as they chose their device.
Our hardware is built for exactly that division of labour. The Ryder One generates keys inside an EAL6+ certified Infineon SLC38 secure element and they never leave the chip. It speaks NFC only, with no Bluetooth radio, no Wi-Fi and no data over a cable, so the only way to interact with it is a deliberate tap. Every transaction renders in readable detail on the 1.6-inch AMOLED screen before you confirm, the signing button is wired directly to the secure element so no software path can approve anything on its own, and the firmware was independently audited by Halborn with the report published in full. It is 149 USD for the Starter Combo and 179 USD for the Super Safe Combo.
Owning your keys is the first decision, and protecting them properly is the one that keeps paying off for as long as you hold anything worth protecting. Get your Ryder One.
Share: