Web3 Security Weekly News Review — October 5–11, 2026
This week's review covers October 5 – 11, 2026: 12 publicly reported items, six of them loss events inside the window — together roughly $99.6M, dominated by the largest hardware-wallet compromise this column has recorded and the first week since late September to approach nine figures.
The week's defining fact is where the money entered the crime. Nothing broke the cryptography, the firmware, or the secure element of the wallets that were drained: the seed phrases were read off the display during setup, by hardware implanted before the devices reached their buyers.
A supply-chain drain of Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines. On October 9, on-chain investigators traced inflows from hundreds of victim wallets on Bitcoin, Ethereum and Tron, with estimates running from about $72M to $94.5M — roughly $86M at the most-cited count. Ledger confirmed on October 10 that at least one affected device contained an unauthorized hardware implant that could read the recovery phrase off the screen and transmit it by cellular data; the secure element itself was never broken. The wallets' owners had done the one thing self-custody asks — kept the phrase offline and signed nothing suspicious — and it did not matter, because the phrase was captured the moment the device generated it. Roughly $10M of the stolen USDT was frozen by Tether, and the attacker converted a further tranche into USDD, a stablecoin with no issuer-level freeze switch, through SUN.io on Tron.
- Realized losses~$99.6M6 in-window events; ~9.7x last week
- Largest event~$86MLedger/CryptoBilis supply-chain drain, Oct 9
- Second-largest~$12.5M79thVault operator-role key, Oct 7
- Issuer freeze~$10MTether, on addresses tied to the Ledger cluster
Overview
The week broke the self-custody promise at its earliest link. Hundreds of Ledger users lost funds from wallets whose recovery phrases they had generated offline and never entered anywhere online — because the devices themselves had been altered before purchase. On October 9, on-chain investigators published tens of theft addresses and estimates from about $72M to $94.5M across Bitcoin, Ethereum and Tron; the common thread was the Southeast Asian reseller CryptoBilis. Ledger asked the reseller to stop all sales and shipments, told recent buyers not to set up their devices, and on October 10 confirmed that at least one affected unit carried an unauthorized hardware implant. Former Mt. Gox chief Mark Karpelès posted photos of one he said he had bought with the shrink wrap intact: a second circuit board hidden behind the screen's padding, an antenna on a single wire, and an LTE module with a data eSIM — enough to read the 24 words as they appeared during setup and send them out as text. The cryptography held. The distribution channel did not.
The money trail is the second half of the story and the part worth studying for anyone who tracks stolen stablecoins. Most of the loss was USDT on Tron — the chain where a stablecoin transfer is cheapest and where an issuer's kill switch is most effective. Tether blacklisted more than twenty addresses and froze roughly $10M across the cluster, and the attacker answered by converting USDT into USDD through SUN.io and USDD's peg-stability module, moving the float onto a dollar token with no freeze primitive at all. PeckShield then traced roughly $3.89M of the haul — 3.685M USDT plus 615,000 TRX — into Binance deposit addresses on Tron, the first hop that gives investigators an account to ask about. Every freeze this week produced an adaptation within hours, which is the most useful thing the incident taught about the control the industry relies on.
Away from the headline, the week ran a small sampler of every other failure class. 79thVault, a BNB Chain project, lost about $12.5M when a wallet holding the token's OPERATOR_ROLE moved 2.01M 79AU out of its PancakeSwap pool and sold it back — a single hot key with no multisig and no timelock, which GoPlus described as backdoor-like and left open whether it was a leak or an insider. Mezo lost 5.52 BTC when a meta-transaction library split let an attacker impersonate the sender of a transfer. A dormant MakerDAO liquidation keeper from 2020 gave up 200 ETH to an unauthenticated function. Second, an Ark implementation for Bitcoin, leaked 0.75 BTC of its own liquidity when its boarding flow trusted a key the client supplied. And on the enforcement side, the Department of Justice sought forfeiture of more than $1B in crypto tied to Iran, sued nobody but reviewed Binance's settlement compliance — while a payments firm sued Tether over a two-year-old freeze. The week's through-line is uncomfortable and consistent: the controls everyone cites as the last line — the multisig, the hardware wallet, the issuer freeze, the operator role — each failed or was routed around, and in every case the failure was in a person, a process or a channel, not in the code that was audited.
