Search TSN
HomeCrypto Hacks and Exploits: TSN Story Hub

Crypto Hacks and Exploits: TSN Story Hub

Illustration of a cracked hexagonal vault leaking a stream of glowing gold particles

Crypto theft in 2026 is less about cracking blockchains and more about getting around the people and software that surround them. Security company Hacken counts $1.18 billion lost across 107 incidents in the third quarter alone, Cointelegraph reported, with 77% linked to compromised suppliers or developer tools, publicly disclosed fixes that had not been deployed, and components outside security reviews.

The pattern shows up across TSN’s coverage. Ledger confirmed that one affected user’s device bought through the reseller CryptoBilis “contained an unauthorized hardware implant”, and Bitquery has put losses among CryptoBilis buyers at $92.9 million, a figure that is not Ledger’s. Trezor has since cut its reseller network. Attackers also abuse trusted channels: a fake security alert sent through NGRAVE’s LIQUID app led owners to a phishing page, and Coldcard says a phishing link was posted from its official X account.

Protocols are still being hit directly. Qubic stopped its network after an attacker drained 1,404 wallets whose seeds were generated with insufficient randomness, and Cysic shut its cross-chain bridge after an unauthorised mint of 10 million CYS tokens. Sometimes the bug is caught first: the XRP Ledger disclosed a flaw that could have created XRP from nothing, fixed on 25 September, with no evidence it was exploited.

That matters for anyone holding crypto, because recovery is rare. Blockaid says only 0.8% of the $1.18 billion stolen across 60 major exploits from January to August had been returned to victims by early September, and that $287.1 million sits in wallets that can be watched but not frozen. The Drift case shows why: a wallet linked to the $295 million April hack sent about $61 million of Ether to the Tornado Cash mixer, Cointelegraph reported. Drift says Mandiant attributed the attack to a North Korean threat group.

Where things stand: several incidents are still under investigation, and many loss figures are estimates from blockchain analytics firms rather than the projects themselves. TSN attributes each figure to whoever gives it and updates this page as cases develop.

Timeline

October 2026

Load more Showing 12 of 21

Key moments

  • 20 Oct 2026: A wallet linked to the Drift Protocol hack sends about $61m of Ether into Tornado Cash, Cointelegraph reports. Read
  • 20 Oct 2026: A fake alert sent through NGRAVE’s LIQUID app drains wallets; Bitquery estimates $2.65m was taken. Read
  • 19 Oct 2026: Blockaid says $287.1m of crypto stolen this year sits where nobody can freeze it. Read
  • 18 Oct 2026: Qubic halts its network after an attacker drains 1,404 wallets through weak seeds. Read
  • 18 Oct 2026: Cysic halts its cross-chain bridge after an unauthorised mint of 10 million CYS. Read
  • 15 Oct 2026: Hacken says crypto hacks cost $1.18bn in Q3 2026, mostly through suppliers, developer tools and unpatched fixes. Read
  • 14 Oct 2026: Crypto casino Gamdom takes its systems offline after finding an “unauthorized connection”. Read
  • 13 Oct 2026: Trezor cuts the number of shops allowed to sell its hardware wallets after “recent supply-chain incidents”. Read
  • 13 Oct 2026: MediaMarktSaturn removes all Ledger products from its stores and online platforms, a spokesperson told Cointelegraph. Read
  • 12 Oct 2026: Ontology restarts its mainnet after a roughly 41-hour halt over a security incident at an ecosystem project, Bitcoin.com reports. Read
  • 11 Oct 2026: Coldcard says a phishing link was posted from its official X account. Read
  • 10 Oct 2026: Ledger confirms an unauthorised hardware implant in one device affected in the CryptoBilis case. Read
  • 10 Oct 2026: The XRP Ledger discloses a decade-old bug that could have created XRP from nothing, fixed on 25 September. Read
  • 9 Oct 2026: Ledger investigates lost funds among CryptoBilis buyers and pauses the reseller’s sales. Read
  • 6 Oct 2026: A DeFi vault on Base loses about $6m through a whitelist change, not an Aave core breach. Read

Latest in this hub

Topics in this hub

All topics as a list

Categories

Tags (grouped like the map, then by post count)

Counts are the stories in this hub that carry each topic. Category counts include posts in their sub-categories. After each tag, the category (or categories) most of its posts sit in. Updated 21 October 2026, 17:08 UTC.

All coverage

Every TSN post on crypto hacks and exploits is listed below, newest first.

Polkadot Foundation Says Fearless Wallet Extension Leaked Users’ Private Keys

The Polkadot Community Foundation says four Fearless Wallet browser extension versions sent private keys to an attacker. Users should move funds now.

NGRAVE Fake App Alert Drained Wallets; Bitquery Estimates $2.65m Taken

Attackers used NGRAVE's LIQUID app notifications to send a fake security alert that phished recovery phrases. Bitquery estimates $2.65m was taken.

Drift Exploiter Moves About $61m of Ether Into Tornado Cash, Cointelegraph Says

A wallet linked to the $295m Drift Protocol hack sent about $61m of Ether to Tornado Cash, Cointelegraph reports, citing Lookonchain.

