{
 "tag": "bitcoin",
 "name": "Bitcoin",
 "group": "Chains",
 "incidents": [
  {
   "slug": "coldcard-x-account-phishing-post-oct-2026",
   "title": "COLDCARD's X account posts fake 'security migration' phishing link",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026",
   "json": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin"
   ],
   "method": "social-engineering",
   "product": "COLDCARD hardware wallet users on X",
   "tags": [
    "bitcoin",
    "social-engineering",
    "x-account-hack",
    "coldcard",
    "hardware-wallet",
    "seed-phrase-phishing",
    "fake-security-alert",
    "fake-firmware",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-11",
   "closedAt": "2026-10-11",
   "updatedAt": "2026-10-11T12:00:00Z",
   "summary": "On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website."
  },
  {
   "slug": "ledger-cryptobilis-tampered-hardware-wallets",
   "title": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets",
   "json": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin"
   ],
   "method": "supply-chain",
   "product": "Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers",
   "tags": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin",
    "supply-chain",
    "ledger",
    "hardware-wallet",
    "cryptobilis",
    "reseller",
    "hardware-implant",
    "seed-phrase-theft",
    "tether-freeze"
   ],
   "amountUsd": 102000000,
   "victims": 324,
   "startedAt": "2026-10-09",
   "closedAt": null,
   "updatedAt": "2026-10-16T12:00:00Z",
   "summary": "Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct."
  },
  {
   "slug": "duelbits-hot-wallet-drain-sep-2026",
   "title": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026",
   "json": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "bsc",
    "tron",
    "bitcoin",
    "solana"
   ],
   "method": "key-leak",
   "product": "Duelbits crypto casino hot wallets",
   "tags": [
    "ethereum",
    "bsc",
    "tron",
    "bitcoin",
    "solana",
    "key-leak",
    "casino",
    "gambling",
    "hot-wallet",
    "private-key-compromise",
    "duelbits"
   ],
   "amountUsd": 7000000,
   "victims": null,
   "startedAt": "2026-09-24",
   "closedAt": "2026-09-27",
   "updatedAt": "2026-10-06T12:00:00Z",
   "summary": "On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe."
  },
  {
   "slug": "dcent-app-wallet-seed-compromise-sep-2026",
   "title": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026",
   "json": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum",
    "tron",
    "bitcoin"
   ],
   "method": "key-leak",
   "product": "D'CENT mobile App Wallet users (wallets created in the app)",
   "tags": [
    "ethereum",
    "tron",
    "bitcoin",
    "key-leak",
    "dcent",
    "iotrust",
    "mobile-wallet",
    "seed-phrase",
    "xrp",
    "thorchain"
   ],
   "amountUsd": 18000000,
   "victims": 6678,
   "startedAt": "2026-09-15",
   "closedAt": null,
   "updatedAt": "2026-09-28T12:00:00Z",
   "summary": "From 15 to 20 September 2026 thieves emptied at least 6,678 wallets created in the D'CENT mobile app in six waves, taking about 11.7M XRP, and kept draining after 21 September for a total above 12.4M XRP (over $18M per Protos). D'CENT's own disclosure also named Bitcoin, Tron and Ethereum, and the stolen XRP was moved to Ethereum through THORChain. The cause is compromised recovery phrases for wallets made in the app; how they leaked has not been explained. D'CENT says app-created wallets are vulnerable and tells users to make a new recovery phrase and move everything."
  },
  {
   "slug": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "title": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "json": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Trezor, BitBox and CoinTracking newsletter subscribers",
   "tags": [
    "bitcoin",
    "multi-evm",
    "social-engineering",
    "email-phishing",
    "seed-phishing",
    "hardware-wallet",
    "trezor",
    "bitbox",
    "cointracking",
    "brevo",
    "newsletter"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-09-09",
   "closedAt": "2026-09-11",
   "updatedAt": "2026-09-11T12:00:00Z",
   "summary": "An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses."
  },
  {
   "slug": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "title": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
   "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "json": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "ethereum",
    "solana"
   ],
   "method": "clipboard-hijacker",
   "product": "Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)",
   "tags": [
    "bitcoin",
    "ethereum",
    "solana",
    "clipboard-hijacker",
    "clipper",
    "browser-extension",
    "chrome",
    "chromium",
    "countloader",
    "mcafee",
    "etherhiding",
    "windows"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-30",
   "closedAt": "2026-06-30",
   "updatedAt": "2026-06-30T12:00:00Z",
   "summary": "McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published."
