{ "tag": "key-leak", "name": "Leaked private keys and seed phrases", "group": "Drain methods", "incidents": [ { "slug": "duelbits-hot-wallet-drain-sep-2026", "title": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026", "json": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum", "bsc", "tron", "bitcoin", "solana" ], "method": "key-leak", "product": "Duelbits crypto casino hot wallets", "tags": [ "ethereum", "bsc", "tron", "bitcoin", "solana", "key-leak", "casino", "gambling", "hot-wallet", "private-key-compromise", "duelbits" ], "amountUsd": 7000000, "victims": null, "startedAt": "2026-09-24", "closedAt": "2026-09-27", "updatedAt": "2026-10-06T12:00:00Z", "summary": "On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe." }, { "slug": "singularitynet-bridge-signing-key-compromise-sep-2026", "title": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted", "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026", "json": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026.json", "status": "live", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum", "bsc" ], "method": "key-leak", "product": "SingularityNET / ASI Alliance bridge and conversion contracts (also NuNet, Cogito, Rejuve and World Mobile tokens)", "tags": [ "ethereum", "bsc", "key-leak", "bridge", "cloud-compromise", "signing-key", "unauthorized-mint", "singularitynet", "asi-alliance", "nunet", "fet", "agix" ], "amountUsd": 2290000, "victims": null, "startedAt": "2026-09-19", "closedAt": null, "updatedAt": "2026-09-25T12:00:00Z", "summary": "An unauthorized party got into part of SingularityNET's cloud infrastructure and on 19-20 September 2026 used a compromised authorizer signature and NuNet's mint authority to release 8.72M FET from a bridge and mint about 2.3 billion AGIX, NTX, WMTX and CGV. Sixteen wallets, four labelled as SingularityNET or NuNet staff, were swept before the minting. Headlines cited $16.77M, but Rekt's transaction-level count found about $2.29M in sellable proceeds because most minted tokens could not be sold. Bridges and converters are offline and AGIX is being replaced, so holders should wait for official migration steps." }, { "slug": "dcent-app-wallet-seed-compromise-sep-2026", "title": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026", "json": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026.json", "status": "live", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum", "tron", "bitcoin" ], "method": "key-leak", "product": "D'CENT mobile App Wallet users (wallets created in the app)", "tags": [ "ethereum", "tron", "bitcoin", "key-leak", "dcent", "iotrust", "mobile-wallet", "seed-phrase", "xrp", "thorchain" ], "amountUsd": 18000000, "victims": 6678, "startedAt": "2026-09-15", "closedAt": null, "updatedAt": "2026-09-28T12:00:00Z", "summary": "From 15 to 20 September 2026 thieves emptied at least 6,678 wallets created in the D'CENT mobile app in six waves, taking about 11.7M XRP, and kept draining after 21 September for a total above 12.4M XRP (over $18M per Protos). D'CENT's own disclosure also named Bitcoin, Tron and Ethereum, and the stolen XRP was moved to Ethereum through THORChain. The cause is compromised recovery phrases for wallets made in the app; how they leaked has not been explained. D'CENT says app-created wallets are vulnerable and tells users to make a new recovery phrase and move everything." }, { "slug": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026", "title": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server", "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026", "json": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026.json", "status": "live", "severity": "medium", "threatStatus": "active", "verification": "verified", "ai": { "role": "agent-target", "note": "The package is an MCP server for AI agents, and it sends the wallet key configured for agent auto-payments to a remote server on each tool call." }, "chains": [ "base" ], "method": "key-leak", "product": "gadgethumans-mcp (npm)", "tags": [ "base", "key-leak", "mcp", "mcp-server", "npm", "x402", "ai-agent", "agent-payments", "private-key", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2026-09-08", "closedAt": null, "updatedAt": "2026-09-08T12:00:00Z", "summary": "Knostic reported on 8 September 2026 that gadgethumans-mcp, an npm MCP server that promises AI agents automatic x402 micropayments, asks users to set a wallet private key but does no local signing. Instead it copies the raw key into a request header and sends it to a remote endpoint on every recognized tool call, which would let whoever receives it take over the wallet. The package had 2,327 downloads in July and August 2026 and was still on npm when the report came out; Knostic found no confirmed thefts. Anyone who set a key in it should move funds and use a fresh, low-balance wallet." }, { "slug": "humanity-protocol-dev-machine-keys-jun-2026", "title": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys", "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026", "json": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026.json", "status": "closed", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum", "bsc" ], "method": "key-leak", "product": "Humanity Protocol (H token) bridges and treasury", "tags": [ "ethereum", "bsc", "key-leak", "humanity-protocol", "malware", "infostealer", "developer-machine", "gnosis-safe", "multisig", "bridge", "h-token" ], "amountUsd": 