{ "tag": "ethereum", "name": "Ethereum", "group": "Chains", "incidents": [ { "slug": "eip-7702-delegation-drain-22k-oct-2026", "title": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet", "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026", "json": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026.json", "status": "live", "severity": "medium", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum" ], "method": "eip-7702-phishing", "product": "An Ethereum wallet holding TAPEETH mining rewards", "tags": [ "ethereum", "eip-7702-phishing", "eip-7702", "type-4-transaction", "sponsored-transaction", "exvul", "tapeeth" ], "amountUsd": 22770, "victims": 1, "startedAt": "2026-10-14", "closedAt": null, "updatedAt": "2026-10-14T12:00:00Z", "summary": "On 14 October 2026 an attacker used an EIP-7702 authorization the victim had signed earlier to drain 9.1231 ETH (about $22,770) and TAPEETH rewards from an Ethereum wallet, ExVul reported. The attacker sponsored a type-4 transaction carrying the old signature, which made the victim's wallet run attacker code that claimed mining rewards and withdrew the ETH in one go. ExVul said the malicious delegation was still active afterwards and that TAPEETH and PodMining were not at fault. The case shows a 7702 signature can sit unused and be fired later." }, { "slug": "ledger-cryptobilis-tampered-hardware-wallets", "title": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets", "json": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json", "status": "live", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "tron", "ethereum", "bsc", "polygon", "solana", "bitcoin" ], "method": "supply-chain", "product": "Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers", "tags": [ "tron", "ethereum", "bsc", "polygon", "solana", "bitcoin", "supply-chain", "ledger", "hardware-wallet", "cryptobilis", "reseller", "hardware-implant", "seed-phrase-theft", "tether-freeze" ], "amountUsd": 102000000, "victims": 324, "startedAt": "2026-10-09", "closedAt": null, "updatedAt": "2026-10-16T12:00:00Z", "summary": "Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct." }, { "slug": "permit2-phishing-link-167k-oct-2026", "title": "Old Permit2 phishing approval used to drain $167K in LINK", "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026", "json": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026.json", "status": "live", "severity": "high", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum" ], "method": "permit-phishing", "product": "An Ethereum LINK holder", "tags": [ "ethereum", "permit-phishing", "permit2", "signature-phishing", "dormant-approval", "link", "scam-sniffer" ], "amountUsd": 167342, "victims": 1, "startedAt": "2026-10-03", "closedAt": null, "updatedAt": "2026-10-04T12:00:00Z", "summary": "Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now." }, { "slug": "bitget-hot-wallet-breach-zero-day-sep-2026", "title": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances", "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026", "json": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026.json", "status": "live", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum", "arbitrum", "avalanche", "optimism", "bsc", "base" ], "method": null, "product": "Bitget exchange hot and warm wallets", "tags": [ "ethereum", "arbitrum", "avalanche", "optimism", "bsc", "base", "exchange", "bitget", "hot-wallet", "zero-day", "infrastructure-breach", "dprk" ], "amountUsd": 387500000, "victims": null, "startedAt": "2026-09-24", "closedAt": "2026-09-28", "updatedAt": "2026-10-15T12:00:00Z", "summary": "Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund." }, { "slug": "duelbits-hot-wallet-drain-sep-2026", "title": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026", "json": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum", "bsc", "tron", "bitcoin", "solana" ], "method": "key-leak", "product": "Duelbits crypto casino hot wallets", "tags": [ "ethereum", "bsc", "tron", "bitcoin", "solana", "key-leak", "casino", "gambling", "hot-wallet", "private-key-compromise", "duelbits" ], "amountUsd": 7000000, "victims": null, "startedAt": "2026-09-24", "closedAt": "2026-09-27", "updatedAt": "2026-10-06T12:00:00Z", "summary": "On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe." }, { "slug": "singularitynet-bridge-signing-key-compromise-sep-2026", "title": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted", "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026", "json": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026.json", "status": "live", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum", "bsc" ], "method": "key-leak", "product": "SingularityNET / ASI Alliance bridge and conversion contracts (also NuNet, Cogito, Rejuve and World Mobile tokens)", "tags": [ "ethereum", "bsc", "key-leak", "bridge", "cloud-compromise", "signing-key", "unauthorized-mint", "singularitynet", "asi-alliance", "nunet", "fet", "agix" ], "amountUsd": 2290000, "victims": null, "startedAt": "2026-09-19", "closedAt": null, "updatedAt": "2026-09-25T12:00:00Z", "summary": "An unauthorized party got into part of SingularityNET's cloud infrastructure and on 19-20 September 2026 used a compromised authorizer signature and NuNet's mint authority to release 8.72M FET from a bridge and mint about 2.3 billion AGIX, NTX, WMTX and CGV. Sixteen wallets, four labelled as SingularityNET or NuNet staff, were swept before the minting. Headlines cited $16.77M, but Rekt's transaction-level count found about $2.29M in sellable proceeds because most minted tokens could not be sold. Bridges and converters are offline and AGIX is being replaced, so holders should wait for official migration steps." }, { "slug": "dcent-app-wallet-seed-compromise-sep-2026", "title": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026", "json": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026.json", "status": "live", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum", "tron", "bitcoin" ], "method": "key-leak", "product": "D'CENT mobile App Wallet users (wallets created in the app)", "tags": [ "ethereum", "tron", "bitcoin", "key-leak", "dcent", "iotrust", "mobile-wallet", "seed-phrase", "xrp", "thorchain" ], "amountUsd": 18000000, "victims": 6678, "startedAt": "2026-09-15", "closedAt": null, "updatedAt": "2026-09-28T12:00:00Z", "summary": "From 15 to 20 September 2026 thieves emptied at least 6,678 wallets created in the D'CENT mobile app in six waves, taking about 11.7M XRP, and kept draining after 21 September for a total above 12.4M XRP (over $18M per Protos). D'CENT's own disclosure also named Bitcoin, Tron and Ethereum, and the stolen XRP was moved to Ethereum through THORChain. The cause is compromised recovery phrases for wallets made in the app; how they leaked has not been explained. D'CENT says app-created wallets are vulnerable and tells users to make a new recovery phrase and move everything." }, { "slug": "safe-module-authorization-abuse-rseth-sep-2026", "title": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief", "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026", "json": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026.json", "status": "live", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum" ], "method": null, "product": "A user's Safe multisig with a custom Uniswap v4 liquidity module", "tags": [ "ethereum", "safe", "multisig", "safe-module", "uniswap-v4", "multicall", "rseth", "kelp-dao", "mev", "blockaid" ], "amountUsd": 7800000, "victims": 1, "startedAt": "2026-09-15", "closedAt": null, "updatedAt": "2026-09-15T12:00:00Z", "summary": "On 15 September 2026 an attacker abused a custom Uniswap v4 liquidity module and a Multicall helper that an Ethereum Safe multisig owner had approved, pointing the wallet's position at a malicious pool and unwrapping