{
 "site": "https://drains.watch",
 "generatedAt": "2026-10-22T21:54:42.802Z",
 "changes": [
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-21",
   "title": "Another 18,800 ETH (about $46M) went to Tornado Cash, a two-day total of 44,510 ETH (about $109M); about 56,569 ETH stayed in exploiter-labelled wallets per Arkham.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-20",
   "title": "The Drift exploiter sent about $61M in ETH to Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-16",
   "title": "Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-15",
   "title": "Hacken's Q3 data showed about $387M covered by Bitget's user protection fund; Circle and Tether froze about $340,000 tied to the theft.",
   "sourceUrl": "https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "eip-7702-delegation-drain-22k-oct-2026",
   "incidentTitle": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-14",
   "title": "Attacker submits a sponsored type-4 transaction using the victim's earlier EIP-7702 authorization and drains 9.1231 ETH plus TAPEETH.",
   "sourceUrl": "https://etherscan.io/tx/0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee",
   "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026"
  },
  {
   "incident": "eip-7702-delegation-drain-22k-oct-2026",
   "incidentTitle": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-14",
   "title": "ExVul flags the drain and says the malicious delegation is still active; crypto.news reports it.",
   "sourceUrl": "https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/",
   "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-14",
   "title": "Ledger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-13",
   "title": "Ledger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-12",
   "title": "CryptoSlate reported that 1,104 wallets in a studied subset paid $940,106 to poisoned addresses, described as a minimum.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "An unauthorized post on COLDCARD's X account links to a fake 'security migration' site; COLDCARD deletes it and warns users.",
   "sourceUrl": "https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "A phishing link is posted on Coldcard's X account; Coldcard warns users, deletes the post and contacts X.",
   "sourceUrl": "https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-11",
   "title": "Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.",
   "sourceUrl": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-10",
   "title": "Ledger confirmed that at least one affected device contained an unauthorized hardware implant.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "noir-drainer-dns-txt-c2-oct-2026",
   "incidentTitle": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-09",
   "title": "Infoblox Threat Intel publishes its analysis of the Noir drainer kit and its DNS TXT based control channel.",
   "sourceUrl": "https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/",
   "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Coordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Ledger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-09",
   "title": "Bitquery published findings that 4,497,798 Solana wallets were targeted with lookalike addresses over about 11 months.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist founder Cos warned on X of bookmark phishing aimed at the Fomo web app, using a fake CAPTCHA and a bookmark clicked two to three times.",
   "sourceUrl": "https://x.com/evilcos/status/2108000520493490578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist posted a threat-intel alert saying the technique is an old one now being used against Fomo users.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108039792219013578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist published its analysis: about $48,000 lost after a link on the MOONLET token page led to a fake verification page; 45,106.85 USDC went to one attacker address in three transfers.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist said MistTrack traced the funds through USDC/SOL swaps, address splitting, cross-chain transfers, Privacy Cash and gambling platforms.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108169316025893169",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist warned of bookmark phishing against Fomo users, calling it an old exploitation method, and published an analysis of a $48,000 loss.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-07",
   "title": "Socket published its analysis, linking the add-ons through a shared campaign marker to crypto-theft extensions it found in August 2026.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-10-06",
   "title": "Rekt reported that no root-cause report had been published, traced about $6.07M, and noted an earlier $4.6M Duelbits hot-wallet breach in February 2024.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-05",
   "title": "Mozilla unpublished the 16 malicious extensions from the Firefox add-ons store.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-05",
   "title": "Incrypted published the addresses involved: the poison address matched the intended recipient's first three and last six hex characters.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-05",
   "title": "Ransom-ISAC publishes 'Inferno Drainer Is Burning Out', describing the ecosystem as still active.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "GoPlus Security reported the roughly $305,000 DAI loss and warned that address-poisoning campaigns are now fully automated.",
   "sourceUrl": "https://phemex.com/news/article/user-loses-305000-in-dai-to-automated-address-poisoning-attack-98744",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  },
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "Scam Sniffer flagged the loss and PANews relayed it.",
   "sourceUrl": "https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  },
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-03",
   "title": "The attacker used the victim's old Permit2 phishing approval to move $167,342 in LINK.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-01",
   "title": "The confirmed loss was put at $387.5 million, up from the first estimate of $351.6 million.",
   "sourceUrl": "https://crypto.news/crypto-loses-768m-in-worst-hack-month-of-2026/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-28",
   "title": "Bitget resumed Bitcoin withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-28",
