Web3 Security Weekly Recovery & Enforcement Update — October 5–11, 2026

Recovery Ledger: A Freeze and Its Escape Hatch

The Ledger/CryptoBilis drain produced the week's only meaningful recovery, and it is instructive precisely because of where it stopped. Tether froze roughly $10M of USDT across more than twenty linked addresses — a fast, issuer-level action on a case whose losses are estimated at $72M–$94.5M, so roughly a tenth of the base figure. The attacker adapted within a day: on October 9, USDT was converted into USDD via SUN.io's exchange route and USDD's peg-stability module, moving the stablecoin portion onto a token whose issuer has no blacklist function, so a Tether freeze on the USDT contract cannot touch it. On the Ethereum side, about 430 ETH (~$1.07M) was routed through Tornado Cash across four wallets. PeckShield's tracing then produced the week's most actionable new data: roughly $3.89M — 3.685M USDT plus 615,000 TRX — sent into Binance deposit addresses on Tron over a two-day window, after roughly $10M had already moved to Binance deposit addresses earlier. Centralized exchanges can act on a deposit in a way no permissionless rail can, which is why this lead matters more than the freeze total.

Issuer Freeze Ledger

The Ledger cluster's ~$10M is the week's freeze figure, and the case is also the week's argument about how much a freeze is worth. A freeze binds one token on one set of addresses; the same haul carried bitcoin and ether, which no issuer can freeze, and only the USDT portion was ever reachable by an issuer action at all. The larger ledger this column has tracked — the Bitget case's roughly $840K in tracked freezes against a $387.5M theft — barely moved this week, with the ~$343M across 13 identified wallets still dormant. The pattern across both cases is the same and worth stating plainly: issuer freezes are the fastest recovery tool the industry has, and they recover a small, token-dependent slice of any haul, which is why programs like Bitget's 5%/5% bounty and T3's freeze pipeline run alongside them rather than instead of them.

Enforcement: A Forfeiture, a Review and a Lawsuit

A busy enforcement week, and for once it moved on three fronts. The Department of Justice filed forfeiture complaints targeting more than $1B in cryptocurrency allegedly tied to the Iranian government — approximately 127,271 BTC, plus a separate complaint for approximately 442,534 USDT (seized by the FBI on or about June 4, 2026, and citing 18 U.S.C. § 981(a)(1)(C)); the USDT complaint is dated October 9 and a notice was filed in the Eastern District of New York the following day. Alongside it, the DOJ is reviewing whether Binance complied with its November 2023 settlement, with a focus on potential Iran-sanctions violations — the review confirmed by Tysen Duva, head of the Criminal Division, to Bloomberg on October 9 — against a parallel $61M forfeiture — filed in the Southern District of New York in September, before this window — alleging Iranian oil proceeds routed through Binance accounts tied to two Hong Kong entities, Blessed Trust and Hexa Whale. And in civil court, Conduit Technology sued four Tether entities in the Southern District of New York on October 5, seeking the release of $2.76M in USDT it says Tether froze for over a year with no court order and no compliance link to Conduit, plus at least $2.76M in damages and a share of the reserve profits Tether earned on the frozen tokens. Two of these are actions against funds; the third is a direct challenge to the freeze power itself.

Refund and Compensation Tracker

Two new commitments and a familiar shape. Mezo will make every affected veBTC holder whole from protocol-owned sources — five days after the October 5 exploit, having self-halted its chain and bridge to stop the bleeding, it pledged reimbursement directly to affected wallets and warned users against any link promising recovery, which is what a clean small-incident response looks like. 79thVault has offered a 10% bounty on the ~$14,394.92 BNB still parked at a consolidation address, but the offer arrived from the same privileged address used in the drain — GoPlus called the sender's authenticity into question, so there is no confirmed counterparty to negotiate with, only a wallet to watch. Carried without new movement: Bitget's 5%/5% bounty against ~$343M dormant; Drift/Velocity's DFX claims at ~$1.04% per dollar; DYORSWAP's reimbursement of the fake GIWA scam (40% for sub-5-ETH deposits); Neutron's ~1,227,121 ATOM held for return; and the D'CENT, Meter, Duelbits and Payy cases, each still short of a published completion.

Unrecovered and Unaddressed

The week added a nine-figure unresolved problem and did not subtract from the backlog. The Ledger haul is largely unrecovered: only ~$10M of the base estimate is frozen, no issuer can touch the bitcoin or ether portions, and the attacker's USDD pivot moved a large stablecoin tranche out of the freezable zone — with tens of millions still in tagged wallets as of mid-week. 79thVault's ~$11.03M sits at a single address with no confirmed negotiation. MakerDAO's 200 ETH is gone into Tornado Cash, and Second's 0.75 BTC is de-anonymized by a Blink link but not returned. Carried: the Base vault's ~$31.7M inside an unclaimed contract; more than 63,000 ETH in Bitget-exploiter-linked wallets and the ~$1.8M Neutron attacker balance; the D'CENT operator's 1,440,291 XRP; the Liquid Network's ~598.5 BTC; and Coldcard's remaining balance. The base rate this column keeps recording held again this week: a fast, well-run response (freeze, halt, tracing) both caps a loss and leaves most of it unrecovered, because the recovery instruments — issuer freezes, CEX deposits, court orders — cover a fraction of any haul, and every actor who reads them coming adapts.

What This Means for Buyers of Security

Three implications. First, freeze planning has to model the exit, not just the entry: an attacker who can convert stolen USDT into an unfreezable dollar token within a day turns a ~$10M freeze into a partial recovery, so the value of a freeze program is now bounded by what the funds can pivot into — a fact to weigh before counting on issuer controls. Second, the supply chain is part of the security budget, and it is currently priced wrong: if a hardware wallet's guarantee is only as good as the reseller that shipped it, then buying direct and verifying the device is not paranoia but part of the product, and any custody product built on resold hardware inherits a channel risk its audits do not mention. Third, the legal levers are in play and worth watching: the DOJ's >$1B Iran forfeiture and its Binance settlement review price the cost of post-settlement compliance, while the Conduit suit against Tether is the first serious challenge to where an issuer's technical freeze power ends and its legal authority begins — the answer will set the terms for everyone treating a stablecoin as working capital.

Watch Items

• Ledger's own count and cause: device numbers, whether the flagged other resellers show confirmed exposure, and any recovery beyond the ~$10M frozen.
• Whether Binance acts on the ~$3.89M traced to its Tron deposit addresses, and how the DOJ's Binance settlement review resolves.
• Whether USDD absorbs more stolen stablecoin float — and if so, whether any issuer-level freeze precedent appears on Tron's stablecoin stack.
• The Conduit v. Tether outcome on freeze authority, and Tether's public response.
• Mezo's refunds landing and 79thVault's white-hat negotiations over the ~14,394.92 BNB.
• Carried: the unclaimed Base vault's ~$31.7M, Bitget's full report, and the still-dormant ~$343M.