about 2,882 rsETH (around $7.8M). Blockaid described it as abuse of module permissions on that one Safe, not a bug in Safe itself or a stolen owner key. MEV bot Yoink front-ran the attacker and took the funds, Kelp DAO froze that address within about two hours, and whether the funds come back is unresolved. Safe owners should audit every enabled module." }, { "slug": "whale-wallet-25m-drain-aug-2026", "title": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023", "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026", "json": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026.json", "status": "live", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum" ], "method": null, "product": "Unidentified Ethereum whale wallet", "tags": [ "ethereum", "whale", "phishing", "aave", "awbtc", "peckshield", "repeat-victim" ], "amountUsd": 25600000, "victims": 1, "startedAt": "2026-08-12", "closedAt": null, "updatedAt": "2026-08-13T12:00:00Z", "summary": "On 12 August 2026 an unidentified whale lost about $25.6M, including about $6.3M in aWBTC, $5.1M in DAI, $4.7M in WBTC and $2.6M in ETH, according to PeckShield. Analyst Specter called it a phishing attack and PeckShield called it a hack; the exact method has not been published. The attacker swapped the funds into DAI and ETH across four addresses. The same wallet lost about $24.2M through malicious token approvals in September 2023." }, { "slug": "triple-a-hot-wallets-drained-jul-2026", "title": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON", "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026", "json": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026.json", "status": "live", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "solana", "ethereum", "tron" ], "method": null, "product": "Triple-A payment processor hot wallets", "tags": [ "solana", "ethereum", "tron", "payments", "hot-wallet", "treasury", "triple-a", "multi-chain", "peckshield" ], "amountUsd": 9700000, "victims": null, "startedAt": "2026-07-24", "closedAt": null, "updatedAt": "2026-07-25T12:00:00Z", "summary": "On Jul 24, 2026, on-chain analyst Specter flagged suspicious outflows from hot wallets of the crypto payment processor Triple-A, and PeckShield later estimated losses above $9.7 million. crypto.news lists Ethereum, Solana, TRON and TON as affected, with some reports adding Polygon and Arbitrum. The proceeds were gathered in an Ethereum address holding about 5,227 ETH. The cause had not been disclosed, and no evidence tied the breach to Triple-A's custody provider Fireblocks. Merchants and customers should rely only on Triple-A's official channels for updates." }, { "slug": "usdt-approval-phishing-999999-jul-2026", "title": "Ethereum user loses 999,999 USDT after signing a phishing token approval", "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026", "json": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026.json", "status": "closed", "severity": "high", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum" ], "method": "approval-phishing", "product": "Ethereum USDT holder", "tags": [ "ethereum", "approval-phishing", "usdt", "scam-sniffer", "multicall", "drainer" ], "amountUsd": 999999, "victims": 1, "startedAt": "2026-07-08", "closedAt": "2026-07-09", "updatedAt": "2026-07-09T12:00:00Z", "summary": "On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance." }, { "slug": "silent-swap-fake-google-notes-clipper-extension-jun-2026", "title": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses", "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026", "json": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026.json", "status": "closed", "severity": "medium", "threatStatus": "active", "verification": "verified", "chains": [ "bitcoin", "ethereum", "solana" ], "method": "clipboard-hijacker", "product": "Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)", "tags": [ "bitcoin", "ethereum", "solana", "clipboard-hijacker", "clipper", "browser-extension", "chrome", "chromium", "countloader", "mcafee", "etherhiding", "windows" ], "amountUsd": null, "victims": null, "startedAt": "2026-06-30", "closedAt": "2026-06-30", "updatedAt": "2026-06-30T12:00:00Z", "summary": "McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published." }, { "slug": "polymarket-frontend-vendor-compromise-jun-2026", "title": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained", "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026", "json": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "polygon", "ethereum" ], "method": "front-end-hijack", "product": "Polymarket web app users", "tags": [ "polygon", "ethereum", "front-end-hijack", "polymarket", "supply-chain", "third-party-vendor", "injected-script", "pusd", "prediction-market" ], "amountUsd": 3000000, "victims": null, "startedAt": "2026-06-25", "closedAt": "2026-07-01", "updatedAt": "2026-07-01T12:00:00Z", "summary": "Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users." }, { "slug": "cryptobandits-usb-worm-clipper-tor-jun-2026", "title": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor", "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026", "json": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026.json", "status": "closed", "severity": "high", "threatStatus": "active", "verification": "verified", "chains": [ "bitcoin", "ethereum", "tron" ], "method": "clipboard-hijacker", "product": "Windows users who open shortcut files from USB drives", "tags": [ "bitcoin", "ethereum", "tron", "clipboard-hijacker", "windows", "clipper", "usb-worm", "lnk", "tor", "microsoft", "cryptobandits", "seed-phrase" ], "amountUsd": null, "victims": null, "startedAt": "2026-06-17", "closedAt": "2026-06-18", "updatedAt": "2026-06-18T12:00:00Z", "summary": "Microsoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published." }, { "slug": "humanity-protocol-dev-machine-keys-jun-2026", "title": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys", "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026", "json": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026.json", "status": "closed", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum", "bsc" ], "method": "key-leak", "product": "Humanity Protocol (H token) bridges and treasury", "tags": [ "ethereum", "bsc", "key-leak", "humanity-protocol", "malware", "infostealer", "developer-machine", "gnosis-safe", "multisig", "bridge", "h-token" ], "amountUsd": 36000000, "victims": null, "startedAt": "2026-06-08", "closedAt": "2026-06-15", "updatedAt": "2026-06-15T12:00:00Z", "summary": "On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools." }, { "slug": "ill-bloom-weak-seed-randomness-drains-may-2026", "title": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included", "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026", "json": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "solana", "bitcoin", "ethereum", "polygon", "tron" ], "method": "key-leak", "product": "Seed phrases made by some less widely used mobile software wallets (2018 onward)", "tags": [ "solana", "bitcoin", "ethereum", "polygon", "tron", "key-leak", "weak-randomness", "prng", "seed-phrase", "mobile-wallet", "coinspect", "ill-bloom" ], "amountUsd": 5000000, "victims": 431, "startedAt": "2026-05-27", "closedAt": "2026-07-06", "updatedAt": "2026-07-06T12:00:00Z", "summary": "Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet." }, { "slug": "stablr-1of3-multisig-key-may-2026", "title": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key", "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026", "json": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026.json", "status": "closed", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum" ], "method": "key-leak", "product": "StablR EURR and USDR stablecoins and holders", "tags": [ "ethereum", "key-leak", "stablr", "eurr", "usdr", "stablecoin", "multisig", "1-of-3", "private-key-compromise", "depeg" ], "amountUsd": 2800000, "victims": null, "startedAt": "2026-05-23", "closedAt": "2026-05-24", "updatedAt": "2026-05-24T12:00:00Z", "summary": "On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum." }, { "slug": "sigma-telegram-bot-wallets-key-leak-200k-may-2026", "title": "Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak", "url": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026", "json": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum", "base", "bsc" ], "method": "key-leak", "product": "SIGMA Telegram trading bot wallets (one trader)", "tags": [ "ethereum", "base", "bsc", "key-leak", "sigma", "telegram-bot", "trading-bot", "private-key", "fake-captcha" ], "amountUsd": 200000, "victims": 1, "startedAt": "2026-05-11", "closedAt": "2026-05-11", "updatedAt": "2026-05-11T12:00:00Z", "summary": "On 11 May 2026 a crypto trader lost over $200,000 across Ethereum, Base and BSC from two wallets created by the SIGMA Telegram trading bot; the largest losses were about $125,000 in POD on Base and $21,000 in FHE on BSC. An on-chain analyst said the drain used the private keys directly, with no token approval involved, while the victim's other wallets were untouched. The cause is unconfirmed; suggestions include fake CAPTCHA bots in Telegram, infostealer malware or a device compromise. Users of bot-generated wallets should keep balances small and never run 'verification' steps a Telegram bot asks for." }, { "slug": "wasabi-protocol-deployer-key-apr-2026", "title": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key", "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026", "json": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum", "base" ], "method": "key-leak", "product": "Wasabi Protocol vaults and LP holders (Ethereum, Base)", "tags": [ "ethereum", "base", "key-leak", "wasabi-protocol", "admin-key", "deployer-key", "proxy-upgrade", "perps", "blockaid" ], "amountUsd": 4550000, "victims": null, "startedAt": "2026-04-30", "closedAt": "2026-04-30", "updatedAt": "2026-04-30T12:00:00Z", "summary": "On 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts." }, { "slug": "cow-swap-dns-hijack-apr-2026", "title": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals", "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026", "json": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum" ], "method": "front-end-hijack", "product": "CoW Swap (swap.cow.fi) users", "tags": [ "ethereum", "front-end-hijack", "cow-swap", "dns-hijack", "registrar", "social-engineering", "approval-phishing", "dex" ], "amountUsd": 1200000, "victims": null, "startedAt": "2026-04-14", "closedAt": "2026-05-13", "updatedAt": "2026-05-13T12:00:00Z", "summary": "On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered." }, { "slug": "fake-ledger-live-mac-app-store-9-5m-apr-2026", "title": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts", "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026", "json": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026.json", "status": "closed", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "bitcoin", "ethereum", "tron", "solana" ], "method": "fake-app", "product": "Ledger users who installed 'Ledger Live' from the Mac App Store", "tags": [ "bitcoin", "ethereum", "tron", "solana", "fake-app", "ledger", "app-store", "macos", "apple", "seed-phrase", "zachxbt", "kucoin" ], "amountUsd": 9500000, "victims": 50, "startedAt": "2026-04-08", "closedAt": "2026-04-15", "updatedAt": "2026-04-15T12:00:00Z", "summary": "A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase." }, { "slug": "npm-galedonovan-solana-key-stealers-mar-2026", "title": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys", "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026", "json": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026.json", "status": "closed", "severity": "medium", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "solana", "ethereum" ], "method": "supply-chain", "product": "npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd", "tags": [ "solana", "ethereum", "supply-chain", "npm", "typosquat", "bs58", "base58", "telegram-c2", "developers", "raydium" ], "amountUsd": null, "victims": null, "startedAt": "2026-03-26", "closedAt": "2026-03-26", "updatedAt": "2026-03-26T12:00:00Z", "summary": "In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds." }, { "slug": "resolv-usr-minting-key-compromise-mar-2026", "title": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens", "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026", "json": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum" ], "method": "key-leak", "product": "Resolv Labs USR stablecoin and holders", "tags": [ "ethereum", "key-leak", "resolv", "usr", "stablecoin", "depeg", "private-key-compromise", "off-chain-signer", "minting" ], "amountUsd": 24500000, "victims": null, "startedAt": "2026-03-21", "closedAt": "2026-04-01", "updatedAt": "2026-04-01T12:00:00Z", "summary": "On 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery." }, { "slug": "iotex-iotube-bridge-key-compromise-feb-2026", "title": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026", "json": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026.json", "status": "closed", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum" ], "method": "key-leak", "product": "IoTeX ioTube bridge (Ethereum side)", "tags": [ "ethereum", "key-leak", "iotex", "iotube", "bridge", "social-engineering", "validator-key", "malicious-upgrade" ], "amountUsd": 4400000, "victims": null, "startedAt": "2026-02-21", "closedAt": "2026-02-24", "updatedAt": "2026-03-28T12:00:00Z", "summary": "On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users." }, { "slug": "address-poisoning-4556-eth-jan-2026", "title": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier", "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026", "json": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum" ], "method": "address-poisoning", "product": "Ethereum whale wallet", "tags": [ "ethereum", "address-poisoning", "eth", "dusting", "lookalike-address", "tornado-cash", "scam-sniffer", "whale" ], "amountUsd": 12250000, "victims": 1, "startedAt": "2026-01-30", "closedAt": "2026-01-31", "updatedAt": "2026-01-31T12:00:00Z", "summary": "On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss." }, { "slug": "address-poisoning-514k-usdt-jan-2026", "title": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer", "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026", "json": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026.json", "status": "closed", "severity": "high", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum" ], "method": "address-poisoning", "product": "Ethereum USDT holder", "tags": [ "ethereum", "address-poisoning", "usdt", "test-transaction", "lookalike-address", "cyvers" ], "amountUsd": 514000, "victims": 1, "startedAt": "2026-01-16", "closedAt": "2026-01-16", "updatedAt": "2026-01-16T12:00:00Z", "summary": "On 16 January 2026 a victim sent a 5,000 USDT test transfer and, two minutes later, 509,000 USDT to a lookalike Ethereum address planted by an address-poisoning scammer, a total loss of about $514,000. The intended address ended in D3E6F; the fake ended in f3e6F and differed only in the middle characters wallets usually hide. Cyvers flagged the theft." }, { "slug": "permit-phishing-1-08m-aethlbtc-jan-2026", "title": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature", "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026", "json": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum" ], "method": "permit-phishing", "product": "An Aave aEthLBTC holder", "tags": [ "ethereum", "permit-phishing", "permit", "aave", "lbtc", "atoken", "tornado-cash", "scam-sniffer", "slowmist" ], "amountUsd": 