theft

The U.S. prosecution has charged 6 members of a gang suspected of stealing from Madagascar NFT wallets. The FBI estimates that 74 victim wallets have lost at least $516,700.

On October 24, the Bitcoin lightweight wallet Electrum disclosed a malicious server attack targeting transaction fee increases and fixed it in version 4.8.3, corresponding to GitHub security advisory GHSA-6jp4-8v48-cc5v. Users may inadvertently sign funds over to the attacker when performing regular fee increases on transactions. Developers stated that the issue arose after users reported losing funds after signing fee increases.The results of two reports differed: one person discovered that transactions in the wallet history were replaced after broadcasting a payment and claimed that the original payment did not enter the Bitcoin peer-to-peer network and was withheld by the server; another person, Raju-K12, reported losing funds due to the fee increase on the replaced transaction. In the attack, the malicious server withheld new transactions broadcasted by the client and inserted a conflicting transaction into the history, replacing the original output with the attacker's address. The replacement transaction was signed invalidly at that time, but the lightweight client did not verify these signatures before displaying unconfirmed transactions; after the user manually increased the fee and signed through RBF, the attacker received the funds. Both individuals claimed that the last four digits of the attacker's address were the same as those of the legitimate receiving address. The announcement did not disclose the amount stolen, transaction identifiers, or the attacker's address.The patch corresponds to commit 90fe308, which checks the signatures of the wallet's own inputs before writing memory pool transactions to local history, but does not overwrite inputs from external addresses of the wallet and does not perform complete consensus verification. The announcement suggests that users who have not upgraded should verify the output address and amount each time they sign; clients connected to their own or trusted servers are not affected by this attack. On the timeline, the issue was first privately disclosed on October 11, received reports of fee loss on October 18, the fixed version was tagged on October 23, and the binary and public disclosure occurred on October 24.

According to monitoring by Onchain Lens, Bloomtrading users reported that their wallet assets were stolen, with approximately $954,000 in funds transferred to a suspected theft address. A hacker stole 9,408 SOL from 49 victims through a theft wallet, and the final amount may be higher.The highest single stolen amount was 1,636 SOL, approximately $166,000. Users are reminded to disconnect immediately and transfer their funds to a new wallet.

Slow Fog released a threat intelligence report stating that they recently received user feedback about a GitHub repository named sol-live, which disguises itself as a Solidity interview practice project. However, it hides commands in the .vscode/settings.json file to download and execute remote scripts, which may trigger malicious payloads when users start the project with custom terminal configurations.Slow Fog's analysis shows that the related malicious payloads can collect browser login databases, wallet extension storage, and macOS Keychain files. They also have the capability to scan and upload local files, execute remote commands, provide interactive Shell access, and monitor the clipboard. In macOS and Linux environments, the malicious terminal configuration must be actively initiated by the user to execute; the attack chain on Windows has not been confirmed due to issues with quote handling.

On-chain detective ZachXBT posted that a certain institution was allegedly hacked by the North Korean-linked organization SquidSquad on October 8, resulting in the theft of approximately 2.84 million USD on the BNB Smart Chain (BSC).According to its tracking, the attackers deposited 1,111.2 ETH into Tornado Cash on October 20, then withdrew it to three addresses, and subsequently transferred the funds from Ethereum to Tron via USDT, consolidating them into two addresses. The aforementioned consolidation addresses are all financially linked to addresses previously attributed to North Korea. The funds were then directed to Chinese over-the-counter (OTC) traders through intermediary addresses within minutes, and ZachXBT believes this move may be to evade potential fund freezes by Tether.

According to Chainalysis, one of the biggest victims in the theft incident involving the cryptocurrency hardware wallet manufacturer Ledger was also a scammer, suffering a loss of over 60 BTC, worth approximately 4.8 million dollars, with funds coming from a task scam.In this scam, participants were paid to create fake sales and reviews for real products. Subsequently, a "negative balance" appeared, and participants were told that they had to invest their own funds to receive payment. On September 22, the mastermind behind the scam transferred the funds to three separate Ledger addresses. On October 9, the thieves emptied all three addresses, transferring the funds to the same wallet through a single transaction from each address. The receiving wallet has been reported to be involved with the stolen funds.

Recently, the police in Binhai City, Shandong, China received a report from a citizen named Xie, stating that 1,300 USDC stablecoins and NFTs worth tens of thousands of yuan had mysteriously disappeared from his digital wallet. There were no obvious transfer alerts or signs of phishing links in the wallet. The police began an on-chain investigation into the virtual currency transfer records and actively sought cooperation with enterprises to analyze the suspect's account.After extensive work, a major suspect named Chen (30 years old, from Fengyang County, Chuzhou, Anhui) was identified. On October 9, technical police officers went to Fengyang County to arrest him. Upon arrival, Chen initially denied the allegations. However, the police utilized the immutable and traceable characteristics of blockchain evidence to gradually break down his psychological defenses. Chen ultimately confessed to the theft. Chen has now been criminally detained in accordance with the law, and his family has actively compensated the victim for the losses. This case marks the first instance of virtual currency theft in Binhai City.