   "title": "Protos reported more than 7,000 wallets drained, over $18M stolen and 6.3M XRP moved to Ethereum via THORChain, with no recoveries.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-27",
   "title": "Duelbits reopened at 05:04 UTC with deposits and withdrawals enabled.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-25",
   "title": "A custom withdrawal tool drained hot and warm wallets over nearly three hours after midnight (UTC+8); Bitget suspended withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "singularitynet-bridge-signing-key-compromise-sep-2026",
   "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-25",
   "title": "Rekt reported SingularityNET had revoked the access, shut the bridges and converters, paused AGIX and NTX transfers on Ethereum and planned to retire AGIX; the attacker's hub still held about 433 ETH.",
   "sourceUrl": "https://rekt.news/singularitynet-rekt",
   "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-24",
   "title": "Per Mandiant, the attacker gained privileged access to two third-party security appliances, then reached the wallet job server and deployed malicious packages.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-24",
   "title": "Duelbits hot wallets were drained across five chains; Scam Sniffer called it a suspected private-key compromise and SlowMist listed private key leakage.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-21",
   "title": "Drains continued, with 640,370 more XRP taken after 21 September.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "singularitynet-bridge-signing-key-compromise-sep-2026",
   "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-20",
   "title": "Unauthorized minting began around 03:13 UTC, creating about 2.3 billion AGIX, NTX, WMTX and CGV.",
   "sourceUrl": "https://rekt.news/singularitynet-rekt",
   "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026"
  },
  {
   "incident": "singularitynet-bridge-signing-key-compromise-sep-2026",
   "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-19",
   "title": "A compromised authorizer signature released 8,721,530.40 FET from the bridge, cleared at 20:21 UTC, which the attacker swapped for 522.78 ETH.",
   "sourceUrl": "https://rekt.news/singularitynet-rekt",
   "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026"
  },
  {
   "incident": "waterplum-contagious-interview-advisory-sep-2026",
   "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-19",
   "title": "BleepingComputer reported the advisory's figures: 30,000+ infected devices, 7,000+ wallets hit and over 1.7 billion yen stolen.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026"
  },
  {
   "incident": "waterplum-contagious-interview-advisory-sep-2026",
   "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-18",
   "title": "Japan, the US, Australia and Germany issued a joint advisory on WaterPlum covering activity from December 2025 to July 2026.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-17",
   "title": "D'CENT's status report said its latest app includes a check to show users whether they need to act.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-15",
   "title": "The first of at least six drain waves (through 20 September) hit D'CENT app wallets, taking about 11.7M XRP from 6,678 wallets per xrpl.to.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "safe-module-authorization-abuse-rseth-sep-2026",
   "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-15",
   "title": "At 04:38 UTC the attacker used the approved module to unwrap the Safe's aEthrsETH into about 2,882 rsETH; Blockaid flagged the theft.",
   "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026"
  },
  {
   "incident": "safe-module-authorization-abuse-rseth-sep-2026",
   "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-15",
   "title": "MEV bot Yoink front-ran the exploit by paying the block builder about $46,000, and Kelp DAO froze the receiving address within about two hours.",
   "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-11",
   "title": "Cointelegraph reported about 2,500 people opened the Trezor phishing link before it was taken down, with no losses reported.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-10",
   "title": "Brevo's postmortem said 138 client accounts were accessed, six used to send phishing and contacts exported from 43.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-09",
   "title": "Trezor and BitBox warned users about unauthorized emails sent through their Brevo accounts.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-09",
   "title": "Socket reported malicious Chrome and Firefox extensions stealing trading-terminal session and wallet data, with code labelled as Axiom bookmarklet tooling.",
   "sourceUrl": "https://socket.dev/blog/chrome-firefox-crypto-data-theft",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026",
   "incidentTitle": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-08",
   "title": "Knostic published its analysis showing the package sends the raw wallet key to a remote endpoint.",
   "sourceUrl": "https://www.knostic.ai/blog/when-auto-signing-sends-your-wallet-private-key-to-a-remote-server-a-malicious-mcp-package-on-npm",
   "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-08-31",
   "title": "SlowMist's report traced the earliest malicious activity in Bitget's logs to 31 August.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "incidentTitle": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-08-30",
   "title": "BleepingComputer reported Socket's discovery of 19 malicious Chrome and Edge extensions; the Chrome versions were gone but one Edge version was still live.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-13",
   "title": "PeckShield reported the theft and said the stolen aWBTC, DAI, WBTC and ETH were swapped into DAI and ETH and split across four addresses.",
   "sourceUrl": "https://u.today/crypto-hack-drains-256-million-from-unknown-victims",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-13",
   "title": "Specter described the theft as phishing; the same wallet had lost about $24.2M to malicious token approvals in September 2023.",
   "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-12",
   "title": "The whale's wallet was drained of about $25.6M in assets.",
   "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026",
   "incidentTitle": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-02",
   "title": "Version 1.0.9 of gadgethumans-mcp, one of the versions Knostic analyzed, was published to npm.",