1080000, "victims": 1, "startedAt": "2026-01-03", "closedAt": "2026-01-03", "updatedAt": "2026-01-03T12:00:00Z", "summary": "A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders." }, { "slug": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "title": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025", "json": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "solana", "bitcoin", "ethereum" ], "method": "malicious-extension", "product": "Trust Wallet Chrome extension v2.68", "tags": [ "solana", "bitcoin", "ethereum", "malicious-extension", "trust-wallet", "browser-extension", "chrome-web-store", "seed-phrase", "leaked-api-key", "wallet", "supply-chain", "shai-hulud", "npm", "seed-phrase-theft" ], "amountUsd": 8500000, "victims": 2520, "startedAt": "2025-12-24", "closedAt": "2025-12-25", "updatedAt": "2025-12-31T12:00:00Z", "summary": "A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected." }, { "slug": "address-poisoning-50m-usdt-dec-2025", "title": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history", "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025", "json": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum" ], "method": "address-poisoning", "product": "Ethereum USDT holder (funds withdrawn from Binance)", "tags": [ "ethereum", "address-poisoning", "usdt", "test-transaction", "lookalike-address", "tornado-cash", "binance-withdrawal" ], "amountUsd": 49999950, "victims": 1, "startedAt": "2025-12-20", "closedAt": "2025-12-20", "updatedAt": "2025-12-20T12:00:00Z", "summary": "On 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end." }, { "slug": "permit-phishing-440k-usdc-dec-2025", "title": "Ethereum user loses $440K in USDC after signing a malicious permit", "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025", "json": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum" ], "method": "permit-phishing", "product": "An Ethereum USDC holder", "tags": [ "ethereum", "permit-phishing", "permit", "erc-2612", "usdc", "scam-sniffer", "signature-phishing" ], "amountUsd": 440358, "victims": 1, "startedAt": "2025-12-08", "closedAt": "2025-12-08", "updatedAt": "2025-12-09T12:00:00Z", "summary": "An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions." }, { "slug": "whale-safe-1of1-key-compromise-nov-2025", "title": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash", "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025", "json": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum" ], "method": "key-leak", "product": "Private whale's Gnosis Safe multisig (Ethereum)", "tags": [ "ethereum", "key-leak", "gnosis-safe", "multisig", "private-key-compromise", "aave", "tornado-cash", "whale" ], "amountUsd": 27300000, "victims": 1, "startedAt": "2025-11-04", "closedAt": "2026-01-06", "updatedAt": "2026-01-06T12:00:00Z", "summary": "A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key." }, { "slug": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "title": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend", "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "json": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-lure", "note": "The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account." }, "chains": [ "ethereum" ], "method": "social-engineering", "product": "THORChain co-founder's personal wallet", "tags": [ "ethereum", "social-engineering", "dprk", "deepfake", "zoom", "fake-meeting", "telegram", "account-takeover", "metamask", "zachxbt", "thorchain", "thorswap", "ai" ], "amountUsd": 1350000, "victims": 1, "startedAt": "2025-09-04", "closedAt": "2025-09-12", "updatedAt": "2025-09-12T12:00:00Z", "summary": "In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected." }, { "slug": "cursor-contractshark-solidity-extension-dev-key-theft-aug-2025", "title": "Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key", "url": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025", "json": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025.json", "status": "closed", "severity": "medium", "threatStatus": "partly-contained", "verification": "verified", "ai": { "role": "agent-target", "note": "The key-stealing extension was installed in Cursor, the AI code editor the developer used as a coding assistant; it read the .env file rather than abusing the AI itself." }, "chains": [ "ethereum" ], "method": "supply-chain", "product": "Cursor AI code editor users", "tags": [ "ethereum", "supply-chain", "cursor", "ai-code-editor", "malicious-extension", "solidity", "env-file", "private-key", "developers", "ai" ], "amountUsd": null, "victims": 1, "startedAt": "2025-08-13", "closedAt": "2025-08-13", "updatedAt": "2025-08-13T12:00:00Z", "summary": "Cointelegraph reported on 13 August 2025 that an Ethereum core developer's hot wallet was drained after he installed 'contractshark.solidity-lang', a fake Solidity extension for the Cursor AI code editor with over 54,000 downloads. The extension read his .env file and sent the private key to the attacker, who waited three days before emptying the wallet. The loss was a few hundred dollars because he kept only test funds there and his main holdings on hardware wallets. Keep keys out of .env files on development machines and use small, separate test wallets." }, { "slug": "ai-video-mev-bot-tutorials-drainer-contracts-aug-2025", "title": "YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken", "url": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025", "json": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025.json", "status": "closed", "severity": "high", "threatStatus": "active", "verification": "verified", "ai": { "role": "ai-lure", "note": "SentinelLABS says several tutorial videos appear to be AI-generated from audio and visual tells, though the most successful one (about $902,000 taken) does not appear to be." }, "chains": [ "ethereum" ], "method": "social-engineering", "product": "Ethereum users following YouTube 'MEV bot' tutorials", "tags": [ "ethereum", "social-engineering", "mev-bot", "fake-trading-bot", "youtube", "remix", "smart-contract-scam", "ai-generated-video", "sentinelone", "ai" ], "amountUsd": 900000, "victims": null, "startedAt": "2025-08-05", "closedAt": "2025-08-05", "updatedAt": "2025-08-05T12:00:00Z", "summary": "SentinelLABS reported in August 2025 that scammers use YouTube tutorials to get people to deploy a 'free' Ethereum arbitrage bot contract through Remix, fund it with ETH and press Start. Hidden code sends the ETH to an attacker wallet, and the top attacker address alone received 244.9 ETH (about $902,000). The videos ran on aged channels with manipulated comments, and SentinelLABS says several appear to be AI-generated. Versions of the scam have run since at least early 2024 and were described as ongoing." } ], "changes": [ { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-16", "title": "Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.", "sourceUrl": "https://rekt.news/factory-sealed", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "bitget-hot-wallet-breach-zero-day-sep-2026", "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-10-15", "title": "Hacken's Q3 data showed about $387M covered by Bitget's user protection fund; Circle and Tether froze about $340,000 tied to the theft.", "sourceUrl": "https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3", "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026" }, { "incident": "eip-7702-delegation-drain-22k-oct-2026", "incidentTitle": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-10-14", "title": "Attacker submits a sponsored type-4 transaction using the victim's earlier EIP-7702 authorization and drains 9.1231 ETH plus TAPEETH.", "sourceUrl": "https://etherscan.io/tx/0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee", "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026" }, { "incident": "eip-7702-delegation-drain-22k-oct-2026", "incidentTitle": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-10-14", "title": "ExVul flags the drain and says the malicious delegation is still active; crypto.news reports it.", "sourceUrl": "https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/", "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-14", "title": "Ledger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-13", "title": "Ledger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-11", "title": "Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.", "sourceUrl": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-10", "title": "Ledger confirmed that at least one affected device contained an unauthorized hardware implant.