36000000, "victims": null, "startedAt": "2026-06-08", "closedAt": "2026-06-15", "updatedAt": "2026-06-15T12:00:00Z", "summary": "On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools." }, { "slug": "ill-bloom-weak-seed-randomness-drains-may-2026", "title": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included", "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026", "json": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "solana", "bitcoin", "ethereum", "polygon", "tron" ], "method": "key-leak", "product": "Seed phrases made by some less widely used mobile software wallets (2018 onward)", "tags": [ "solana", "bitcoin", "ethereum", "polygon", "tron", "key-leak", "weak-randomness", "prng", "seed-phrase", "mobile-wallet", "coinspect", "ill-bloom" ], "amountUsd": 5000000, "victims": 431, "startedAt": "2026-05-27", "closedAt": "2026-07-06", "updatedAt": "2026-07-06T12:00:00Z", "summary": "Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet." }, { "slug": "stablr-1of3-multisig-key-may-2026", "title": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key", "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026", "json": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026.json", "status": "closed", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum" ], "method": "key-leak", "product": "StablR EURR and USDR stablecoins and holders", "tags": [ "ethereum", "key-leak", "stablr", "eurr", "usdr", "stablecoin", "multisig", "1-of-3", "private-key-compromise", "depeg" ], "amountUsd": 2800000, "victims": null, "startedAt": "2026-05-23", "closedAt": "2026-05-24", "updatedAt": "2026-05-24T12:00:00Z", "summary": "On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum." }, { "slug": "sigma-telegram-bot-wallets-key-leak-200k-may-2026", "title": "Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak", "url": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026", "json": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum", "base", "bsc" ], "method": "key-leak", "product": "SIGMA Telegram trading bot wallets (one trader)", "tags": [ "ethereum", "base", "bsc", "key-leak", "sigma", "telegram-bot", "trading-bot", "private-key", "fake-captcha" ], "amountUsd": 200000, "victims": 1, "startedAt": "2026-05-11", "closedAt": "2026-05-11", "updatedAt": "2026-05-11T12:00:00Z", "summary": "On 11 May 2026 a crypto trader lost over $200,000 across Ethereum, Base and BSC from two wallets created by the SIGMA Telegram trading bot; the largest losses were about $125,000 in POD on Base and $21,000 in FHE on BSC. An on-chain analyst said the drain used the private keys directly, with no token approval involved, while the victim's other wallets were untouched. The cause is unconfirmed; suggestions include fake CAPTCHA bots in Telegram, infostealer malware or a device compromise. Users of bot-generated wallets should keep balances small and never run 'verification' steps a Telegram bot asks for." }, { "slug": "wasabi-protocol-deployer-key-apr-2026", "title": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key", "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026", "json": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum", "base" ], "method": "key-leak", "product": "Wasabi Protocol vaults and LP holders (Ethereum, Base)", "tags": [ "ethereum", "base", "key-leak", "wasabi-protocol", "admin-key", "deployer-key", "proxy-upgrade", "perps", "blockaid" ], "amountUsd": 4550000, "victims": null, "startedAt": "2026-04-30", "closedAt": "2026-04-30", "updatedAt": "2026-04-30T12:00:00Z", "summary": "On 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts." }, { "slug": "resolv-usr-minting-key-compromise-mar-2026", "title": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens", "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026", "json": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "ethereum" ], "method": "key-leak", "product": "Resolv Labs USR stablecoin and holders", "tags": [ "ethereum", "key-leak", "resolv", "usr", "stablecoin", "depeg", "private-key-compromise", "off-chain-signer", "minting" ], "amountUsd": 24500000, "victims": null, "startedAt": "2026-03-21", "closedAt": "2026-04-01", "updatedAt": "2026-04-01T12:00:00Z", "summary": "On 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery." }, { "slug": "iotex-iotube-bridge-key-compromise-feb-2026", "title": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026", "json": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026.json", "status": "closed", "severity": "critical", "threatStatus": "partly-contained", "verification": "verified", "chains": [ "ethereum" ], "method": "key-leak", "product": "IoTeX ioTube bridge (Ethereum side)", "tags": [ "ethereum", "key-leak", "iotex", "iotube", "bridge", "social-engineering", "validator-key", "malicious-upgrade" ], "amountUsd": 4400000, "victims": null, "startedAt": "2026-02-21", "closedAt": "2026-02-24", "updatedAt": "2026-03-28T12:00:00Z", "summary": "On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users." }, { "slug": "step-finance-treasury-drain-jan-2026", "title": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down", "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026", "json": "https://drains.watch/i/step-finance-treasury-drain-jan-2026.json", "status": "closed", "severity": "critical", "threatStatus": "contained", "verification": "verified", "chains": [ "solana" ], "method": "key-leak", "product": "Step Finance treasury and fee wallets", "tags": [ "solana", "key-leak", "treasury", "team-wallet", "private-key", "step-finance", "solanafloor", "remora", "staking" ], "amountUsd": 40000000, "victims": null, "startedAt": "2026-01-31", "closedAt": "2026-01-31", "updatedAt": "2026-02-23T12:00:00Z", "summary": "On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption." }, { "slug": "polycule-polymarket-telegram-bot-hack-jan-2026", "title": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds", "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026", "json": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "chains": [ "polygon" ], "method": "key-leak", "product": "Polycule Telegram trading bot users (Polymarket, Polygon)", "tags": [ "polygon", "key-leak", "polycule", "polymarket", "telegram-bot", "custodial-bot", "trading-bot" ], "amountUsd": 230000, "victims": null, "startedAt": "2026-01-13", "closedAt": "2026-01-14", "updatedAt": "2026-01-14T12:00:00Z", "summary": "Polycule, a Telegram bot for trading on Polymarket, confirmed on 13 Jan 2026 that it had been hacked and that about $230,000 of user funds held in bot-managed Polygon wallets was taken. The team took the bot offline and promised a patch and compensation; no official root cause was published, and some rivals called it a rug pull. Custodial Telegram bots keep users' private keys on their own servers, so one breach can drain every user at once. Keep only small trading balances in any bot wallet." }, { "slug": "whale-safe-1of1-key-compromise-nov-2025", "title": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash", "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025", "json": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json", "status": "closed", "severity": "critical", "threatStatus": "active", "verification": "verified", "chains": [ "ethereum" ], "method": "key-leak", "product": "Private whale's Gnosis Safe multisig (Ethereum)", "tags": [ "ethereum", "key-leak", "gnosis-safe", "multisig", "private-key-compromise", "aave", "tornado-cash", "whale" ], "amountUsd": 27300000, "victims": 1, "startedAt": "2025-11-04", "closedAt": "2026-01-06", "updatedAt": "2026-01-06T12:00:00Z", "summary": "A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key." } ], "changes": [ { "incident": "duelbits-hot-wallet-drain-sep-2026", "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-10-06", "title": "Rekt reported that no root-cause report had been published, traced about $6.07M, and noted an earlier $4.6M Duelbits hot-wallet breach in February 2024.", "sourceUrl": "https://rekt.news/duelbits-rekt", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026" }, { "incident": "dcent-app-wallet-seed-compromise-sep-2026", "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-28", "title": "Protos reported more than 7,000 wallets drained, over $18M stolen and 6.3M XRP moved to Ethereum via THORChain, with no recoveries.", "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026" }, { "incident": "duelbits-hot-wallet-drain-sep-2026", "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-09-27", "title": "Duelbits reopened at 05:04 UTC with deposits and withdrawals enabled.", "sourceUrl": "https://rekt.news/duelbits-rekt", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026" }, { "incident": "singularitynet-bridge-signing-key-compromise-sep-2026", "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-09-25", "title": "Rekt reported SingularityNET had revoked the access, shut the bridges and converters, paused AGIX and NTX transfers on Ethereum and planned to retire AGIX; the attacker's hub still held about 433 ETH.", "sourceUrl": "https://rekt.news/singularitynet-rekt", "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026" }, { "incident": "duelbits-hot-wallet-drain-sep-2026", "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-09-24", "title": "Duelbits hot wallets were drained across five chains; Scam Sniffer called it a suspected private-key compromise and SlowMist listed private key leakage.", "sourceUrl": "https://rekt.news/duelbits-rekt", "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026" }, { "incident": "dcent-app-wallet-seed-compromise-sep-2026", "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-21", "title": "Drains continued, with 640,370 more XRP taken after 21 September.", "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026" }, { "incident": "singularitynet-bridge-signing-key-compromise-sep-2026", "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-09-20", "title": "Unauthorized minting began around 03:13 UTC, creating about 2.3 billion AGIX, NTX, WMTX and CGV.", "sourceUrl": "https://rekt.news/singularitynet-rekt", "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026" }, { "incident": "singularitynet-bridge-signing-key-compromise-sep-2026", "incidentTitle": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted", "severity": "critical", "status": "live", "threatStatus": "partly-contained", "date": "2026-09-19", "title": "A compromised authorizer signature released 8,721,530.40 FET from the bridge, cleared at 20:21 UTC, which the attacker swapped for 522.78 