   "sourceUrl": "https://www.knostic.ai/blog/when-auto-signing-sends-your-wallet-private-key-to-a-remote-server-a-malicious-mcp-package-on-npm",
   "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026"
  },
  {
   "incident": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "incidentTitle": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "severity": "low",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-01",
   "title": "USENIX Security '26 publishes the study reporting 924 malicious contract accounts and more than $2.3M in losses.",
   "sourceUrl": "https://www.usenix.org/conference/usenixsecurity26/presentation/huang-mingyuan",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026"
  },
  {
   "incident": "triple-a-hot-wallets-drained-jul-2026",
   "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-07-25",
   "title": "PeckShield amplified the alert as estimates rose above $9.7M; Triple-A had not yet confirmed the breach.",
   "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/",
   "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026"
  },
  {
   "incident": "triple-a-hot-wallets-drained-jul-2026",
   "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-07-24",
   "title": "Analyst Specter flagged suspicious transfers from Triple-A hot wallets, first estimated at over $9.3M.",
   "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/",
   "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026"
  },
  {
   "incident": "eip-7702-pancakeswap-lp-2-96m-jul-2026",
   "incidentTitle": "Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-23",
   "title": "Specter reports a dormant PancakeSwap LP lost about $2.96M after signing a malicious EIP-7702 authorization; about $1.46M goes to Tornado Cash.",
   "sourceUrl": "https://www.chaincatcher.com/en/article/2277886",
   "url": "https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026"
  },
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-09",
   "title": "Scam Sniffer posted an alert about the loss.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  },
  {
   "incident": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "incidentTitle": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-09",
   "title": "ForkLog reported the case alongside a separate 999,999 USDT approval-phishing theft, noting the approval gave attackers unlimited access and a sweeper drained the funds.",
   "sourceUrl": "https://forklog.com/en/ethereum-user-loses-nearly-1-million-usdt-in-phishing-scam/",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "Socket published its analysis: the payload hooks fromMnemonic and fromHex, 17 more packages pinned the bad version, the malicious release had 310 downloads, and 1.20.23 is clean.",
   "sourceUrl": "https://socket.dev/blog/compromised-injective-sdk-npm-package",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "BleepingComputer reported the compromise and advised affected developers to move funds to new wallets and rotate all secrets.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-08",
   "title": "The victim signed a phishing token approval and the attacker pulled 999,999 USDT out in three transactions using multicalls.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  },
  {
   "incident": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "incidentTitle": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments",
   "severity": "low",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-06",
   "title": "SecurityWeek reported Zscaler's findings on two campaigns using hidden web instructions to push AI agents into crypto payments.",
   "sourceUrl": "https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/",
   "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026"
  },
  {
   "incident": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-06",
   "title": "Coinspect warned publicly about the Ill Bloom flaw and released a wallet checker; about $2M more had moved from exposed wallets.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026"
  },
  {
   "incident": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "incidentTitle": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-03",
   "title": "An X post by an on-chain commentator reported that a wallet holder lost $1.65M after connecting to a fake exchange and signing a malicious contract.",
   "sourceUrl": "https://x.com/RyanColeXBT/status/2073172860034789620",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-01",
   "title": "Halborn's June review listed the vendor-driven front-end attack at about $3M stolen from site visitors.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "incidentTitle": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-30",
   "title": "eSecurity Planet reports McAfee's findings on the Silent Swap clipper extension campaign.",
   "sourceUrl": "https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/",
   "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-26",
   "title": "Bubblemaps estimated about $3M stolen from fewer than 15 users; PeckShield said victims' pUSD was drained and the funds were converted to ETH.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-25",
   "title": "Polymarket said a third-party vendor was compromised and malicious code was injected into its website; it removed the code, patched the issue and promised full refunds.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "cryptobandits-usb-worm-clipper-tor-jun-2026",
   "incidentTitle": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-18",
   "title": "BleepingComputer reports the USB worm clipper and its address-swap and seed-phrase theft.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/",
   "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026"
  },
  {
   "incident": "cryptobandits-usb-worm-clipper-tor-jun-2026",
   "incidentTitle": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-17",
   "title": "Microsoft Threat Intelligence details the Tor-based crypto clipper with worm-like USB spreading, active since February 2026.",
   "sourceUrl": "https://www.microsoft.com/en-us/security/blog/?p=148177",
   "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-15",
   "title": "Halborn's analysis said malware with root access on a developer computer collected seven keys left there by an accidental backup at mainnet launch; ZachXBT questioned that explanation.",
   "sourceUrl": "https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-09",
   "title": "Founder Terence Kwok confirmed the incident; the team halted deposits and withdrawals on the affected bridges as H fell from $0.731 to $0.0796.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-08",