The 12 Stories
A tampered-reseller drain empties hundreds of Ledger wallets of roughly $86M — the seed phrases were read off the screens
Ledger users who had bought devices from CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines, began reporting mass thefts on October 9; on-chain investigator Specter published ten theft addresses and put suspected losses above $86M, spread across Bitcoin, Ethereum and Tron. Two other analysts gave different scopes — tanuki42 tied more than $72M to eight addresses, MistTrack put the total near $90M, Arkham grouped 152 addresses under a 'ledger-drainer' label holding about $71.6M, and later reporting cited a total between $86M and $94.5M. Ledger has not confirmed a cause or a count. What it did confirm, on October 10, is that at least one affected device contained an unauthorized hardware implant. The mechanism, per Karpelès and SlowMist's 23pds: a small circuit board hidden behind the screen, with an LTE module and a data eSIM, that recognizes the display during setup, reads the 24-word recovery phrase as it is generated, and transmits it — the secure element and the firmware were never broken, and Ledger's Genuine Check does not detect a physical modification as long as the original chip is intact. CryptoBilis, it later emerged, was sold by its founders in spring 2026 under a confidentiality agreement that barred disclosure until October 19, while the store kept its 'Ledger authorized' branding. Most of the loss was USDT on Tron; by October 11 the majority of the stolen USDT sat on Tron, the attacker had swapped a large tranche into USDD to escape Tether's reach, and PeckShield had traced about $3.89M into Binance deposit addresses on Tron.
Source: Specter, tanuki42, MistTrack and Arkham on-chain tracing (Oct 9–11); Ledger support statement and CryptoBilis sales pause (Oct 9–10); Mark Karpelès hardware findings and SlowMist's 23pds analysis; PeckShield Binance-deposit tracing (Oct 11); CoinDesk, Crypto Briefing, ForkLog and PANews coverage
79thVault loses ~$12.5M as a single operator key drains its 79AU pool — leaked key or insider, still unresolved
Between roughly 07:25 and 08:19 UTC on October 7, a hot wallet holding the OPERATOR_ROLE on 79thVault's 79AU token made seven calls to a privileged function that moves 79AU out of a chosen address and forces the pool to resync. The calls pulled 2.01M 79AU out of the PancakeSwap 79AU/USDT pair to one address in tranches of 10,000, 100,000, 100,000, 300,000, 500,000, 500,000 and 500,000 tokens; that address sold the tokens back into the same pair across roughly 95 swaps, cutting the pool's USDT reserves from about $15.2M to about $3.9M. The proceeds became 16,249 BNB — roughly $12.5M at the ~$769.50 print — consolidated at a single address; 41 seconds after the last transfer the operator wallet sent it a further 3.79 BNB of its own. GoPlus Security reviewed the case and left two explanations open: a leaked operator key, or insider action — the operator role sat on one hot wallet with no multisig and no timelock, the contract's source is unverified on BscScan, and an on-chain message offering a 10% bounty came from the same privileged address used in the drain, which GoPlus called unusual and of unconfirmed authenticity. About 14,394.92 BNB (~$11.03M, ~89% of the haul) remained at a consolidation address as of the latest review; PeckShield flagged a 30 BNB deposit to KuCoin, which has not said whether it froze the funds. The role was revoked after the fact; the project's public notice described a 'system upgrade.' Close to 10,000 holders are affected.