Blockaid Says $287.1m of Stolen Crypto Sits Where Nobody Can Freeze It

Blockaid says $287.1m of crypto stolen in 2026 sits in wallets that can't be frozen, after $1.18bn was taken in 60 exploits. Almost none came back.

Qubic Halts Its Network After Attacker Drains 1,404 Wallets Through Weak Seeds

An attacker drained 1,404 Qubic wallets created with weak seeds. The network is halted, and Qubic says 87.1% of the funds never left its chain.

Cysic Halts Its Cross-Chain Bridge After Unauthorised Mint of 10 Million CYS

Cysic has shut its cross-chain bridge after an attacker minted 10 million CYS on BNB Smart Chain. It says user wallets were not hit; losses under review.

Eclair v0.14.4 Lightning Patch Blocks Browser Access to the Node API

ACINQ's Eclair v0.14.4 Lightning release rejects browser requests to its API, closing a cross-site forgery route, plus hardening fixes from project Loupe.

Hacken Says Crypto Hacks Cost $1.18 Billion in Q3 2026, Mostly Through Suppliers, Developer Tools and Unpatched Fixes

Hacken says crypto hacks cost $1.18bn across 107 incidents in Q3 2026, with 77% linked to suppliers, dev tools and unpatched fixes, Cointelegraph reports.

Crypto Casino Gamdom Takes All Its Systems Offline After Finding an “Unauthorized Connection”

Crypto casino Gamdom took all its systems offline after an "unauthorized connection" on a server. It says user funds are safe; no loss figure given.

South Korea’s Financial Hacks Spread to 16 Firms, Including the Operator of Crypto Exchange Gopax; About 100,000 Records Presumed Leaked

Korean regulators say 16 financial firms, including Gopax operator Streami, were hacked and about 100,000 records presumed leaked. The count may rise.

Trezor Cuts the Number of Shops Allowed to Sell Its Hardware Wallets

Trezor is cutting the number of shops authorised to sell its hardware wallets, saying it wants to check every partner closely. It names no countries.

MediaMarktSaturn Removes All Ledger Products From Its Stores and Online Platforms

MediaMarktSaturn says it has removed all Ledger products from its stores and online platforms after a buyer's tampering claims, unconfirmed by Ledger.

Ontology Restarts Its Mainnet After a Roughly 41-Hour Precautionary Halt Over a Security Incident at an Unnamed Ecosystem Project

Ontology's mainnet is back after a 41-hour precautionary halt over an ecosystem project incident; it says the network lost no funds.

CryptoBilis Changed Hands in March, Its Former Founders Say; CZ Alleges Hackers Bought the Reseller

The Ledger reseller's former founders say they handed over in March. CZ alleges hackers bought it. No public evidence links the sale to the drains.

Coldcard Says a Phishing Link Was Posted From Its Official X Account and It Is Still Investigating How

Coldcard says a phishing link was posted from its official X account and deleted. What it confirmed, what is reported, what is unknown. Do not visit it.

Ledger Confirms an Unauthorized Hardware Implant in One Device Affected in the CryptoBilis Case

Ledger says one affected user's device contained an unauthorized hardware implant. What the company confirmed, what it has not said, and why loss totals are not Ledger's.

XRP Ledger Discloses a Decade-Old Overflow Bug That Could Have Created XRP From Nothing, Fixed on 25 September

XRPL's 9 October 2026 disclosure says an integer overflow in its payment engine could be exploited to create XRP from nothing. Fixed in xrpld 3.4.1 on 25 September, no evidence of exploitation. What an overflow and an amendment are, in plain English.

Crypto Crime Roundup: 15,000 BNB Returned, a Hacker Convicted and a SIM-Swapper Jailed

An attacker returned 15,000 BNB to the 79thVault project on BNB Chain, a Manhattan jury convicted Uranium Finance hacker Jonathan Spalletta on all counts, and a London court jailed a SIM-swap fraudster for two and a half years. Plus two small DeFi exploits flagged by SlowMist.

Ledger Investigates Lost Funds Among CryptoBilis Buyers and Pauses the Reseller’s Sales

Ledger says it is investigating reports of lost funds among South East Asia customers who bought devices from the reseller CryptoBilis, and has asked the reseller to pause sales. Loss totals of about $86m come from Hacken and an on-chain analyst, not Ledger. The cause is unconfirmed.

Base vault ~$6m loss: whitelist change, not an Aave core breach

Trade press: an unidentified Base DeFi vault lost about 1,783 wstETH (~$6m) on 4 Oct 2026 after a multisig whitelist change. Firms say Aave V3 was not hit.
Load more

Latest on TSN

Explore the TSN Atlas: Every topic we cover, mapped. Click a bubble to dive in.

Open the Atlas

TSN explains AI, Big Tech, crypto and cybersecurity, with every source linked.

Get TSN in your inbox

Sections

TSN

Follow

© 2026 TSN · Tech Social Network