According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update that fixes vulnerabilities that could allow malicious nodes to steal funds. The most serious vulnerability involves Lightning channel reconnections. According to Bitcoin Optech, malicious nodes may falsely claim that they did not receive previously confirmed channel updates.The vulnerable LDK software could subsequently sign conflicting commitment transactions without properly recording the related transactions, allowing attackers to regain Bitcoin after forwarding the payment is completed. Versions LDK 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.

According to The Defiant, on-chain records of the Ethereum blockchain show that a wallet related to the CryptoBilis theft has transferred 464 ETH to the mixing protocol Tornado Cash.On-chain data indicates that these funds first passed through an intermediary address and were then dispersed to four deposit wallets, while the source address currently retains about 700 ETH.

According to Lookonchain monitoring, a certain address's old wallet has been safely running for 8 years. After being dormant for more than 4 years, it transferred to a new wallet one month ago, and then CryptoBillis Ledger Drainer stole all 59 ETH from that wallet, worth $146,800.

Hardware wallet manufacturer Ledger has once again experienced a security incident today, with third-party security agencies estimating the losses to be close to 90 million USD. Ledger is investigating the financial losses related to devices sold by its Southeast Asian authorized distributor CryptoBilis and has requested the distributor to suspend sales and shipments, advising users who purchased devices through this channel in the past 90 days to exercise caution or transfer their assets. The cause of the incident has not yet been definitively confirmed, but it is suspected to involve supply chain or device tampering risks.Major historical attacks and financial loss incidents related to Ledger include:In 2018, early hardware and supply chain research vulnerabilities emerged. Security researchers demonstrated the possibility of tampering with the Nano S before it left the factory, as well as issues such as MCU bootloader bypass, isolation vulnerabilities, and Bitcoin change address injection. Ledger gradually released security announcements and completed fixes, with related issues mostly being research-level vulnerabilities or requiring physical contact with the device to exploit.In 2020, Ledger experienced a massive customer data leak. Attackers obtained e-commerce and marketing databases through third-party API keys and vulnerabilities related to Shopify, exposing over 1 million email addresses and approximately 272,000 to 292,000 detailed customer records, including names, addresses, and phone numbers. The hardware and private keys were not affected, but this incident triggered long-term phishing, social engineering, and counterfeit official letter scams.In December 2023, the Ledger Connect Kit suffered a supply chain attack. After a former employee fell victim to a phishing attack, their NPMJS account was compromised, and attackers released a malicious version of the Connect Kit, injecting malicious code into DApps that relied on the library, enticing users to sign fraudulent transactions. The active window of the attack was about 2 hours, with losses estimated between 480,000 to 600,000 USD. The hardware and Ledger Live itself were not directly breached.In January 2026, third-party Global-e order data was leaked. The payment and logistics partner's system suffered unauthorized access, exposing some Ledger.com order-related information, including names, addresses, and contact details. Ledger's own systems and private keys were not affected, but the phishing risk rose again.In April 2026, counterfeit Ledger Live application scams appeared on the App Store. The counterfeit application was listed for about a week, tricking users into entering their recovery phrases, with over 50 victims losing approximately 9.5 million USD across multiple blockchains. Apple subsequently removed it, and Ledger emphasized that it would never ask for 24-word recovery phrases.In August 2026, Ledger disclosed vulnerabilities related to Ethereum application signatures, including command interleaving causing display content to be out of sync with signature parameters, and Clear-signing bypass issues. The vulnerabilities required malicious hosts to cooperate, and Ledger stated that there was no evidence of actual user exploitation; related issues have been fixed in the new version.On October 9, 2026, a large-scale wallet draining incident related to the CryptoBilis distributor occurred, with estimated losses close to 90 million USD. Ledger is investigating, and the incident is suspected to involve supply chain or device tampering attacks targeting a single channel. The official sales have been suspended, and affected users are advised to migrate their assets.

According to MistTrack monitoring, Tether has frozen a large amount of USDT on certain addresses related to the Ledger user funds theft incident, which has resulted in losses nearing 90 million dollars. It is reported that some affected users have contacted MistTrack for assistance, and their team is following up. Previously, Ledger stated that it is investigating the theft incident involving user funds related to the Southeast Asian dealer CryptoBillis.