  },
  {
   "slug": "cryptobandits-usb-worm-clipper-tor-jun-2026",
   "title": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor",
   "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026",
   "json": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "ethereum",
    "tron"
   ],
   "method": "clipboard-hijacker",
   "product": "Windows users who open shortcut files from USB drives",
   "tags": [
    "bitcoin",
    "ethereum",
    "tron",
    "clipboard-hijacker",
    "windows",
    "clipper",
    "usb-worm",
    "lnk",
    "tor",
    "microsoft",
    "cryptobandits",
    "seed-phrase"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-17",
   "closedAt": "2026-06-18",
   "updatedAt": "2026-06-18T12:00:00Z",
   "summary": "Microsoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published."
  },
  {
   "slug": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "title": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026",
   "json": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana",
    "bitcoin",
    "ethereum",
    "polygon",
    "tron"
   ],
   "method": "key-leak",
   "product": "Seed phrases made by some less widely used mobile software wallets (2018 onward)",
   "tags": [
    "solana",
    "bitcoin",
    "ethereum",
    "polygon",
    "tron",
    "key-leak",
    "weak-randomness",
    "prng",
    "seed-phrase",
    "mobile-wallet",
    "coinspect",
    "ill-bloom"
   ],
   "amountUsd": 5000000,
   "victims": 431,
   "startedAt": "2026-05-27",
   "closedAt": "2026-07-06",
   "updatedAt": "2026-07-06T12:00:00Z",
   "summary": "Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet."
  },
  {
   "slug": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "title": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026",
   "json": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "bitcoin",
    "tron"
   ],
   "method": "fake-app",
   "product": "iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps",
   "tags": [
    "multi-evm",
    "bitcoin",
    "tron",
    "fake-app",
    "ios",
    "app-store",
    "kaspersky",
    "sparkkitty",
    "metamask",
    "ledger",
    "trust-wallet",
    "coinbase",
    "seed-phrase",
    "developer-profile"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-20",
   "closedAt": "2026-04-20",
   "updatedAt": "2026-04-20T12:00:00Z",
   "summary": "Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published."
  },
  {
   "slug": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "title": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "json": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Mac users with Ledger Live, Trezor Suite or desktop/extension wallets",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "macos",
    "infostealer",
    "ledger",
    "trezor",
    "clickfix",
    "google-ads",
    "youtube",
    "moonlock",
    "notnullosx"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-10",
   "closedAt": "2026-04-10",
   "updatedAt": "2026-04-10T12:00:00Z",
   "summary": "Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published."
  },
  {
   "slug": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "title": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "json": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "ethereum",
    "tron",
    "solana"
   ],
   "method": "fake-app",
   "product": "Ledger users who installed 'Ledger Live' from the Mac App Store",
   "tags": [
    "bitcoin",
    "ethereum",
    "tron",
    "solana",
    "fake-app",
    "ledger",
    "app-store",
    "macos",
    "apple",
    "seed-phrase",
    "zachxbt",
    "kucoin"
   ],
   "amountUsd": 9500000,
   "victims": 50,
   "startedAt": "2026-04-08",
   "closedAt": "2026-04-15",
   "updatedAt": "2026-04-15T12:00:00Z",
   "summary": "A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase."
  },
  {
   "slug": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "title": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "json": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Linux users installing wallet apps from the Snap Store",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "linux",
    "snap-store",
    "snapcraft",
    "exodus",
    "ledger",
    "trust-wallet",
    "slowmist",
    "seed-phrase",
    "expired-domain",
    "account-takeover"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-21",
   "closedAt": "2026-01-21",
   "updatedAt": "2026-01-21T12:00:00Z",
   "summary": "SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published."
  },
  {
   "slug": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "title": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "json": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana",
    "bitcoin",
    "ethereum"
   ],
   "method": "malicious-extension",
   "product": "Trust Wallet Chrome extension v2.68",
   "tags": [
    "solana",
    "bitcoin",
    "ethereum",
    "malicious-extension",
    "trust-wallet",
    "browser-extension",
    "chrome-web-store",
    "seed-phrase",
    "leaked-api-key",
    "wallet",
    "supply-chain",
    "shai-hulud",
    "npm",
    "seed-phrase-theft"
   ],
   "amountUsd": 8500000,
   "victims": 2520,
   "startedAt": "2025-12-24",
   "closedAt": "2025-12-25",
   "updatedAt": "2025-12-31T12:00:00Z",
   "summary": "A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected."