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-09", "title": "Coordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.", "sourceUrl": "https://rekt.news/factory-sealed", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "ledger-cryptobilis-tampered-hardware-wallets", "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-10-09", "title": "Ledger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/", "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets" }, { "incident": "duelbits-hot-wallet-drain-sep-2026", "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-10-06", "title": "Rekt reported that no root-cause report had been published, traced about $6.07M, and noted an earlier $4.6M Duelbits hot-wallet breach in February 2024.", "sourceUrl": "https://rekt.news/duelbits-rekt", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026" }, { "incident": "permit2-phishing-link-167k-oct-2026", "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK", "severity": "high", "status": "live", "threatStatus": "active", "date": "2026-10-04", "title": "Scam Sniffer flagged the loss and PANews relayed it.", "sourceUrl": "https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72", "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026" }, { "incident": "permit2-phishing-link-167k-oct-2026", "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK", "severity": "high", "status": "live", "threatStatus": "active", "date": "2026-10-03", "title": "The attacker used the victim's old Permit2 phishing approval to move $167,342 in LINK.", "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/", "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026" }, { "incident": "bitget-hot-wallet-breach-zero-day-sep-2026", "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-10-01", "title": "The confirmed loss was put at $387.5 million, up from the first estimate of $351.6 million.", "sourceUrl": "https://crypto.news/crypto-loses-768m-in-worst-hack-month-of-2026/", "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026" }, { "incident": "bitget-hot-wallet-breach-zero-day-sep-2026", "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-09-28", "title": "Bitget resumed Bitcoin withdrawals.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/", "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026" }, { "incident": "dcent-app-wallet-seed-compromise-sep-2026", "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-28", "title": "Protos reported more than 7,000 wallets drained, over $18M stolen and 6.3M XRP moved to Ethereum via THORChain, with no recoveries.", "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026" }, { "incident": "duelbits-hot-wallet-drain-sep-2026", "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-09-27", "title": "Duelbits reopened at 05:04 UTC with deposits and withdrawals enabled.", "sourceUrl": "https://rekt.news/duelbits-rekt", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026" }, { "incident": "bitget-hot-wallet-breach-zero-day-sep-2026", "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-09-25", "title": "A custom withdrawal tool drained hot and warm wallets over nearly three hours after midnight (UTC+8); Bitget suspended withdrawals.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/", "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026" }, { "incident": "singularitynet-bridge-signing-key-compromise-sep-2026", "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-09-25", "title": "Rekt reported SingularityNET had revoked the access, shut the bridges and converters, paused AGIX and NTX transfers on Ethereum and planned to retire AGIX; the attacker's hub still held about 433 ETH.", "sourceUrl": "https://rekt.news/singularitynet-rekt", "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026" }, { "incident": "bitget-hot-wallet-breach-zero-day-sep-2026", "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-09-24", "title": "Per Mandiant, the attacker gained privileged access to two third-party security appliances, then reached the wallet job server and deployed malicious packages.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/", "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026" }, { "incident": "duelbits-hot-wallet-drain-sep-2026", "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-09-24", "title": "Duelbits hot wallets were drained across five chains; Scam Sniffer called it a suspected private-key compromise and SlowMist listed private key leakage.", "sourceUrl": "https://rekt.news/duelbits-rekt", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026" }, { "incident": "dcent-app-wallet-seed-compromise-sep-2026", "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-21", "title": "Drains continued, with 640,370 more XRP taken after 21 September.", "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026" }, { "incident": "singularitynet-bridge-signing-key-compromise-sep-2026", "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-09-20", "title": "Unauthorized minting began around 03:13 UTC, creating about 2.3 billion AGIX, NTX, WMTX and CGV.", "sourceUrl": "https://rekt.news/singularitynet-rekt", "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026" }, { "incident": "singularitynet-bridge-signing-key-compromise-sep-2026", "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-09-19", "title": "A compromised authorizer signature released 8,721,530.40 FET from the bridge, cleared at 20:21 UTC, which the attacker swapped for 522.78 ETH.", "sourceUrl": "https://rekt.news/singularitynet-rekt", "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026" }, { "incident": "dcent-app-wallet-seed-compromise-sep-2026", "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-17", "title": "D'CENT's status report said its latest app includes a check to show users whether they need to act.", "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026" }, { "incident": "dcent-app-wallet-seed-compromise-sep-2026", "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-15", "title": "The first of at least six drain waves (through 20 September) hit D'CENT app wallets, taking about 11.7M XRP from 6,678 wallets per xrpl.to.", "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026" }, { "incident": "safe-module-authorization-abuse-rseth-sep-2026", "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-09-15", "title": "At 04:38 UTC the attacker used the approved module to unwrap the Safe's aEthrsETH into about 2,882 rsETH; Blockaid flagged the theft.", "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/", "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026" }, { "incident": "safe-module-authorization-abuse-rseth-sep-2026", "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-09-15", "title": "MEV bot Yoink front-ran the exploit by paying the block builder about $46,000, and Kelp DAO froze the receiving address within about two hours.", "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/", "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026" }, { "incident": "bitget-hot-wallet-breach-zero-day-sep-2026", "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances", "severity": "critical", "status": "live", "threatStatus": "contained", "date": "2026-08-31", "title": "SlowMist's report traced the earliest malicious activity in Bitget's logs to 31 August.