Source: GoPlus Security analysis (Oct 8); Defimon Alerts and CertiK monitoring; The Crypto Times and ForkLog coverage; SlowMist hacked-database entry (Oct 7, $12.5M); on-chain reads (16,249 BNB; 14,394.92 BNB unmoved)
Mezo loses 5.52 BTC to a meta-transaction trick — then halts its own chain and pledges to make every holder whole
On October 5, an attacker moved 37 veBTC positions out of 36 holders' wallets on Mezo, the Bitcoin-backed credit chain, and bridged the proceeds off-chain; Mezo's own incident report counts approximately 5.52 BTC taken, converted to 174.61 ETH on a DEX at 19:15 UTC. The flaw sat where two safe design choices met: veBTC's VotingEscrow is split across external Solidity libraries (to fit the EVM size limit) and supports meta-transactions through a trusted forwarder. The meta-transaction standard identifies the real sender by appending the verified address to the end of the calldata, but a call into an external library runs in a fresh stack frame built only from the function's declared parameters — the appended sender is not one of them, so it is dropped. A crafted _data parameter for safeTransferFrom made the contract read the last 20 bytes of calldata as the sender, letting the attacker take over any veBTC position; he specifically targeted unlocked-but-unredeemed positions so the BTC could be redeemed and bridged out. Mezo caught the anomaly on October 6, declared an incident at 09:04 UTC, paused bridge withdrawals at 09:17, located the bug at 09:21, halted all chain transactions at 09:27, engaged SEAL 911 at 10:00 and shipped the fix by 15:00. A review found three further functions with more constrained access-control exposure, all covered by the same patch. The project says all affected users will be made whole from protocol-owned sources and warns users not to follow any link promising recovery.
Source: Mezo incident report (Oct 5, 2026); Outposts summary; SEAL 911 engagement; Mezo blog notice (Oct 7)
A dormant 2020 MakerDAO liquidation keeper gives up 200 ETH to an unauthenticated function
At 06:13:11 UTC on October 6, an attacker drained 200 ETH ($542,982 at the time) of ETH-A collateral from a legacy auction-keeper contract on Ethereum mainnet. The 200 ETH came from four 50-ETH lots that the keeper had won with zero bids during MakerDAO's 'Black Thursday' liquidations in March 2020 and never settled — the collateral had been sitting in the Flipper ever since. An unauthenticated function on the keeper let the attacker grant a contract it controlled full delegation over the keeper's MakerDAO Vat account; in a single transaction the attack contract obtained that delegation, settled auctions 1457–1460, and moved the collateral out to the attacker's address. CertiK's reconstruction shows the attacker funded itself with 0.1 ETH from a Tornado Cash pool and, after the exploit, split the proceeds into nine 10-ETH deposits back into the Tornado Cash router. SlowMist pegs the same loss at $538,000. The vulnerable keepers and their proxy are third-party infrastructure, not MakerDAO core: the bug was in a liquidation bot that a team had left running, unmaintained, since 2020.
Source: CertiK incident analysis (Oct 6); SlowMist hacked-database entry (Oct 6, $538,000); on-chain transaction hashes and addresses as published by CertiK
Second's Ark server loses 0.75 BTC of its own liquidity to a boarding-flow check that trusted the client's key
Second, the company behind Bark, an implementation of the Ark protocol for Bitcoin, disclosed on October 8 that on October 5 an attacker exploited a bug in its Ark server's boarding flow and took 0.75 BTC — about $62K — of Second's own liquidity. No user funds were affected. The company caught the attack within hours, briefly took the server offline and shipped a fix, and said the attacker kept probing through October 6, degrading Lightning receives. The fix, committed to Bark's open repository on October 7, spells out the hole: the server checked a board against a transaction ID that did not commit to the funding output's script, and validated signatures against keys supplied by the client — so a client could list its own key in place of the server's, sign alone, and get the board registered. The attacker then pulled those coins back to his own wallet on-chain while also spending the same coins out of Second's node over Lightning. The fix now requires the funding output to match a key shared by user and server. Second says the coins used in the attack were linked to the September 19 theft at Blink; no tagged Bark release carries the fix yet at reporting time, and user exits were held during the outage.
