MEV bots that front-run exploits to recover funds do more harm than good

Overview Debates Related claims Topics Sources

Blockaid recorded 11 drain transactions executed by the primary attacker behind the UNCX Network Vesting V2 exploit, copycat wallet addresses, and automated maximal extractable value (MEV) trading bots

Pirate Chain developers acknowledged that the cryptographically hidden nature of Sapling pool transactions complicates efforts to trace where the 39.8 million unauthorized ARRR tokens went

A source code flaw in the Pirate Chain privacy network allowed an unauthorized user to mint approximately 39.8 million ARRR tokens on October 14, 2026

The unauthorized minting of 39.8 million ARRR tokens represented roughly 20% of the total Pirate Chain token supply at the time of the October 14, 2026 exploit

Following the unauthorized minting of 39.8 million ARRR tokens on October 14, 2026, the illicit tokens were rapidly moved into Pirate Chain's Sapling shielded pool

The Pirate Chain network remained operational while developers worked on recovery, instructed wallet users not to move funds, and requested exchanges and mining pools voluntarily pause operations following the October 14, 2026 exploit that minted 39.8 million ARRR tokens

Onchain researchers linked tampered Ledger hardware wallets distributed by Malaysian reseller CryptoBilis in Southeast Asia to suspected cryptocurrency losses ranging between $86 million and $93.2 million across over 300 wallets

Unauthorized implants inside compromised CryptoBilis devices captured users' 24-word recovery phrases from screens during setup and transmitted them over mobile networks using hidden chips

Tether froze $10 million of its dollar-pegged USDT stablecoin tied to the unauthorized hardware implant theft involving compromised Ledger devices sold through CryptoBilis

Ledger bears responsibility for losses caused by tampered devices sold through its authorized resellers

Ledger's investigation into tampered devices became public on October 9, 2026, after reports surfaced of stolen cryptocurrency linked to hardware wallets purchased through reseller CryptoBilis

Ledger reported on October 13, 2026, that it has not verified any cryptocurrency asset drain connected to a device bought outside of Southeast Asia

Sandwich attacks on Ethereum cost traders approximately $60 million over the 12 months leading up to October 2025, according to Cointelegraph's analysis of EigenPhi data.

Cronos validators halted block production on August 30, 2026, and erased two hours of history after an exploit involving the TONIC token on the Tectonic lending market exposed $75 million

Ontology halted mainnet block production on October 10, 2026, after receiving a security warning concerning a potential threat involving an unnamed ecosystem project

Blockchain networks ICON, Injective, MultiversX, and MANTRA experienced security incidents or operational outages during August and September 2026

On October 11, 2026 at around 02:00 UTC, a fraudulent post claiming a critical firmware vulnerability appeared on Bitcoin hardware wallet manufacturer Coldcard's official X account

The Liquid Network federation reserve held roughly 4,205 BTC before the September 6, 2026 Elements software bug exploit and dropped to 197 BTC at the height of that exploit

The October 11, 2026 phishing post on Coldcard's X account listed the exact patched firmware versions from Coldcard's July 2026 firmware fix to mimic its legitimate migration procedure

An unauthorized post on Coldcard's official X account on October 11, 2026 directed users to a phishing website named migrate.coldcardwallet.io to collect 24-word wallet seed phrases