{
 "tag": "hardware-wallet",
 "name": "Hardware Wallet",
 "group": "Wallets & apps",
 "incidents": [
  {
   "slug": "coldcard-x-account-phishing-post-oct-2026",
   "title": "COLDCARD's X account posts fake 'security migration' phishing link",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026",
   "json": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin"
   ],
   "method": "social-engineering",
   "product": "COLDCARD hardware wallet users on X",
   "tags": [
    "bitcoin",
    "social-engineering",
    "x-account-hack",
    "coldcard",
    "hardware-wallet",
    "seed-phrase-phishing",
    "fake-security-alert",
    "fake-firmware",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-11",
   "closedAt": "2026-10-11",
   "updatedAt": "2026-10-11T12:00:00Z",
   "summary": "On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website."
  },
  {
   "slug": "ledger-cryptobilis-tampered-hardware-wallets",
   "title": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets",
   "json": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin"
   ],
   "method": "supply-chain",
   "product": "Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers",
   "tags": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin",
    "supply-chain",
    "ledger",
    "hardware-wallet",
    "cryptobilis",
    "reseller",
    "hardware-implant",
    "seed-phrase-theft",
    "tether-freeze"
   ],
   "amountUsd": 102000000,
   "victims": 324,
   "startedAt": "2026-10-09",
   "closedAt": null,
   "updatedAt": "2026-10-16T12:00:00Z",
   "summary": "Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct."
  },
  {
   "slug": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "title": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "json": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Trezor, BitBox and CoinTracking newsletter subscribers",
   "tags": [
    "bitcoin",
    "multi-evm",
    "social-engineering",
    "email-phishing",
    "seed-phishing",
    "hardware-wallet",
    "trezor",
    "bitbox",
    "cointracking",
    "brevo",
    "newsletter"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-09-09",
   "closedAt": "2026-09-11",
   "updatedAt": "2026-09-11T12:00:00Z",
   "summary": "An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses."
  }
 ],
 "changes": [
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-16",
   "title": "Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-14",
   "title": "Ledger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-13",
   "title": "Ledger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "An unauthorized post on COLDCARD's X account links to a fake 'security migration' site; COLDCARD deletes it and warns users.",
   "sourceUrl": "https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "A phishing link is posted on Coldcard's X account; Coldcard warns users, deletes the post and contacts X.",
   "sourceUrl": "https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-11",
   "title": "Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.",
   "sourceUrl": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-10",
   "title": "Ledger confirmed that at least one affected device contained an unauthorized hardware implant.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Coordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Ledger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-11",
   "title": "Cointelegraph reported about 2,500 people opened the Trezor phishing link before it was taken down, with no losses reported.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-10",
   "title": "Brevo's postmortem said 138 client accounts were accessed, six used to send phishing and contacts exported from 43.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-09",
   "title": "Trezor and BitBox warned users about unauthorized emails sent through their Brevo accounts.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  }
 ]
}