Source: Second X thread (Oct 8); Bark repository commit (Oct 7); Mempolitics analysis; SlowMist hacked-database entry (Oct 6, MakerDAO; used here for cross-registry context only)
Set Protocol leaks ~$14K to a share-rounding bug amplified by Uniswap v4's flash accounting
A much smaller contract bug closed the week's DeFi set. On October 6, an attacker exploited Set Protocol's actualizeFee() function: even with no minting fee to charge, the function rounded unitShares up — from 4,927 to 4,928 — and the attacker minted shares before the update, then redeemed the same quantity after it, withdrawing more collateral than they had supplied. Uniswap v4's flash accounting supplied the temporary liquidity that amplified the discrepancy. SlowMist's database logs the loss at $13,700; DefiLlama's log entries the same Set Protocol incident at $21.9K, and a separate October 7 rounding incident on Locus Finance (Arbitrum) at $18.0K. The amounts are trivial; the mechanism is not new — it belongs to the growing class of share-accounting and rounding bugs that Uniswap v4's shared-accounting model keeps surfacing, the same category as GoldPesa's $115K hook loss the week before.
Source: SlowMist hacked-database entry (Oct 6, $13,700); DefiLlama incident feed (Set Protocol $21.9K; Locus Finance $18.0K, Oct 7)
Bookmark phishing hijacks a logged-in Fomo session — stealing the credential, not the chain
SlowMist's Yu Chui flagged a bookmark-phishing campaign against the Fomo web platform on October 8, after a user reported losing about $48,000 while viewing the MOONLET token. The path: the victim followed a link to a site posing as a project, a fake 'human verification' step told them to drag an icon into the browser's bookmark bar and click it three times, and what looked like a CAPTCHA installed a JavaScript bookmarklet that ran inside the already-authenticated Fomo page. SlowMist's script analysis found the bookmarklet collected Privy access and refresh tokens alongside browser-storage and wallet-related data from localStorage and IndexedDB, then posted the bundle to attacker-controlled infrastructure. No seed phrase and no on-chain approval were required — the stolen session and its locally stored credentials were enough to authorize access to the account's assets. MistTrack traced the funds through USDC-to-SOL conversions, address splitting, cross-chain transfers and deposits into privacy and gambling services, including 1,568.33 SOL into the Privacy Cash pool. SlowMist is explicit that the technique attacks the authenticated browser session, not the blockchain or the embedded-wallet provider, and that the traced wallet activity is broader than the one confirmed victim.
Source: SlowMist investigation and X thread (Oct 8); The Chain Observer analysis; MistTrack tracing (Privacy Cash, Stake, Winna); KuCoin flash summary
The DOJ moves to forfeit more than $1B in crypto tied to Iran, including 127,271 BTC
The Department of Justice filed forfeiture complaints targeting more than $1B in cryptocurrency allegedly tied to the Iranian government. The Bitcoin filing covers approximately 127,271 BTC — about 38.8% of the roughly 328,372 BTC the government reports holding — and a separate complaint covers approximately 442,534 USDT, citing 18 U.S.C. § 981(a)(1)(C); the USDT had been seized by the FBI on or about June 4, 2026, valued then at about $442,505.68, and moved to a wallet under US control. That USDT complaint is dated October 9, and the following day a notice was filed in the Eastern District of New York in the Bitcoin case. The filings put amounts and a statutory basis on paper behind a seizure campaign Treasury Secretary Scott Bessent had described publicly, having said in April that the US had seized 'nearly $500 million' of Iranian crypto assets and by late May about $1B, against an assessed $400–500M per month of sanctions evasion by Iran. Bessent has framed the seizures as part of a pressure campaign and outlined the administration's stated intent to add seized bitcoin to a US digital asset reserve once damages are resolved.
Source: DOJ forfeiture complaints (USDT complaint dated Oct 9, 2026; Bitcoin notice E.D.N.Y. Oct 10); CoinScoop and aggregated reporting; Treasury Secretary Bessent remarks (Apr–May 2026)
A payments firm sues Tether over a $2.76M USDT freeze that has held for over a year
Conduit Technology Inc., a cross-border payments firm, sued four Tether entities in the Southern District of New York on October 5, alleging Tether blacklisted its corporate treasury wallet on September 24, 2025 and has kept roughly $2.76M in USDT locked for more than a year with no court order and no compliance link to Conduit itself. Conduit describes the frozen wallet as the equivalent of its operating bank account, says it owes Tether nothing, and seeks the funds back plus at least $2.76M in damages, punitive damages and a share of the profits Tether kept on the reserves backing the frozen tokens. The freeze traces to a Brazilian Federal Police investigation into Onix Intermediações, a former Conduit customer; the complaint says Onix last used Conduit in April 2025, roughly a month before the treasury wallet was created, that the wallet never held Onix funds, that Brazilian authorities never flagged it, and that a Brazilian court confirmed Conduit was not under investigation. Tether had not publicly responded as of early October. It is the second USDT-freeze suit filed in the same court in five weeks, after two Thai businessmen sued over about $42.4M frozen across ten Ethereum addresses.
