# Seed Phrase Theft · Drain Watch

4 incidents, 2 live. JSON: https://drains.watch/t/seed-phrase-theft.json · RSS: https://drains.watch/t/seed-phrase-theft/feed.xml

- [Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M](https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets) (live, Critical, Partly contained, since Oct 9, 2026)
- [16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys](https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026) (live, Medium, Partly contained, since Oct 5, 2026)
- [Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys](https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026) (closed, High, Contained, since Jun 8, 2026)
- [Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets](https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025) (closed, Critical, Contained, since Dec 24, 2025)