Seed Phrase
7 incidents, 1 live. 37 days since the last new one.
7 drains in the last 12 months
7 drains in the last 12 months
6 drains in 2026
1 drains in 2025
Live
-
Critical✕Still active
D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron
From 15 to 20 September 2026 thieves emptied at least 6,678 wallets created in the D'CENT mobile app in six waves, taking about 11.7M XRP, and kept draining after 21 September for a total above 12.4M XRP (over $18M per Protos). D'CENT's own disclosure also named Bitcoin, Tron and Ethereum, and the stolen XRP was moved to Ethereum through THORChain. The cause is compromised recovery phrases for wallets made in the app; how they leaked has not been explained. D'CENT says app-created wallets are vulnerable and tells users to make a new recovery phrase and move everything.
D'CENT mobile App Wallet users (wallets created in the app)·Ethereum, Tron, Bitcoin·$18M stolen·Since Sep 15, 2026·
Past
June 2026 1
-
High✕Still active
Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor
Microsoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published.
Windows users who open shortcut files from USB drives·Bitcoin, Ethereum, Tron·Since Jun 17, 2026·
May 2026 1
-
Critical✕Still active
'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included
Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet.
Seed phrases made by some less widely used mobile software wallets (2018 onward)·Solana, Bitcoin, Ethereum, Polygon, Tron·$5.0M stolen·Since May 27, 2026·
April 2026 2
-
High◐Partly contained
Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases
Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published.
iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps·Multiple EVM chains, Bitcoin, Tron·Since Apr 20, 2026·
-
Critical◐Partly contained
Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts
A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase.
Ledger users who installed 'Ledger Live' from the Mac App Store·Bitcoin, Ethereum, Tron, Solana·$9.5M stolen·Since Apr 8, 2026·
January 2026 1
-
High✕Still active
Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps
SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published.
Linux users installing wallet apps from the Snap Store·Bitcoin, Multiple EVM chains·Since Jan 21, 2026·
December 2025 1
-
Critical✓Contained
Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets
A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected.
Trust Wallet Chrome extension v2.68·Solana, Bitcoin, Ethereum·$8.5M stolen·Since Dec 24, 2025·
No drains match these filters.