Source: Conduit Technology complaint, SDNY (Oct 5, 2026, via The Block and OffshoreAlert); Crypto.news and Cryptopolitan coverage; T3 Financial Crime Unit program figures as reported
The DOJ reviews whether Binance kept its 2023 settlement — with an Iran-sanctions focus and a parallel $61M forfeiture
The DOJ is reviewing whether Binance Holdings complied with its November 2023 settlement, reported October 9–10 and confirmed by Tysen Duva, head of the Criminal Division, to Bloomberg. The review, run by the US Attorney's Office in Manhattan with the Criminal Division, focuses on whether Binance processed transactions with potential links to Iran that its systems should have blocked. It follows a Wall Street Journal report that accounts tied to Iranian financier Babak Zanjani moved close to $850M through the exchange via a network of 21 trading accounts and shell companies; an internal Binance document said at least $67M flowed from two of those accounts to wallets linked to the Revolutionary Guard. Separately, federal prosecutors filed a civil forfeiture complaint seeking roughly $61M in cryptocurrency alleged to be Iranian oil-sale proceeds routed through Binance accounts tied to two Hong Kong entities, Blessed Trust and Hexa Whale. No charges have been announced against Binance, and it is not a named defendant in the forfeiture; the exchange says it maintains a zero-tolerance sanctions policy, identifies and offboards flagged accounts, and had paid over $4.3B and accepted a monitor under the 2023 plea. The review's outcome could range from tighter monitoring to fresh penalties.
Source: Bloomberg reporting via Wu Blockchain and CoinCentral (Oct 9); CoinDesk and Trading Dashboard summaries (Oct 9–10); WSJ report on the Zanjani network; DOJ Civil Division forfeiture complaint (Sept 2026, ~$61M)
Coldcard's own X account posts a phishing link — a reminder that the vendor's channel is part of the attack surface
Coldcard, the Bitcoin hardware-wallet maker, said a phishing link appeared on its official X account on October 11 and that it had begun an internal review and asked the platform to investigate. The firm said it found no unauthorized logins to its own systems and advised users not to interact with suspicious links. The event carried no disclosed loss and, on its own, is minor — but it lands in a week defined by hardware-wallet channel compromise, and on a product whose marketing leans on offline, tamper-resistant signing. A vendor's social account is a distribution channel too: followers treat its links as trusted, which is exactly the assumption a compromised or spoofed account monetizes.
Source: Coldcard statement (Oct 11, 2026); Pickaxe industry roundup; vendor advisory to users
Ethereum researchers warn on migration risk as quantum talk turns to 'months, not years' — and Tron ships post-quantum code to testnet
Ethereum Foundation researcher Justin Drake suggested on October 7 that the ECDSA signature algorithm could prove breakable — meaning fast private-key recovery from a public key — before large quantum computers arrive, citing rapid progress in AI applied to mathematics, and put the worst case at 'months, not years.' His advice to large holders was to move funds gradually to addresses that have never sent a transaction; Vitalik Buterin cautioned against rushing, saying he had 'lost more money from bad migrations than from all hacks combined.' Glassnode co-founder Rafael Schultze-Kraft quantified the exposure: about 6.26M BTC, 31.2% of supply, sits at addresses whose public keys are already revealed — 4.33M BTC through address reuse and 1.94M through address format, the latter including roughly 1.1M BTC attributed to Satoshi Nakamoto. Separately, in an October 10 post, Justin Sun announced that Tron's post-quantum cryptography features are live on the Nile testnet with end-to-end signature support for schemes such as FN-DSA-512, with a mainnet move contingent on testing and governance. Nothing here is a confirmed vulnerability; both are pre-emptive, and both carry the risk Drake and Buterin each named — a hurried migration can lose more than the threat it averts.
