Onchain researchers linked tampered Ledger hardware wallets distributed by Malaysian reseller CryptoBilis in Southeast Asia to suspected cryptocurrency losses ranging between $86 million and $93.2 million across over 300 wallets

Overview Debates Related claims Topics Sources

Pirate Chain developers acknowledged that the cryptographically hidden nature of Sapling pool transactions complicates efforts to trace where the 39.8 million unauthorized ARRR tokens went

A source code flaw in the Pirate Chain privacy network allowed an unauthorized user to mint approximately 39.8 million ARRR tokens on October 14, 2026

The unauthorized minting of 39.8 million ARRR tokens represented roughly 20% of the total Pirate Chain token supply at the time of the October 14, 2026 exploit

Following the unauthorized minting of 39.8 million ARRR tokens on October 14, 2026, the illicit tokens were rapidly moved into Pirate Chain's Sapling shielded pool

The Pirate Chain network remained operational while developers worked on recovery, instructed wallet users not to move funds, and requested exchanges and mining pools voluntarily pause operations following the October 14, 2026 exploit that minted 39.8 million ARRR tokens

Unauthorized implants inside compromised CryptoBilis devices captured users' 24-word recovery phrases from screens during setup and transmitted them over mobile networks using hidden chips

Tether froze $10 million of its dollar-pegged USDT stablecoin tied to the unauthorized hardware implant theft involving compromised Ledger devices sold through CryptoBilis

Ledger bears responsibility for losses caused by tampered devices sold through its authorized resellers

Ledger's investigation into tampered devices became public on October 9, 2026, after reports surfaced of stolen cryptocurrency linked to hardware wallets purchased through reseller CryptoBilis

Ledger reported on October 13, 2026, that it has not verified any cryptocurrency asset drain connected to a device bought outside of Southeast Asia

Cronos validators halted block production on August 30, 2026, and erased two hours of history after an exploit involving the TONIC token on the Tectonic lending market exposed $75 million

Ontology halted mainnet block production on October 10, 2026, after receiving a security warning concerning a potential threat involving an unnamed ecosystem project

Blockchain networks ICON, Injective, MultiversX, and MANTRA experienced security incidents or operational outages during August and September 2026

On October 11, 2026 at around 02:00 UTC, a fraudulent post claiming a critical firmware vulnerability appeared on Bitcoin hardware wallet manufacturer Coldcard's official X account

The Liquid Network federation reserve held roughly 4,205 BTC before the September 6, 2026 Elements software bug exploit and dropped to 197 BTC at the height of that exploit

The October 11, 2026 phishing post on Coldcard's X account listed the exact patched firmware versions from Coldcard's July 2026 firmware fix to mimic its legitimate migration procedure

An unauthorized post on Coldcard's official X account on October 11, 2026 directed users to a phishing website named migrate.coldcardwallet.io to collect 24-word wallet seed phrases

On September 6, 2026, a software bug in Elements allowed an unauthorized user to create and redeem Liquid Bitcoin, draining roughly 3,996 to 4,000 BTC valued at $320 million

Stablecoin issuer Tether froze approximately $10 million in USDT tied to blockchain addresses involved in the Ledger wallet draining incident

Ledger confirmed that all documented hardware wallet draining cases linked to CryptoBilis-sold devices involved devices purchased from reseller CryptoBilis within three months prior to October 10, 2026