The cryptocurrency hardware wallet manufacturer Ledger is investigating a theft incident involving Southeast Asian users, who had purchased devices through the distributor CryptoBilis.Ledger has requested CryptoBilis to suspend sales and shipments and advised users who purchased devices through this distributor in the past 90 days not to initialize their devices; if they have already completed the setup, they should create a new Ledger signing device using a new mnemonic phrase and transfer their assets to the new wallet.On-chain investigator Specter estimates that this incident has led to the theft of hundreds of wallets on the Bitcoin, Ethereum, and TRON networks, with losses exceeding 86 million dollars. Security researcher tanuki42 previously estimated the losses to be over 72 million dollars and stated that the amount is still increasing. The specific cause of the incident and whether the involved devices have security vulnerabilities are still under investigation.

On-chain analyst Specter stated that there have been multiple reports of Ledger user wallets being stolen recently on X and Reddit. After tracking the related theft addresses, it was found that the funds came from hundreds of victim wallets, involving multiple mainstream blockchains such as Ethereum, TRON, and Bitcoin, with total losses exceeding 86 million dollars.Currently, the analyst has disclosed several involved addresses, but the reasons for the attacks, the specific number of affected individuals, and whether Ledger has any security vulnerabilities have not yet been confirmed. At this stage, the information mainly comes from on-chain tracking and community reports, and further verification is still needed.

Trader Frogman confirmed on platform X that assets worth 4 million dollars were stolen. He also stated, "I'm not sure how it happened yet, but I'm currently in Singapore. Thanks to the teams and individuals helping with the investigation. I will share more information as much as I can."This morning's news reported that trader Frogman's wallet, containing approximately 4 million dollars in assets, was transferred and sold, exchanged for ETH, BNB, and SOL, and then dispersed using tools like Privacy Cash and Chainflip.The stolen assets involve 9 types of tokens, including 1.43 million BP, valued at approximately 1.77 million dollars; 13.96 million MarsCoin, valued at approximately 1.55 million dollars; and 3.7 million Cash Cat, valued at approximately 510 thousand dollars. The address of the stolen wallet has been flagged.

Mr. Li Yi, a Douyin user, posted a video on social media stating that on June 10 of this year, he downloaded a fake wallet from the official Huawei store, which led to the exposure of his mnemonic phrase and the theft of 177,473 USDT.According to his description, the hacker changed the permissions of his wallet address to multi-signature, and then implemented a secondary scam under the pretext of unlocking it for spending money. After the victim transferred funds, all USDT in the address was transferred away.Mr. Li Yi claimed that after he released the video exposing the app, the download volume of the app in the official store plummeted. The hacker repeatedly gathered internet trolls to report his video, causing it to be forcibly taken down, and privately attempted to negotiate a conditional agreement to delete the video.He also stated that after conducting a private investigation, he learned that the scam app had five servers set up in Hong Kong, paying to have the app listed in the Huawei official store and to boost its ranking, causing a large number of victims to download it first in searches. Due to relevant bans in mainland China, related wallet apps cannot be normally launched in the store, so any app that cannot be launched but does exist in the store may be a counterfeit scam app.

On-chain data analysis firm Bitquery linked the approximately $459,000 asset theft incident involving Tradewiz to a wallet that completed 27 transactions through the trading bot previously. Investigation statistics show that the incident affected 20,933 wallets, with losses involving SOL, tokens, and deposits recovered after closing token accounts; the valuation is based on a SOL price of $120.Bitquery discovered that major fund transfers began 41 minutes after Tradewiz's trading activity stopped; about 73% of the SOL in this round of transfers was moved afterward. Tradewiz stated that the incident involved the private key leak of the SOL PVP export function and promised to compensate users for their losses; subsequent updates indicated that the first batch of refunds had been issued, and claims need to be verified. Tradewiz also suspended EVM services for security checks and stated that the police are assisting in tracking the assets and have contacted exchanges for identity and account verification information.Bitquery traced some of the early funds coming from MEXC withdrawals, later shifting to Kucoin deposit addresses; these connections do not indicate that the two exchanges participated in the theft.

According to Insurance Journal, blockchain analysis company Elliptic disclosed that it has tracked over 50 security incidents related to North Korea, with a total of approximately $1.2 billion stolen this year.Some of the stolen funds from Bitget overlap with the associated addresses from last year's $1.5 billion theft incident at Bybit exchange. Initial on-chain money laundering patterns indicate that the Bitget incident was carried out by the hacker organization TraderTraitor.

The U.S. Attorney's Office for the District of Massachusetts has filed a civil forfeiture lawsuit seeking to seize 110,300 USDT from a Binance account. The case involves phishing text messages impersonating Coinbase, which led to the theft of 33.7 bitcoins from a beneficiary and their family trust within the same Coinbase account, valued at approximately $900,000 at the time.Investigators stated that from June 5 to June 15, 2023, 11.2 stolen bitcoins were traced to the Binance account, which were then quickly exchanged for Monero. When the FBI requested to freeze the account, it held approximately 758.55 Monero; Binance transferred 110,300 USDT to a government-controlled wallet on August 3, 2026.