# Bitcoin · Drain Watch

13 incidents, 3 live. JSON: https://drains.watch/t/bitcoin.json · RSS: https://drains.watch/t/bitcoin/feed.xml

- [COLDCARD's X account posts fake 'security migration' phishing link](https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026) (live, Medium, Contained, since Oct 11, 2026)
- [Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M](https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets) (live, Critical, Partly contained, since Oct 9, 2026)
- [Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise](https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026) (closed, Critical, Contained, since Sep 24, 2026)
- [D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron](https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026) (live, Critical, Still active, since Sep 15, 2026)
- [Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers](https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026) (closed, Medium, Contained, since Sep 9, 2026)
- ['Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses](https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026) (closed, Medium, Still active, since Jun 30, 2026)
- [Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor](https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026) (closed, High, Still active, since Jun 17, 2026)
- ['Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included](https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026) (closed, Critical, Still active, since May 27, 2026)
- [Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases](https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026) (closed, High, Partly contained, since Apr 20, 2026)
- [notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies](https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026) (closed, High, Still active, since Apr 10, 2026)
- [Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts](https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026) (closed, Critical, Partly contained, since Apr 8, 2026)
- [Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps](https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026) (closed, High, Still active, since Jan 21, 2026)
- [Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets](https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025) (closed, Critical, Contained, since Dec 24, 2025)