{
 "tag": "seed-phrase-theft",
 "name": "Seed Phrase Theft",
 "group": "Other",
 "incidents": [
  {
   "slug": "ledger-cryptobilis-tampered-hardware-wallets",
   "title": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets",
   "json": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin"
   ],
   "method": "supply-chain",
   "product": "Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers",
   "tags": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin",
    "supply-chain",
    "ledger",
    "hardware-wallet",
    "cryptobilis",
    "reseller",
    "hardware-implant",
    "seed-phrase-theft",
    "tether-freeze"
   ],
   "amountUsd": 102000000,
   "victims": 324,
   "startedAt": "2026-10-09",
   "closedAt": null,
   "updatedAt": "2026-10-16T12:00:00Z",
   "summary": "Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct."
  },
  {
   "slug": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "title": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "json": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "malicious-extension",
   "product": "Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons",
   "tags": [
    "multi-evm",
    "malicious-extension",
    "firefox",
    "browser-extension",
    "fake-wallet",
    "rabby",
    "okx-wallet",
    "seed-phrase-theft",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-05",
   "closedAt": null,
   "updatedAt": "2026-10-07T12:00:00Z",
   "summary": "Socket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen."
  },
  {
   "slug": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "title": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026",
   "json": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages",
   "tags": [
    "multi-evm",
    "supply-chain",
    "npm",
    "injective",
    "sdk",
    "github-compromise",
    "seed-phrase-theft",
    "developer"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-08",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23."
  },
  {
   "slug": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "title": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "json": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana",
    "bitcoin",
    "ethereum"
   ],
   "method": "malicious-extension",
   "product": "Trust Wallet Chrome extension v2.68",
   "tags": [
    "solana",
    "bitcoin",
    "ethereum",
    "malicious-extension",
    "trust-wallet",
    "browser-extension",
    "chrome-web-store",
    "seed-phrase",
    "leaked-api-key",
    "wallet",
    "supply-chain",
    "shai-hulud",
    "npm",
    "seed-phrase-theft"
   ],
   "amountUsd": 8500000,
   "victims": 2520,
   "startedAt": "2025-12-24",
   "closedAt": "2025-12-25",
   "updatedAt": "2025-12-31T12:00:00Z",
   "summary": "A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected."
  }
 ],
 "changes": [
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-16",
   "title": "Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-14",
   "title": "Ledger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-13",
   "title": "Ledger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-11",
   "title": "Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.",
   "sourceUrl": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-10",
   "title": "Ledger confirmed that at least one affected device contained an unauthorized hardware implant.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Coordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Ledger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-07",
   "title": "Socket published its analysis, linking the add-ons through a shared campaign marker to crypto-theft extensions it found in August 2026.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-05",
   "title": "Mozilla unpublished the 16 malicious extensions from the Firefox add-ons store.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "Socket published its analysis: the payload hooks fromMnemonic and fromHex, 17 more packages pinned the bad version, the malicious release had 310 downloads, and 1.20.23 is clean.",
   "sourceUrl": "https://socket.dev/blog/compromised-injective-sdk-npm-package",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "BleepingComputer reported the compromise and advised affected developers to move funds to new wallets and rotate all secrets.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-08",
   "title": "The attacker made the first suspicious commits to the Injective SDK repository and published the malicious version shortly after.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-31",
   "title": "SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.",
   "sourceUrl": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-27",
   "title": "Trust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-26",
   "title": "CyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.",
   "sourceUrl": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-25",
   "title": "ZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.",
   "sourceUrl": "https://www.theblock.co/post/383735/trust-wallet-extension-incident",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-24",
   "title": "Malicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  }
 ]
}