BNB Chain
7 incidents, 3 live. 13 days since the last new one.
7 drains in the last 12 months
7 drains in the last 12 months
7 drains in 2026
Live
-
Critical◐Partly contained
Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M
Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct.
Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers·Tron, Ethereum, BNB Chain, Polygon, Solana, Bitcoin·$102M stolen·Since Oct 9, 2026·
-
Critical✓Contained
Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances
Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund.
Bitget exchange hot and warm wallets·Ethereum, Arbitrum, Avalanche, Optimism, BNB Chain, Base·$388M stolen·Since Sep 24, 2026·
-
Critical◐Partly contained
SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted
An unauthorized party got into part of SingularityNET's cloud infrastructure and on 19-20 September 2026 used a compromised authorizer signature and NuNet's mint authority to release 8.72M FET from a bridge and mint about 2.3 billion AGIX, NTX, WMTX and CGV. Sixteen wallets, four labelled as SingularityNET or NuNet staff, were swept before the minting. Headlines cited $16.77M, but Rekt's transaction-level count found about $2.29M in sellable proceeds because most minted tokens could not be sold. Bridges and converters are offline and AGIX is being replaced, so holders should wait for official migration steps.
SingularityNET / ASI Alliance bridge and conversion contracts (also NuNet, Cogito, Rejuve and World Mobile tokens)·Ethereum, BNB Chain·$2.3M stolen·Since Sep 19, 2026·
Past
September 2026 1
-
Critical✓Contained
Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise
On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe.
Duelbits crypto casino hot wallets·Ethereum, BNB Chain, Tron, Bitcoin, Solana·$7.0M stolen·Since Sep 24, 2026·
July 2026 1
-
Critical✓Contained
Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization
A long-inactive PancakeSwap liquidity provider lost about $2.96 million after signing a malicious EIP-7702 authorization, according to Specter monitoring reported by ChainCatcher on 23 July 2026. The attacker pulled about $1.48M of BSC-USD and $1.48M of BUSD liquidity, sent about $1.46M to Tornado Cash and still held about $1.48M in USDT at the time. An EIP-7702 authorization hands control of your whole account to a contract, so never sign one from a site you did not seek out.
A PancakeSwap liquidity provider (BNB Chain)·BNB Chain·$3.0M stolen·Since Jul 23, 2026·
June 2026 1
-
Critical◐Partly contained
Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys
On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools.
Humanity Protocol (H token) bridges and treasury·Ethereum, BNB Chain·$36M stolen·Since Jun 8, 2026·
May 2026 1
-
High✓Contained
Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak
On 11 May 2026 a crypto trader lost over $200,000 across Ethereum, Base and BSC from two wallets created by the SIGMA Telegram trading bot; the largest losses were about $125,000 in POD on Base and $21,000 in FHE on BSC. An on-chain analyst said the drain used the private keys directly, with no token approval involved, while the victim's other wallets were untouched. The cause is unconfirmed; suggestions include fake CAPTCHA bots in Telegram, infostealer malware or a device compromise. Users of bot-generated wallets should keep balances small and never run 'verification' steps a Telegram bot asks for.
SIGMA Telegram trading bot wallets (one trader)·Ethereum, Base, BNB Chain·$200K stolen·Since May 11, 2026·
No drains match these filters.