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/", "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026" }, { "incident": "whale-wallet-25m-drain-aug-2026", "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-08-13", "title": "PeckShield reported the theft and said the stolen aWBTC, DAI, WBTC and ETH were swapped into DAI and ETH and split across four addresses.", "sourceUrl": "https://u.today/crypto-hack-drains-256-million-from-unknown-victims", "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026" }, { "incident": "whale-wallet-25m-drain-aug-2026", "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-08-13", "title": "Specter described the theft as phishing; the same wallet had lost about $24.2M to malicious token approvals in September 2023.", "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/", "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026" }, { "incident": "whale-wallet-25m-drain-aug-2026", "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-08-12", "title": "The whale's wallet was drained of about $25.6M in assets.", "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/", "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026" }, { "incident": "triple-a-hot-wallets-drained-jul-2026", "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-07-25", "title": "PeckShield amplified the alert as estimates rose above $9.7M; Triple-A had not yet confirmed the breach.", "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/", "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026" }, { "incident": "triple-a-hot-wallets-drained-jul-2026", "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-07-24", "title": "Analyst Specter flagged suspicious transfers from Triple-A hot wallets, first estimated at over $9.3M.", "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/", "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026" }, { "incident": "usdt-approval-phishing-999999-jul-2026", "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval", "severity": "high", "status": "closed", "threatStatus": "active", "date": "2026-07-09", "title": "Scam Sniffer posted an alert about the loss.", "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval", "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026" }, { "incident": "usdt-approval-phishing-999999-jul-2026", "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval", "severity": "high", "status": "closed", "threatStatus": "active", "date": "2026-07-08", "title": "The victim signed a phishing token approval and the attacker pulled 999,999 USDT out in three transactions using multicalls.", "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval", "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026" }, { "incident": "ill-bloom-weak-seed-randomness-drains-may-2026", "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-07-06", "title": "Coinspect warned publicly about the Ill Bloom flaw and released a wallet checker; about $2M more had moved from exposed wallets.", "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/", "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026" }, { "incident": "polymarket-frontend-vendor-compromise-jun-2026", "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-07-01", "title": "Halborn's June review listed the vendor-driven front-end attack at about $3M stolen from site visitors.", "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026", "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026" }, { "incident": "silent-swap-fake-google-notes-clipper-extension-jun-2026", "incidentTitle": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses", "severity": "medium", "status": "closed", "threatStatus": "active", "date": "2026-06-30", "title": "eSecurity Planet reports McAfee's findings on the Silent Swap clipper extension campaign.", "sourceUrl": "https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/", "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026" }, { "incident": "polymarket-frontend-vendor-compromise-jun-2026", "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-06-26", "title": "Bubblemaps estimated about $3M stolen from fewer than 15 users; PeckShield said victims' pUSD was drained and the funds were converted to ETH.", "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/", "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026" }, { "incident": "polymarket-frontend-vendor-compromise-jun-2026", "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-06-25", "title": "Polymarket said a third-party vendor was compromised and malicious code was injected into its website; it removed the code, patched the issue and promised full refunds.", "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/", "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026" }, { "incident": "cryptobandits-usb-worm-clipper-tor-jun-2026", "incidentTitle": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor", "severity": "high", "status": "closed", "threatStatus": "active", "date": "2026-06-18", "title": "BleepingComputer reports the USB worm clipper and its address-swap and seed-phrase theft.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/", "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026" }, { "incident": "cryptobandits-usb-worm-clipper-tor-jun-2026", "incidentTitle": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor", "severity": "high", "status": "closed", "threatStatus": "active", "date": "2026-06-17", "title": "Microsoft Threat Intelligence details the Tor-based crypto clipper with worm-like USB spreading, active since February 2026.", "sourceUrl": "https://www.microsoft.com/en-us/security/blog/?p=148177", "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026" }, { "incident": "humanity-protocol-dev-machine-keys-jun-2026", "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-06-15", "title": "Halborn's analysis said malware with root access on a developer computer collected seven keys left there by an accidental backup at mainnet launch; ZachXBT questioned that explanation.", "sourceUrl": "https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026", "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026" }, { "incident": "humanity-protocol-dev-machine-keys-jun-2026", "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-06-09", "title": "Founder Terence Kwok confirmed the incident; the team halted deposits and withdrawals on the affected bridges as H fell from $0.731 to $0.0796.", "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73", "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026" }, { "incident": "humanity-protocol-dev-machine-keys-jun-2026", "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-06-08", "title": "Attackers used stolen keys to take over Safe multisigs on Ethereum (3 of 6) and BSC (3 of 5), gained ProxyAdmin control and drained about 141.2M H.", "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73", "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026" }, { "incident": "ill-bloom-weak-seed-randomness-drains-may-2026", "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-05-27", "title": "An attacker drained about $3.1M from 431 wallets whose seeds were generated with weak randomness.", "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/", "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026" }, { "incident": "stablr-1of3-multisig-key-may-2026", "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-05-24", "title": "StablR acknowledged an exploit on X about eight