# Ledger · Drain Watch

6 incidents, 2 live. JSON: https://drains.watch/t/ledger.json · RSS: https://drains.watch/t/ledger/feed.xml

- [Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M](https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets) (live, Critical, Partly contained, since Oct 9, 2026)
- [19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons](https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026) (live, High, Partly contained, since Aug 30, 2026)
- [Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases](https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026) (closed, High, Partly contained, since Apr 20, 2026)
- [notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies](https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026) (closed, High, Still active, since Apr 10, 2026)
- [Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts](https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026) (closed, Critical, Partly contained, since Apr 8, 2026)
- [Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps](https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026) (closed, High, Still active, since Jan 21, 2026)