   "title": "The attacker made the first suspicious commits to the Injective SDK repository and published the malicious version shortly after.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-08",
   "title": "Attackers used stolen keys to take over Safe multisigs on Ethereum (3 of 6) and BSC (3 of 5), gained ProxyAdmin control and drained about 141.2M H.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-05-27",
   "title": "An attacker drained about $3.1M from 431 wallets whose seeds were generated with weak randomness.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026"
  },
  {
   "incident": "trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "incidentTitle": "TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-26",
   "title": "CSO Online reported Socket's TrapDoor findings: 34+ malicious packages across three registries that steal wallet data and poison AI assistant config files.",
   "sourceUrl": "https://www.csoonline.com/article/4177019/trapdoor-malware-campaign-puts-developer-workstations-in-ciso-spotlight.html",
   "url": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026"
  },
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-24",
   "title": "StablR acknowledged an exploit on X about eight hours after on-chain activity stopped; Blockaid attributed it to one signer's compromised key on a 1-of-3 multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-23",
   "title": "ZachXBT flagged the exploit at 9:46 PM ET after the attacker minted 8.35M USDR and 4.5M EURR through the minting multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "fake-cjup-jupiter-airdrop-drainer-may-2026",
   "incidentTitle": "Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-05-22",
   "title": "COINTURK reported Solana Floor's warning about fake $CJUP tokens impersonating Jupiter's Jupuary and linking to wallet drainers.",
   "sourceUrl": "https://en.coin-turk.com/fake-cjup-airdrop-drains-solana-wallets-within-minutes/",
   "url": "https://drains.watch/i/fake-cjup-jupiter-airdrop-drainer-may-2026"
  },
  {
   "incident": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026",
   "incidentTitle": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-13",
   "title": "Cointelegraph reported the free-NFT permission step, put the loss at $155,000 to $174,000 and said some funds were later returned.",
   "sourceUrl": "https://cointelegraph.com/news/grok-bankr-wallet-free-nft-prompt-injection",
   "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-05-13",
   "title": "Halborn's April review put user losses at about $1.2M and said the DNS registrar had been social-engineered.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "sigma-telegram-bot-wallets-key-leak-200k-may-2026",
   "incidentTitle": "Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-05-11",
   "title": "A trader reported two SIGMA-generated wallets drained of over $200,000 on Ethereum, Base and BSC; analysts pointed to a private-key leak.",
   "sourceUrl": "https://www.cryptopolitan.com/crypto-trader-loses-200k-telegram-bot/",
   "url": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026"
  },
  {
   "incident": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026",
   "incidentTitle": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-08",
   "title": "NeuralTrust analyzed the theft as prompt injection combined with excessive agency, after Grok had been given expanded permissions.",
   "sourceUrl": "https://neuraltrust.ai/blog/grok-morse-code",
   "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026"
  },
  {
   "incident": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026",
   "incidentTitle": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-04",
   "title": "About 3 billion DRB tokens were moved from Grok's Bankr wallet on Base after Grok decoded a Morse-coded post and Bankrbot acted on it; coverage began the same day.",
   "sourceUrl": "https://oecd.ai/en/incidents/2026-05-04-4a73",
   "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026"
  },
  {
   "incident": "femitbot-telegram-mini-app-fraud-may-2026",
   "incidentTitle": "FEMITBOT: fake Telegram bots and Mini Apps impersonate crypto brands to take deposits and push Android malware",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-05-03",
   "title": "BleepingComputer reports CTM360's findings on FEMITBOT, a shared backend running fake Telegram bots and Mini Apps for crypto scams and Android malware.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/telegram-mini-apps-abused-for-crypto-scams-android-malware-delivery/",
   "url": "https://drains.watch/i/femitbot-telegram-mini-app-fraud-may-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-05-01",
   "title": "A key rotation locks the operators out of their own command contract for about 23 days (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "wasabi-protocol-deployer-key-apr-2026",
   "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-30",
   "title": "The attacker used the compromised wasabideployer.eth key to call grantRole and give themselves admin privileges with no delay.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise",
   "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026"
  },
  {
   "incident": "wasabi-protocol-deployer-key-apr-2026",
   "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-30",
   "title": "A helper contract upgraded the perp vaults and Long Pool to malicious implementations that drained balances on Ethereum and Base; Blockaid flagged the exploit on X.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise",
   "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026"
  },
  {
   "incident": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-30",
   "title": "OurCryptoTalk reported the loss, disclosed in Meteora's Q1 2026 Token Holder Report, with the USDC moved through KuCoin and recovery considered unlikely.",
   "sourceUrl": "https://ourcryptotalk.com/news/meteora-otc-scam-1-5m-usdc-loss",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026"
  },
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-29",
   "title": "ReversingLabs published its findings and linked the campaign to Famous Chollima.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  },
  {
   "incident": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "incidentTitle": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-20",