hours after on-chain activity stopped; Blockaid attributed it to one signer's compromised key on a 1-of-3 multisig.", "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit", "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026" }, { "incident": "stablr-1of3-multisig-key-may-2026", "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-05-23", "title": "ZachXBT flagged the exploit at 9:46 PM ET after the attacker minted 8.35M USDR and 4.5M EURR through the minting multisig.", "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit", "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026" }, { "incident": "cow-swap-dns-hijack-apr-2026", "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-05-13", "title": "Halborn's April review put user losses at about $1.2M and said the DNS registrar had been social-engineered.", "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026", "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026" }, { "incident": "sigma-telegram-bot-wallets-key-leak-200k-may-2026", "incidentTitle": "Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2026-05-11", "title": "A trader reported two SIGMA-generated wallets drained of over $200,000 on Ethereum, Base and BSC; analysts pointed to a private-key leak.", "sourceUrl": "https://www.cryptopolitan.com/crypto-trader-loses-200k-telegram-bot/", "url": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026" }, { "incident": "wasabi-protocol-deployer-key-apr-2026", "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-04-30", "title": "The attacker used the compromised wasabideployer.eth key to call grantRole and give themselves admin privileges with no delay.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise", "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026" }, { "incident": "wasabi-protocol-deployer-key-apr-2026", "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-04-30", "title": "A helper contract upgraded the perp vaults and Long Pool to malicious implementations that drained balances on Ethereum and Base; Blockaid flagged the exploit on X.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise", "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026" }, { "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026", "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-04-15", "title": "Apple removes the app and terminates the developer account; KuCoin freezes linked accounts.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/", "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026" }, { "incident": "cow-swap-dns-hijack-apr-2026", "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-04-14", "title": "CoW DAO said swap.cow.fi had been hit by a DNS hijacking, paused its backend and APIs, and told users to stay away from the site.", "sourceUrl": "https://cointelegraph.com/news/cow-swap-dao-domain-hijacking", "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026" }, { "incident": "cow-swap-dns-hijack-apr-2026", "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-04-14", "title": "A researcher estimated about $500K drained from a few addresses; CoW DAO told users to revoke all approvals made on CoW Swap after 14:54 UTC.", "sourceUrl": "https://decrypt.co/364377/ethereum-defi-exchange-cow-swap-website-compromise", "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026" }, { "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026", "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-04-14", "title": "BleepingComputer reports about $9.5M stolen from ~50 victims, traced by ZachXBT and laundered via 150+ KuCoin deposit addresses.", "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/", "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026" }, { "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026", "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-04-08", "title": "Victims who entered their recovery phrase into the fake app begin losing funds (losses ran 8-11 April).", "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/", "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026" }, { "incident": "resolv-usr-minting-key-compromise-mar-2026", "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-04-01", "title": "Halborn's March review attributed the roughly $23M loss to a compromised key of an off-chain service, with no on-chain check on mint amounts.", "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026", "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-28", "title": "IoTeX's review said bridge contracts moved to multisig governance and sensitive keys to hardware security modules; Chainalysis linked the attacker to the group behind the Infini exploit.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "npm-galedonovan-solana-key-stealers-mar-2026", "incidentTitle": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys", "severity": "medium", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-26", "title": "Cyber Press reported five 'galedonovan' npm packages that exfiltrate Solana and Ethereum private keys to a Telegram bot; four were still live.", "sourceUrl": "https://cyberpress.org/telegram-attack-targets-crypto-developers/", "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026" }, { "incident": "resolv-usr-minting-key-compromise-mar-2026", "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-03-23", "title": "Resolv temporarily paused its app and later enabled redemptions while contacting verified holders.", "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million", "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026" }, { "incident": "resolv-usr-minting-key-compromise-mar-2026", "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-03-21", "title": "Using a stolen privileged signing key, the attacker deposited roughly $100K-$200K in USDC, minted about 80M unbacked USR and traded it for about 11,408 ETH; USR fell to about 26 cents.", "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million", "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-02", "title": "IoTeX opened the ioTube Claims Portal: full stablecoin payout for losses up to $10,000, larger claims paid over 12 months.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-02-24", "title": "The IoTeX chain came back online at 06:06 UTC.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-02-21", "title": "At 01:51 UTC the attacker upgraded an ioTube Validator contract to a malicious version.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-02-21", "title": "IoTeX detected the incident at 08:01 UTC, alerted the community at 09:39 UTC, and validators suspended the IoTeX chain at 10:03 UTC.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "address-poisoning-4556-eth-jan-2026", "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-01-31", "title": "All 4,556 ETH was deposited into Tornado Cash in 56 deposits.", "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum", "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026" }, { "incident": "address-poisoning-4556-eth-jan-2026", "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-01-31", "title": "Scam Sniffer publicly reported the $12.25M address-poisoning loss.", "sourceUrl": "https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/", "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026" }, { "incident": "address-poisoning-4556-eth-jan-2026", "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-01-30", "title": "The victim sent 4,556 ETH to the lookalike 0x6d9052...2e48 instead of the intended 0x6D90CC...2E48; about 33 minutes later it was swept to a new wallet.", "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum", "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026" }, { "incident": "address-poisoning-514k-usdt-jan-2026", "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer", "severity": "high", "status": "closed", "threatStatus": "active", "date": "2026-01-16", "title": "Around 