ETH.", "sourceUrl": "https://rekt.news/singularitynet-rekt", "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026" }, { "incident": "dcent-app-wallet-seed-compromise-sep-2026", "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-17", "title": "D'CENT's status report said its latest app includes a check to show users whether they need to act.", "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026" }, { "incident": "dcent-app-wallet-seed-compromise-sep-2026", "incidentTitle": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron", "severity": "critical", "status": "live", "threatStatus": "active", "date": "2026-09-15", "title": "The first of at least six drain waves (through 20 September) hit D'CENT app wallets, taking about 11.7M XRP from 6,678 wallets per xrpl.to.", "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/", "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026" }, { "incident": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026", "incidentTitle": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-09-08", "title": "Knostic published its analysis showing the package sends the raw wallet key to a remote endpoint.", "sourceUrl": "https://www.knostic.ai/blog/when-auto-signing-sends-your-wallet-private-key-to-a-remote-server-a-malicious-mcp-package-on-npm", "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026" }, { "incident": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026", "incidentTitle": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-08-02", "title": "Version 1.0.9 of gadgethumans-mcp, one of the versions Knostic analyzed, was published to npm.", "sourceUrl": "https://www.knostic.ai/blog/when-auto-signing-sends-your-wallet-private-key-to-a-remote-server-a-malicious-mcp-package-on-npm", "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026" }, { "incident": "ill-bloom-weak-seed-randomness-drains-may-2026", "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-07-06", "title": "Coinspect warned publicly about the Ill Bloom flaw and released a wallet checker; about $2M more had moved from exposed wallets.", "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/", "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026" }, { "incident": "humanity-protocol-dev-machine-keys-jun-2026", "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-06-15", "title": "Halborn's analysis said malware with root access on a developer computer collected seven keys left there by an accidental backup at mainnet launch; ZachXBT questioned that explanation.", "sourceUrl": "https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026", "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026" }, { "incident": "humanity-protocol-dev-machine-keys-jun-2026", "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-06-09", "title": "Founder Terence Kwok confirmed the incident; the team halted deposits and withdrawals on the affected bridges as H fell from $0.731 to $0.0796.", "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73", "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026" }, { "incident": "humanity-protocol-dev-machine-keys-jun-2026", "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-06-08", "title": "Attackers used stolen keys to take over Safe multisigs on Ethereum (3 of 6) and BSC (3 of 5), gained ProxyAdmin control and drained about 141.2M H.", "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73", "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026" }, { "incident": "ill-bloom-weak-seed-randomness-drains-may-2026", "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-05-27", "title": "An attacker drained about $3.1M from 431 wallets whose seeds were generated with weak randomness.", "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/", "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026" }, { "incident": "stablr-1of3-multisig-key-may-2026", "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-05-24", "title": "StablR acknowledged an exploit on X about eight hours after on-chain activity stopped; Blockaid attributed it to one signer's compromised key on a 1-of-3 multisig.", "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit", "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026" }, { "incident": "stablr-1of3-multisig-key-may-2026", "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-05-23", "title": "ZachXBT flagged the exploit at 9:46 PM ET after the attacker minted 8.35M USDR and 4.5M EURR through the minting multisig.", "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit", "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026" }, { "incident": "sigma-telegram-bot-wallets-key-leak-200k-may-2026", "incidentTitle": "Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2026-05-11", "title": "A trader reported two SIGMA-generated wallets drained of over $200,000 on Ethereum, Base and BSC; analysts pointed to a private-key leak.", "sourceUrl": "https://www.cryptopolitan.com/crypto-trader-loses-200k-telegram-bot/", "url": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026" }, { "incident": "wasabi-protocol-deployer-key-apr-2026", "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-04-30", "title": "The attacker used the compromised wasabideployer.eth key to call grantRole and give themselves admin privileges with no delay.