   "title": "Kaspersky discloses 26 FakeWallet apps on the App Store, active since at least fall 2025, and reports them to Apple.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-15",
   "title": "Apple removes the app and terminates the developer account; KuCoin freezes linked accounts.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-14",
   "title": "CoW DAO said swap.cow.fi had been hit by a DNS hijacking, paused its backend and APIs, and told users to stay away from the site.",
   "sourceUrl": "https://cointelegraph.com/news/cow-swap-dao-domain-hijacking",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-14",
   "title": "A researcher estimated about $500K drained from a few addresses; CoW DAO told users to revoke all approvals made on CoW Swap after 14:54 UTC.",
   "sourceUrl": "https://decrypt.co/364377/ethereum-defi-exchange-cow-swap-website-compromise",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-14",
   "title": "BleepingComputer reports about $9.5M stolen from ~50 victims, traced by ZachXBT and laundered via 150+ KuCoin deposit addresses.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-04-14",
   "title": "CoW Protocol domain takeover (April 2026; see cow-swap-dns-hijack-apr-2026), which the report links to the Inferno ecosystem, costs users about $1.2M over about 4.5 hours.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "incidentTitle": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-10",
   "title": "Moonlock publishes its analysis of notnullOSX, including the module that swaps hardware-wallet apps for trojanized copies.",
   "sourceUrl": "https://moonlock.com/new-mac-stealer-notnullosx",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-08",
   "title": "Victims who entered their recovery phrase into the fake app begin losing funds (losses ran 8-11 April).",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-03",
   "title": "SecurityWeek reported Elliptic's $286M estimate and a likely North Korean link; about $225M had been swapped to Ethereum.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "About a minute after a legitimate insurance-fund test withdrawal, the attacker submitted two pre-signed transactions, took admin control and drained the vaults.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "Attackers executed pre-signed durable-nonce transactions to take Drift's admin key, created a fake CVT collateral market, raised the circuit breaker and drained six assets in about 10 seconds.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "Halborn's March review attributed the roughly $23M loss to a compromised key of an off-chain service, with no on-chain check on mint amounts.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026",
   "incidentTitle": "Solana wallet MCP server on PyPI sent users' private keys to a remote server",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-31",
   "title": "Malicious-package advisory MAL-2026-2315 was published for latinum-wallet-mcp versions 0.0.32 to 0.0.36.",
   "sourceUrl": "https://osv.dev/vulnerability/MAL-2026-2315",
   "url": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026"
  },
  {
   "incident": "spl-token-owner-reassignment-false-deposit-feb-2026",
   "incidentTitle": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-31",
   "title": "Liminal publishes a write-up of the 'false top-up' technique and says it deployed instruction-level filtering and ATA validation.",
   "sourceUrl": "https://www.liminalcustody.com/?p=21280",
   "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-30",
   "title": "A new durable nonce account tied to a member of the updated multisig appeared.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-28",
   "title": "IoTeX's review said bridge contracts moved to multisig governance and sensitive keys to hardware security modules; Chainalysis linked the attacker to the group behind the Infini exploit.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-27",
   "title": "Drift executed a planned Security Council migration to replace a member.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "npm-galedonovan-solana-key-stealers-mar-2026",
   "incidentTitle": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-26",
   "title": "Cyber Press reported five 'galedonovan' npm packages that exfiltrate Solana and Ethereum private keys to a Telegram bot; four were still live.",
   "sourceUrl": "https://cyberpress.org/telegram-attack-targets-crypto-developers/",
   "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026"
  },
  {
   "incident": "litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "incidentTitle": "Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-24",
   "title": "Malicious LiteLLM 1.82.7 and 1.82.8 were published to PyPI with a credential and wallet stealer, and were later removed.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/",
   "url": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-23",
   "title": "Four durable nonce accounts were created, two tied to Security Council members and two controlled by the attacker.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-23",
   "title": "Resolv temporarily paused its app and later enabled redemptions while contacting verified holders.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-21",
   "title": "Using a stolen privileged signing key, the attacker deposited roughly $100K-$200K in USDC, minted about 80M unbacked USR and traded it for about 11,408 ETH; USR fell to about 26 cents.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "bonk-fun-domain-hijack-drainer-mar-2026",
   "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-12",
   "title": "The Block reported the team told users not to interact with the website until it was secured; the operator said losses were minimal.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026"
  },
  {
   "incident": "bonk-fun-domain-hijack-drainer-mar-2026",
   "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-11",
   "title": "Bonk.fun's official domain began serving a drainer behind a fake terms-of-service signature after a team account was hijacked.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-02",
   "title": "IoTeX opened the ioTube Claims Portal: full stablecoin payout for losses up to $10,000, larger claims paid over 12 months.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-03-01",
   "title": "AngelFerno announces it has acquired Purple Drainer (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-28",
   "title": "A commit co-authored by Claude Opus added @solana-launchpad/sdk to the openpaw-graveyard trading agent, pulling in the malicious @validate-sdk/v2.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  },