Source: Justin Drake posts and Vitalik Buterin response (Oct 7); Glassnode analysis (Schultze-Kraft); Justin Sun on Tron Nile testnet post-quantum features (Oct 10); ForkLog week-in-review
Key Signals
| Signal | Reading |
|---|---|
| In-window losses | ~$99.6M across 6 events, ~9.7x last week's ~$10.2M — the first near-nine-figure week since the Bitget breach |
| Largest event | ~$86M — the Ledger/CryptoBilis supply-chain drain (Oct 9), about 86% of the week on its own |
| Attack surface | The channel, not the code: a reseller's tampered devices, a single operator hot key, an abandoned keeper, a client-supplied key |
| Freeze vs. evasion | Tether froze ~$10M of the Ledger cluster; the attacker moved more into USDD, which has no freeze switch at all |
| Enforcement | DOJ sought forfeiture of >$1B Iran-tied crypto; a payments firm sued Tether over a $2.76M freeze — no loss events, both landmark |
TRON Footprint
| Item | On-chain footprint | Status |
|---|---|---|
| Ledger drain (USDT leg) | The bulk of the ~$86M landed as USDT on Tron — the cheapest chain to move it and the one where Tether's freeze is strongest; ~$10M frozen across the cluster | Confirmed |
| USDD evasion | Attacker swapped USDT for USDD on Tron, moving the stablecoin float onto a dollar token whose issuer has no freeze control | Confirmed |
| Binance deposit trail | PeckShield traced ~$3.89M (3.685M USDT + 615,000 TRX) into Binance deposit addresses on Tron, over a two-day window | Confirmed |
| TRX in the haul | 615,000 TRX among the traced flows; TRC-20 USDT remains the single largest stolen asset by chain in the case | Standing |
For Tron energy users the week's lessons are specific. First, the Ledger case shows what TRON's low transfer cost buys an attacker as well as a user: the stolen float concentrated on Tron precisely because moving USDT there is cheap and deep, which also made it the chain where Tether could act — and where the attacker then reached for USDD to get out from under that reach. Anyone holding USDT on Tron should understand that the freeze that protects the network is a switch held by a company, and the week showed both its strength (~$10M recovered off a single incident's addresses) and its limit (a same-day pivot to an unfreezable dollar token). Second, the operator-key and access-control failures that dominated the non-Ledger losses — 79thVault's single OPERATOR_ROLE, MakerDAO's unauthenticated keeper function — are chain-agnostic patterns any TRON-native treasury or token issuer should price before assuming lower fees mean a smaller target. Third, none of this week's six losses involved a TRON protocol; the chain's exposure was as the settlement layer of choice, not the point of failure.
What I'm Watching Next Week
- Whether the Ledger figures settle — Ledger's own device count and cause confirmation, and whether any traced funds beyond the ~$10M frozen are recovered through the Binance deposits.
- Whether Binance acts on the flagged Ledger deposit addresses, and how the DOJ's Binance settlement review resolves.
- The unclaimed Base vault from two weeks ago: the ~$31.7M is still inside and still governed by the same anonymous Safe.
- Bitget's promised full incident report and the first recovered-funds figure from its 5%/5% bounty, against ~$343M still dormant.
- Mezo's reimbursements landing, and 79thVault's asset-tracing and white-hat negotiations over the ~14,394.92 BNB.
- Whether the multi-reseller theory holds — researchers have flagged twenty-plus other Southeast Asian resellers as possible supply-chain exposure, with no evidence yet.
Sources
- Specter, tanuki42, MistTrack and Arkham on-chain tracing on the Ledger/CryptoBilis drain (Oct 9–11); Ledger support statement and CryptoBilis sales pause; Mark Karpelès hardware findings; SlowMist's 23pds on the implant vector; PeckShield Binance-deposit tracing (Oct 11); CoinDesk, Crypto Briefing, ForkLog, PANews and Wu Blockchain.
- GoPlus Security analysis of the 79thVault drain (Oct 8); Defimon Alerts and CertiK monitoring; The Crypto Times and ForkLog; SlowMist hacked-database entry (Oct 7, $12.5M); on-chain reads (16,249 BNB; 14,394.92 BNB unmoved; 30 BNB to KuCoin).