14:01 UTC the victim sent a 5,000 USDT test and then 509,000 USDT to a lookalike address.", "sourceUrl": "https://cryptonews.net/news/security/32290951/", "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026" }, { "incident": "address-poisoning-514k-usdt-jan-2026", "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer", "severity": "high", "status": "closed", "threatStatus": "active", "date": "2026-01-16", "title": "Cyvers Alerts posted a warning about the theft at 14:34 UTC.", "sourceUrl": "https://cryptonews.net/news/security/32290951/", "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026" }, { "incident": "whale-safe-1of1-key-compromise-nov-2025", "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-01-06", "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.", "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield", "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025" }, { "incident": "permit-phishing-1-08m-aethlbtc-jan-2026", "incidentTitle": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-01-03", "title": "Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.", "sourceUrl": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/", "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-31", "title": "SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.", "sourceUrl": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-27", "title": "Trust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.", "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-26", "title": "CyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.", "sourceUrl": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-25", "title": "ZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.", "sourceUrl": "https://www.theblock.co/post/383735/trust-wallet-extension-incident", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025", "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2025-12-24", "title": "Malicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.", "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims", "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025" }, { "incident": "address-poisoning-50m-usdt-dec-2025", "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-12-20", "title": "At 03:06 UTC the victim sent a 50 USDT test to the intended address; a script then created a lookalike address and sent small transfers to poison the wallet's history.", "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return", "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025" }, { "incident": "address-poisoning-50m-usdt-dec-2025", "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-12-20", "title": "At 03:32 UTC the victim copied the lookalike address from history and sent 49,999,950 USDT to it.", "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return", "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025" }, { "incident": "address-poisoning-50m-usdt-dec-2025", "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-12-20", "title": "Within 30 minutes the USDT was swapped to DAI via MetaMask Swap, converted to about 16,690 ETH, and about 16,680 ETH was deposited into Tornado Cash.", "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return", "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025" }, { "incident": "address-poisoning-50m-usdt-dec-2025", "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-12-20", "title": "The victim posted an on-chain message offering a $1M bounty for return of 98% of the funds and said a criminal case had been filed.", "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return", "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025" }, { "incident": "whale-safe-1of1-key-compromise-nov-2025", "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-12-18", "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.", "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages", "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025" }, { "incident": "permit-phishing-440k-usdc-dec-2025", "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2025-12-09", "title": "Decrypt covers the case and explains how permit scams let attackers spend tokens without an on-chain approval.", "sourceUrl": "https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams", "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025" }, { "incident": "permit-phishing-440k-usdc-dec-2025", "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2025-12-08", "title": "Scam Sniffer reports a user lost $440,358 in USDC after signing a malicious permit signature.", "sourceUrl": "https://x.com/realScamSniffer/status/1998018496635207832", "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025" }, { "incident": "whale-safe-1of1-key-compromise-nov-2025", "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-11-04", "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.", "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages", "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025" }, { "incident": "address-poisoning-4556-eth-jan-2026", "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-10-03", "title": "The first ETH dust from the lookalike address arrived; another dust ping followed on 29 January 2026.", "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum", "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026" }, { "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-09-12", "title": "The Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.", "sourceUrl": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user", "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025" }, { "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-09-12", "title": "ForkLog reported his account of seeing a deepfake of his friend on the call.", "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/", "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025" }, { "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025", "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-09-04", "title": "He received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.", "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/", "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025" }, { "incident": "cursor-contractshark-solidity-extension-dev-key-theft-aug-2025", "incidentTitle": "Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key", "severity": "medium", "status": "closed", "threatStatus": "partly-contained", "date": "2025-08-13", "title": "Cointelegraph reported that a malicious Cursor extension had taken an Ethereum core developer's private key and the hot wallet was drained the previous Sunday.", "sourceUrl": "https://cointelegraph.com/news/core-ethereum-devs-crypto-wallet-drained-ai-extension", "url": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025" }, { "incident": "ai-video-mev-bot-tutorials-drainer-contracts-aug-2025", "incidentTitle": "YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken", "severity": "high", "status": "closed", "threatStatus": "active", "date": "2025-08-05", "title": "SentinelLABS' report (updated 5 August 2025) listed three attacker addresses and more than $900,000 taken.", "sourceUrl": "https://www.sentinelone.com/labs/smart-contract-scams-ethereum-drainers-pose-as-trading-bots-to-steal-crypto/", "url": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025" }, { "incident": "address-poisoning-4556-eth-jan-2026", "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-02-25", "title": "The first forged token transfer tied to the lookalike address appeared, starting the poisoning of the victim's history.", "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum", "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026" } ] }