  {
   "incident": "arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "incidentTitle": "Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-24",
   "title": "Security Affairs reported Kaspersky's analysis of Arkanix and the project's shutdown.",
   "sourceUrl": "https://securityaffairs.com/188431/malware/arkanix-stealer-ai-assisted-info-stealer-shuts-down-after-brief-campaign.html",
   "url": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-24",
   "title": "The IoTeX chain came back online at 06:06 UTC.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "step-finance-treasury-drain-jan-2026",
   "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-23",
   "title": "Step Finance said it would end operations along with SolanaFloor and Remora Markets after the roughly $40M loss.",
   "sourceUrl": "https://www.theblock.co/post/390964/step-finance-shuts-down",
   "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026"
  },
  {
   "incident": "lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026",
   "incidentTitle": "AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-22",
   "title": "The Lobstar Wilde agent replied to a request for 4 SOL and transferred about 53 million LOBSTAR tokens, worth about $250,000, to the requester's wallet.",
   "sourceUrl": "https://www.theblock.co/post/390722/ai-agent-created-by-openai-dev-accidentally-sends-entire-memecoin-holdings-to-reply-guy",
   "url": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-21",
   "title": "At 01:51 UTC the attacker upgraded an ioTube Validator contract to a malicious version.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "iotex-iotube-bridge-key-compromise-feb-2026",
   "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-21",
   "title": "IoTeX detected the incident at 08:01 UTC, alerted the community at 09:39 UTC, and validators suspended the IoTeX chain at 10:03 UTC.",
   "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/",
   "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026"
  },
  {
   "incident": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "incidentTitle": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-09",
   "title": "Mandiant published its analysis, naming seven malware families including WAVESHAPER, HYPERCALL and SUGARLOADER.",
   "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering",
   "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026"
  },
  {
   "incident": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "incidentTitle": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-02-05",
   "title": "Bitdefender Labs published its analysis of malicious OpenClaw skills, including Solana- and Phantom-themed lures that delivered the AMOS stealer.",
   "sourceUrl": "https://www.bitdefender.com/en-au/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap",
   "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "The hijacked @arbitrumdao_gov account posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "Arbitrum warned users not to click links or interact with the account until further notice and said it was working to restore access.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  },
  {
   "incident": "spl-token-owner-reassignment-false-deposit-feb-2026",
   "incidentTitle": "SPL token-account ownership reassignment used to fake deposits at a Solana custodian",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-01",
   "title": "During February, Liminal Custody's SOC detects and neutralises two low-value SPL token-account ownership reassignment attempts (exact days not published).",
   "sourceUrl": "https://www.liminalcustody.com/?p=21280",
   "url": "https://drains.watch/i/spl-token-owner-reassignment-false-deposit-feb-2026"
  },
  {
   "incident": "step-finance-treasury-drain-jan-2026",
   "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-31",
   "title": "Step Finance reported a breach of some treasury wallets; CertiK reported 261,854 SOL (about $27M) unstaked and transferred.",
   "sourceUrl": "https://cointelegraph.com/news/step-finance-solanafloor-remora-markets-wind-down-operations",
   "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "All 4,556 ETH was deposited into Tornado Cash in 56 deposits.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "Scam Sniffer publicly reported the $12.25M address-poisoning loss.",
   "sourceUrl": "https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-30",
   "title": "The victim sent 4,556 ETH to the lookalike 0x6d9052...2e48 instead of the intended 0x6D90CC...2E48; about 33 minutes later it was swept to a new wallet.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "incidentTitle": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-22",
   "title": "Check Point Research published its findings on KONNI's AI-generated backdoor aimed at blockchain developers.",
   "sourceUrl": "https://blog.checkpoint.com/research/ai-powered-north-korean-konni-malware-targets-developers/",
   "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026"
  },
  {
   "incident": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "incidentTitle": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-21",
   "title": "SlowMist's CISO warns that Snap Store publisher accounts tied to expired domains are being taken over to ship fake wallet apps.",
   "sourceUrl": "https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026"
  },
  {
   "incident": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-17",
   "title": "Meteora sent $1.5M USDC to a scammer-controlled 'escrow' address during an attempted OTC buyback of MET; SlowMist logs it as social engineering.",
   "sourceUrl": "https://hacked.slowmist.io/?c=Solana",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026"
  },
  {
   "incident": "address-poisoning-514k-usdt-jan-2026",
   "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-16",
   "title": "Around 14:01 UTC the victim sent a 5,000 USDT test and then 509,000 USDT to a lookalike address.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026"
  },
  {
   "incident": "address-poisoning-514k-usdt-jan-2026",
   "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-16",
   "title": "Cyvers Alerts posted a warning about the theft at 14:34 UTC.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026"
  },
  {
   "incident": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-14",
   "title": "Odaily published an ExVul Security analysis of the risks of custodial prediction-market bots.",
