Web3 Security Weekly Intelligence — October 5–11, 2026

Q1 — Wallets: What happened to wallets this week?

The week's wallet event is the first in this column's coverage where the wallet itself was the attack surface and the owner did everything right. Ledger users who bought from CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines, reported mass thefts on October 9; investigators traced $72M–$94.5M across Bitcoin, Ethereum and Tron, and Ledger confirmed on October 10 that at least one affected device carried an unauthorized hardware implant. The mechanism — documented by Mark Karpelès and SlowMist's 23pds — is a hidden circuit board behind the screen, with an LTE module and a data eSIM, that recognizes the display during setup and reads the recovery phrase as it is generated. Nothing about the device's cryptography was broken, which is why the buyers' precautions did not help: the phrase was compromised the instant the device displayed it. Two structural facts sharpen the lesson: CryptoBilis was sold by its founders in spring 2026 under a confidentiality agreement that barred disclosure until October 19, with the 'Ledger authorized' branding left in place, and researchers have since flagged twenty-plus other Southeast Asian resellers as possible exposure on regional proximity alone — speculation, but a supply-chain model that has no per-reseller attestation to fall back on.

Q2 — Smart Contracts: What happened at the contract layer?

Four contract-layer failures, none in audited core code. 79thVault's 79AU token had a privileged OPERATOR_ROLE function that could move tokens out of its PancakeSwap pool and resync the reserves — held by a single hot wallet with no multisig and no timelock, it was used to pull 2.01M tokens and extract ~$12.5M in about an hour; GoPlus called the effect backdoor-like and left 'leaked key or insider' open, with the contract's source unverified on BscScan. MakerDAO did not break, but a legacy 2020 liquidation keeper did: an unauthenticated function let an attacker take Vat delegation and settle four old zero-bid auctions for 200 ETH. Mezo lost 5.52 BTC to a genuine and elegant bug — a meta-transaction forwarder appends the real sender to calldata, but a call into an external library runs in a fresh stack frame that drops it, so a crafted parameter made the contract read the sender from the last 20 bytes; two individually safe choices, interacting badly. And Second's Ark server validated a boarding against a transaction ID that did not commit to the funding script and signatures against keys the client supplied — so a client could name its own key and register a board, then spend the same coins on-chain and over Lightning. The through-line across all four is the same as last week's: the audited arithmetic held, and the missing check was in who or what the system trusted.

Q3 — DeFi & Bridges: What happened across DeFi and cross-chain?

The cross-chain story this week is not a bridge hack but a laundering race. Most of the Ledger loss was USDT on Tron, and the case turned into a live test of the industry's favourite recovery tool. Tether blacklisted more than twenty linked addresses and froze roughly $10M; within a day the attacker converted USDT into USDD through SUN.io and USDD's peg-stability module — a dollar token whose issuer has no freeze primitive — moving the float out from under Tether's reach, with a further ~430 ETH routed through Tornado Cash on the Ethereum leg. PeckShield then traced roughly $3.89M into Binance deposit addresses on Tron, giving investigators an account-level lead that centralized exchanges, unlike permissionless rails, can act on. That is the week's DeFi lesson in one line: the recovery instruments the industry relies on are issuer- and operator-level controls, and any actor who reads the freeze coming will route around it — to an unfreezable stablecoin if one exists, to a CEX deposit if the lead is followed, to a mixer where the trail ends. On the protocol side the notable outcome was Mezo's own response: it detected the anomaly, self-halted its chain and bridge, and pledged to reimburse from protocol-owned funds — a much smaller event handled cleanly, which is the other half of the cross-chain record.

Q4 — People & OpSec: What does the week say about people and process?

Five process notes. First, the hardware-wallet lesson inverts the usual advice: 'the seed never touches the internet' is a statement about the person, not the device, and it is defeated by anything that reads the display during generation — so source devices directly, verify the reseller, and treat any phrase generated on a borrowed or resold device as burned. Second, dormant privileged infrastructure is live infrastructure: a two-key keeper from 2020 with an unauthenticated function and forgotten collateral is still an exploit, and the fix is maintenance, not migration. Third, 'operator key' is a single point of failure dressed as a permission — 79thVault ran a token's liquidity on one hot wallet with no multisig and no timelock, and the same shape recurs across chains. Fourth, freezing works and it is also a decision by a private company: the ~$10M Tether freeze was a real recovery, and the same-day USDD pivot is the reminder that a freeze protects only the token an issuer controls. Fifth, the legal week put both of the industry's favourite enforcement levers under review — the DOJ sought >$1B in Iran-tied forfeiture and reopened scrutiny of Binance's settlement, while a payments firm sued Tether over a freeze that held for over a year, testing where an issuer's power to switch off an address meets its legal authority to do so.

Q5 — Outlook: What should you watch next week?

Five watch items. First, the Ledger figures: whether the vendor confirms a cause and a device count, whether the twenty-plus other resellers researchers flagged see any confirmed exposure, and whether the Binance-deposit lead produces a freeze beyond the ~$10M already taken. Second, the two enforcement threads — how the DOJ's Binance settlement review resolves, and how the Conduit case on Tether's freeze power is received, since both price the cost of post-settlement compliance and unilateral freeze authority. Third, whether the USDD route becomes standard: if the Tron-based stablecoin absorbs more stolen float, analysts will have to price its censorship resistance as a security fact, not a footnote. Fourth, the carried unclaimed problem — the Base vault's ~$31.7M, still inside a contract no team will claim, now two weeks old. Fifth, Mezo's reimbursements landing and 79thVault's white-hat negotiations over the ~14,394.92 BNB, both small tests of whether a project that gets hit can actually make users whole.