- Mezo incident report (Oct 5) and blog notice (Oct 7); Outposts summary; SEAL 911 engagement.
- CertiK MakerDAO legacy auction-keeper analysis (Oct 6); SlowMist hacked-database entry (Oct 6, $538,000); on-chain transaction hashes.
- Second X thread (Oct 8); Bark repository commit (Oct 7); Mempolitics analysis (0.75 BTC; Blink link).
- SlowMist hacked-database entry (Oct 6, Set Protocol $13,700); DefiLlama incident feed (Set Protocol $21.9K; Locus Finance $18.0K, Oct 7).
- SlowMist investigation and X thread on the Fomo bookmark phishing (Oct 8); The Chain Observer; MistTrack tracing (Privacy Cash, Stake, Winna); KuCoin flash.
- DOJ forfeiture complaints (USDT complaint dated Oct 9; E.D.N.Y. notice filed Oct 10); CoinScoop and aggregated coverage; Bessent's seizure-campaign remarks.
- Conduit Technology complaint, SDNY (Oct 5, via The Block and OffshoreAlert); Crypto.news and Cryptopolitan coverage.
- Bloomberg via Wu Blockchain and CoinCentral on the DOJ/Binance review (Oct 9); Trading Dashboard and CoinDesk summaries; WSJ on the Zanjani network; ~$61M forfeiture complaint.
- Coldcard statement (Oct 11); Pickaxe industry roundup.
- Justin Drake posts and Vitalik Buterin response (Oct 7); Glassnode exposure analysis (Schultze-Kraft); Justin Sun on Tron's Nile testnet post-quantum deployment (Oct 10); ForkLog week-in-review.
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
How can a hardware wallet be compromised if the seed phrase was never entered online?
Because the device that generated the phrase was altered before it reached the buyer. Investigators describe a hidden circuit board with cellular hardware that reads the 24-word phrase off the display as it is shown during setup and transmits it — so the phrase is compromised the moment it exists, without any firmware or secure-element break. The one action that protects against this is generating the phrase on a device you sourced directly and verified yourself; a phrase exposed this way should be considered burned, and assets moved to a wallet created on a clean device with a new phrase.
Why is the Ledger figure a range and not one number?
Because no single source has reconciled them. Specter put the loss above $86M across ten addresses, tanuki42 traced more than $72M to eight, MistTrack estimated close to $90M, Arkham's 'ledger-drainer' cluster held about $71.6M in assets at one snapshot, and later reporting cited $86M–$94.5M. The differences are scope — cumulative inflow versus current holdings, and which addresses count — and Ledger has confirmed neither a cause nor a count. This column carries ~$86M as the base and states the range rather than picking a winner.
Is the Fomo phishing loss in the weekly total?
No. The bookmark-phishing attack is a client-side session compromise: the victim ran attacker JavaScript inside their own logged-in browser, and the stolen credential store authorized access. SlowMist classes it as phishing, not a protocol exploit, and it is carried as a method card rather than a loss-series entry — the same treatment this column gives user-facing social engineering like the fake GIWA bridge. The loss series counts protocol and platform exploits.
How much of the Ledger haul has been frozen or recovered?
Roughly $10M of USDT, frozen by Tether across more than twenty addresses linked to the cluster — a small fraction of the ~$86M base case, and with no equivalent mechanism for the bitcoin and ether portions, which no issuer can freeze. PeckShield separately traced about $3.89M into Binance deposit addresses on Tron, giving investigators an account-level lead that has not yet produced a confirmed freeze. The attacker's same-day conversion of USDT into USDD shows how quickly an issuer freeze can be routed around.
Why are the DOJ forfeitures and the Tether lawsuit not counted as losses?
Because neither is a theft. The DOJ filings seek civil forfeiture of crypto already seized or identified — enforcement action against alleged illicit funds — and the Conduit suit is a dispute over a freeze, not a loss event. This column counts only money that left a protocol or platform during the window; enforcement and legal actions are tracked in the recovery column, not folded into the loss total.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.