   "sourceUrl": "https://www.odaily.news/en/post/5208756",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026"
  },
  {
   "incident": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-13",
   "title": "Polycule confirmed its Telegram trading bot was hacked, about $230,000 of user funds lost; the bot was taken offline.",
   "sourceUrl": "https://www.odaily.news/en/post/5208756",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-01-07",
   "title": "OKX Wallet warns the owner-modification phishing technique is spreading on Solana and says it has added warnings; Phantom reportedly added similar alerts.",
   "sourceUrl": "https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-06",
   "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.",
   "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "incidentTitle": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-03",
   "title": "Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.",
   "sourceUrl": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-31",
   "title": "SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.",
   "sourceUrl": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-27",
   "title": "Trust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-12-26",
   "title": "X users warned of the 'Axiom Bookmark Method', with a trending summary claiming over $200,000 drained.",
   "sourceUrl": "https://x.com/insidecalls/status/2004593677138550834",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "axiom-bookmark-method-drains-dec-2025",
   "incidentTitle": "'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-26",
   "title": "@insidecalls posted a warning video about the 'Axiom Bookmark Method', saying someone they knew had recently fallen for it, and asked Axiom to patch it.",
   "sourceUrl": "https://x.com/insidecalls/status/2004593677138550834",
   "url": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025"
  },
  {
   "incident": "axiom-bookmark-method-drains-dec-2025",
   "incidentTitle": "'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-26",
   "title": "An X trending topic summarized posts saying an Axiom bookmark scam had drained over $200,000 from wallets.",
   "sourceUrl": "https://x.com/i/trending/2004611057839378907",
   "url": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-26",
   "title": "CyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.",
   "sourceUrl": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-25",
   "title": "ZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.",
   "sourceUrl": "https://www.theblock.co/post/383735/trust-wallet-extension-incident",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-24",
   "title": "Malicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:06 UTC the victim sent a 50 USDT test to the intended address; a script then created a lookalike address and sent small transfers to poison the wallet's history.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:32 UTC the victim copied the lookalike address from history and sent 49,999,950 USDT to it.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "Within 30 minutes the USDT was swapped to DAI via MetaMask Swap, converted to about 16,690 ETH, and about 16,680 ETH was deposited into Tornado Cash.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "The victim posted an on-chain message offering a $1M bounty for return of 98% of the funds and said a criminal case had been filed.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-18",
   "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "incidentTitle": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "severity": "low",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-12-13",
   "title": "A separate arXiv paper on EIP-7702 phishing reports that authorizations are dominated by a few contract families linked to criminal activity.",
   "sourceUrl": "https://arxiv.org/abs/2512.12174v1",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-09",
   "title": "Decrypt covers the case and explains how permit scams let attackers spend tokens without an on-chain approval.",
   "sourceUrl": "https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-08",
   "title": "Scam Sniffer reports a user lost $440,358 in USDC after signing a malicious permit signature.",
   "sourceUrl": "https://x.com/realScamSniffer/status/1998018496635207832",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "SlowMist warns that a Solana phishing signature moved a victim's account Owner permission to an attacker, with over $3M lost.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/1996528328061382860",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "Coinpaper, citing SlowMist, reported a Solana user lost over $3M after a deceptive signature changed the wallet's Owner permission; protocol teams helped recover about $2M in DeFi assets.",
   "sourceUrl": "https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-02",
   "title": "Halborn's November review listed the DNS hijack with over $1M lost through malicious token approvals.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-november-2025",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-28",
   "title": "Yonhap reported that South Korean authorities suspect the Lazarus Group and are preparing an on-site probe; CertiK said it tracked over 100 exploiter addresses.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  },
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-27",
   "title": "Upbit disclosed irregular withdrawals that drained about $36M in multiple Solana tokens from a hot wallet, froze the wallets and moved remaining funds to cold storage.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-24",
   "title": "Blockaid published its analysis: about $700K stolen to nine attacker addresses, about $3.5M in drains blocked, and 408 users warned at connect and 491 at signing.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "At 20:11 UTC the attacker changed the SOA, NS and A records so both domains pointed to a cloned front-end running Eleven Drainer code.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Blockaid detected malicious transaction patterns at 21:31 UTC and flagged the domain as malicious a minute later; the first user report came at 22:07 UTC.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Nameservers were replaced at 22:40 UTC as remediation began.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "dmt-airdrop-dexmaxai-phishing-nov-2025",