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise", "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026" }, { "incident": "wasabi-protocol-deployer-key-apr-2026", "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-04-30", "title": "A helper contract upgraded the perp vaults and Long Pool to malicious implementations that drained balances on Ethereum and Base; Blockaid flagged the exploit on X.", "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise", "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026" }, { "incident": "resolv-usr-minting-key-compromise-mar-2026", "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-04-01", "title": "Halborn's March review attributed the roughly $23M loss to a compromised key of an off-chain service, with no on-chain check on mint amounts.", "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026", "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-28", "title": "IoTeX's review said bridge contracts moved to multisig governance and sensitive keys to hardware security modules; Chainalysis linked the attacker to the group behind the Infini exploit.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "resolv-usr-minting-key-compromise-mar-2026", "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-03-23", "title": "Resolv temporarily paused its app and later enabled redemptions while contacting verified holders.", "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million", "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026" }, { "incident": "resolv-usr-minting-key-compromise-mar-2026", "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-03-21", "title": "Using a stolen privileged signing key, the attacker deposited roughly $100K-$200K in USDC, minted about 80M unbacked USR and traded it for about 11,408 ETH; USR fell to about 26 cents.", "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million", "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-02", "title": "IoTeX opened the ioTube Claims Portal: full stablecoin payout for losses up to $10,000, larger claims paid over 12 months.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-02-24", "title": "The IoTeX chain came back online at 06:06 UTC.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "step-finance-treasury-drain-jan-2026", "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-02-23", "title": "Step Finance said it would end operations along with SolanaFloor and Remora Markets after the roughly $40M loss.", "sourceUrl": "https://www.theblock.co/post/390964/step-finance-shuts-down", "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-02-21", "title": "At 01:51 UTC the attacker upgraded an ioTube Validator contract to a malicious version.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "iotex-iotube-bridge-key-compromise-feb-2026", "incidentTitle": "IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine", "severity": "critical", "status": "closed", "threatStatus": "partly-contained", "date": "2026-02-21", "title": "IoTeX detected the incident at 08:01 UTC, alerted the community at 09:39 UTC, and validators suspended the IoTeX chain at 10:03 UTC.", "sourceUrl": "https://iotex.io/blog/how-iotex-responded-to-the-iotube-bridge-incident-a-full-month-in-review/", "url": "https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026" }, { "incident": "step-finance-treasury-drain-jan-2026", "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down", "severity": "critical", "status": "closed", "threatStatus": "contained", "date": "2026-01-31", "title": "Step Finance reported a breach of some treasury wallets; CertiK reported 261,854 SOL (about $27M) unstaked and transferred.", "sourceUrl": "https://cointelegraph.com/news/step-finance-solanafloor-remora-markets-wind-down-operations", "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026" }, { "incident": "polycule-polymarket-telegram-bot-hack-jan-2026", "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2026-01-14", "title": "Odaily published an ExVul Security analysis of the risks of custodial prediction-market bots.", "sourceUrl": "https://www.odaily.news/en/post/5208756", "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026" }, { "incident": "polycule-polymarket-telegram-bot-hack-jan-2026", "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2026-01-13", "title": "Polycule confirmed its Telegram trading bot was hacked, about $230,000 of user funds lost; the bot was taken offline.", "sourceUrl": "https://www.odaily.news/en/post/5208756", "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026" }, { "incident": "whale-safe-1of1-key-compromise-nov-2025", "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2026-01-06", "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.", "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield", "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025" }, { "incident": "whale-safe-1of1-key-compromise-nov-2025", "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-12-18", "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.", "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages", "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025" }, { "incident": "whale-safe-1of1-key-compromise-nov-2025", "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash", "severity": "critical", "status": "closed", "threatStatus": "active", "date": "2025-11-04", "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.", "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages", "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025" } ] }