  }
 ],
 "changes": [
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-16",
   "title": "Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-14",
   "title": "Ledger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-13",
   "title": "Ledger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "An unauthorized post on COLDCARD's X account links to a fake 'security migration' site; COLDCARD deletes it and warns users.",
   "sourceUrl": "https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "A phishing link is posted on Coldcard's X account; Coldcard warns users, deletes the post and contacts X.",
   "sourceUrl": "https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-11",
   "title": "Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.",
   "sourceUrl": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-10",
   "title": "Ledger confirmed that at least one affected device contained an unauthorized hardware implant.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Coordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Ledger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-10-06",
   "title": "Rekt reported that no root-cause report had been published, traced about $6.07M, and noted an earlier $4.6M Duelbits hot-wallet breach in February 2024.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-28",
   "title": "Protos reported more than 7,000 wallets drained, over $18M stolen and 6.3M XRP moved to Ethereum via THORChain, with no recoveries.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-27",
   "title": "Duelbits reopened at 05:04 UTC with deposits and withdrawals enabled.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-24",
   "title": "Duelbits hot wallets were drained across five chains; Scam Sniffer called it a suspected private-key compromise and SlowMist listed private key leakage.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-21",
   "title": "Drains continued, with 640,370 more XRP taken after 21 September.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-17",
   "title": "D'CENT's status report said its latest app includes a check to show users whether they need to act.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "dcent-app-wallet-seed-compromise-sep-2026",
   "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-15",
   "title": "The first of at least six drain waves (through 20 September) hit D'CENT app wallets, taking about 11.7M XRP from 6,678 wallets per xrpl.to.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-11",
   "title": "Cointelegraph reported about 2,500 people opened the Trezor phishing link before it was taken down, with no losses reported.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-10",
   "title": "Brevo's postmortem said 138 client accounts were accessed, six used to send phishing and contacts exported from 43.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-09",
   "title": "Trezor and BitBox warned users about unauthorized emails sent through their Brevo accounts.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-06",
   "title": "Coinspect warned publicly about the Ill Bloom flaw and released a wallet checker; about $2M more had moved from exposed wallets.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026"
  },
  {
   "incident": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "incidentTitle": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-30",
   "title": "eSecurity Planet reports McAfee's findings on the Silent Swap clipper extension campaign.",
   "sourceUrl": "https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/",
   "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026"
  },
  {
   "incident": "cryptobandits-usb-worm-clipper-tor-jun-2026",
   "incidentTitle": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-18",
   "title": "BleepingComputer reports the USB worm clipper and its address-swap and seed-phrase theft.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/",
   "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026"
  },
  {
   "incident": "cryptobandits-usb-worm-clipper-tor-jun-2026",
   "incidentTitle": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-17",
   "title": "Microsoft Threat Intelligence details the Tor-based crypto clipper with worm-like USB spreading, active since February 2026.",
   "sourceUrl": "https://www.microsoft.com/en-us/security/blog/?p=148177",
   "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026"
  },
  {
   "incident": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-05-27",
   "title": "An attacker drained about $3.1M from 431 wallets whose seeds were generated with weak randomness.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026"
  },
  {
   "incident": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "incidentTitle": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-20",
   "title": "Kaspersky discloses 26 FakeWallet apps on the App Store, active since at least fall 2025, and reports them to Apple.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-15",
   "title": "Apple removes the app and terminates the developer account; KuCoin freezes linked accounts.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-14",
   "title": "BleepingComputer reports about $9.5M stolen from ~50 victims, traced by ZachXBT and laundered via 150+ KuCoin deposit addresses.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "incidentTitle": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-10",
   "title": "Moonlock publishes its analysis of notnullOSX, including the module that swaps hardware-wallet apps for trojanized copies.",
   "sourceUrl": "https://moonlock.com/new-mac-stealer-notnullosx",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-08",
   "title": "Victims who entered their recovery phrase into the fake app begin losing funds (losses ran 8-11 April).",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "incidentTitle": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-21",
   "title": "SlowMist's CISO warns that Snap Store publisher accounts tied to expired domains are being taken over to ship fake wallet apps.",
   "sourceUrl": "https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-31",
   "title": "SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.",
   "sourceUrl": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-27",
   "title": "Trust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-26",
   "title": "CyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.",
   "sourceUrl": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-25",
   "title": "ZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.",
   "sourceUrl": "https://www.theblock.co/post/383735/trust-wallet-extension-incident",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-24",
   "title": "Malicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  }
 ]
}