   "incidentTitle": "DMT token airdrop promoted by @dexmaxai tied to $130K phishing loss on Solana",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-20",
   "title": "SlowMist's hack database recorded a $130,000 phishing loss tied to the DMT airdrop promoted by @dexmaxai.",
   "sourceUrl": "https://hacked.slowmist.io/?c=Solana",
   "url": "https://drains.watch/i/dmt-airdrop-dexmaxai-phishing-nov-2025"
  },
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-11-17",
   "title": "A Solana wallet sent a $10 USDT test to its Gate.io deposit address; 12 seconds later a lookalike sent dust, and the wallet then sent 30,749.80 USDT to the lookalike.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-11-04",
   "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "incidentTitle": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-28",
   "title": "Kaspersky disclosed the GhostCall and GhostHire campaigns and their targets.",
   "sourceUrl": "https://www.kaspersky.co.uk/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-03",
   "title": "The first ETH dust from the lookalike address arrived; another dust ping followed on 29 January 2026.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "The Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.",
   "sourceUrl": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "ForkLog reported his account of seeing a deepfake of his friend on the call.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-09-06",
   "title": "BleepingComputer reported Wiz's tally of 2,180 exposed accounts and 7,200 repositories across three phases.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-04",
   "title": "He received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-09-03",
   "title": "Wiz published its analysis: over 1,700 users had secrets leaked, over 6,700 private repos were exposed, and no successful crypto exfiltration had been seen.",
   "sourceUrl": "https://www.wiz.io/blog/s1ngularitys-aftermath",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-26",
   "title": "News broke that malicious Nx versions on npm were stealing tokens and using local AI CLIs to search for wallet and secret files.",
   "sourceUrl": "https://www.wiz.io/blog/s1ngularitys-aftermath",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-26",
   "title": "Malicious Nx versions with a data-stealing postinstall script were published to npm.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-20",
   "title": "Proofpoint published its research on Lovable abuse; Lovable said it had removed a phishing cluster and added real-time detection.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  },
  {
   "incident": "cursor-contractshark-solidity-extension-dev-key-theft-aug-2025",
   "incidentTitle": "Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-13",
   "title": "Cointelegraph reported that a malicious Cursor extension had taken an Ethereum core developer's private key and the hot wallet was drained the previous Sunday.",
   "sourceUrl": "https://cointelegraph.com/news/core-ethereum-devs-crypto-wallet-drained-ai-extension",
   "url": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025"
  },
  {
   "incident": "ai-video-mev-bot-tutorials-drainer-contracts-aug-2025",
   "incidentTitle": "YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-08-05",
   "title": "SentinelLABS' report (updated 5 August 2025) listed three attacker addresses and more than $900,000 taken.",
   "sourceUrl": "https://www.sentinelone.com/labs/smart-contract-scams-ethereum-drainers-pose-as-trading-bots-to-steal-crypto/",
   "url": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-01",
   "title": "The Register reported more than 1,500 downloads and the signs of AI-written code.",
   "sourceUrl": "https://www.theregister.com/2025/08/01/emoji_use_ai_malware/",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-31",
   "title": "Safety published its analysis, including the attacker's Solana address and an open command server.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-30",
   "title": "npm marked the package as malicious.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-28",
   "title": "The package was first published to npm; 19 versions followed over two days.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "incidentTitle": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-07-10",
   "title": "Kaspersky disclosed that a fake Solidity extension aimed at Cursor users led to about $500,000 in stolen crypto from a blockchain developer.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers",
   "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-18",
   "title": "Huntress published its analysis, attributing the attack to BlueNoroff (TA444).",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-06-17",
   "title": "Proofpoint first saw the Aave-themed lure, a Lovable app linked from SendGrid emails.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-11",
   "title": "Huntress was contacted about the intrusion on the employee's Mac.",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-14",
   "title": "CryptoSlate reported the warning and his advice to sign wallet transactions only from a separate, dedicated laptop.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-13",
   "title": "Nailwal warned on X that a hijacked Polygon Ventures Telegram account was sending founders to deepfake Zoom calls.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  },
  {
   "incident": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "incidentTitle": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-03-19",
   "title": "Cointelegraph reported the maintainer's statement that servers were migrated, keys swapped and dashboard access paused, and that the AIXBT token fell about 15.5%.",
   "sourceUrl": "https://cointelegraph.com/news/hacker-breaches-ai-crypto-bot-aixbt-steals-55-eth",
   "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025"
  },
  {
   "incident": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "incidentTitle": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-03-18",
   "title": "An attacker breached the AIXBT agent's dashboard and issued two prompts that moved about 55.5 ETH out of its wallet.",
   "sourceUrl": "https://cointelegraph.com/news/hacker-breaches-ai-crypto-bot-aixbt-steals-55-eth",
   "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-02-25",
   "title": "The first forged token transfer tied to the lookalike address appeared, starting the poisoning of the victim's history.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  }
 ]
}