Bitquery estimates $102 million was drained from 324 Ledger-linked wallets on six chains, up from about $86 million earlier. Ledger says its chips, software and servers were not breached and calls it a distribution-channel attack.
Perspective Coverage
6 publishers
- Builder
- Builder 23%
- Operator
- Operator 44%
- Investor
- Investor 33%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+12
- Incentives55
- Confidence60
MediaMarktSaturn pulls Ledger wallets in every country after an implant report in Germany
MediaMarktSaturn has pulled Ledger wallets from its roughly 1,070 stores and websites in every country it operates in. Ledger ties every confirmed case to a Southeast Asian reseller, but one buyer says he found modified units at two MediaMarkt stores.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−10
- Incentives50
- Confidence45
Triple-A's treasury attacker sends $12.4M of ether into Tornado Cash in 56 deposits
Triple-A's July treasury attacker deposited 4,970 ETH, about $12.4 million, into Tornado Cash on Oct. 9, blockchain security firm Salus said. Getting the coins back now depends on tracers tying withdrawals from the mixer to the attacker, as Salus did once with earlier withdrawals.
Reality
- Evidence52
- Adoption48
- Hype gap0
- Incentives58
- Confidence50
Suspect in Ledger reseller breach routes $1.34 million through Tornado Cash and Binance
Onchain Lens traced 430.2 ETH, about $1.07 million, from a suspect in the Ledger CryptoBilis reseller breach into Tornado Cash, plus $270,280 into Binance. The flows are under 2% of the $70.6 million TokenPost valued in the suspect's wallets, so most of what the suspect holds has not been traced to a mixer or exchange as Ledger investigates.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence40
Manhattan federal jurors convicted Jonathan Spalletta of computer fraud and money laundering over the $53.3 million Uranium Finance exploit of 2021. Where the roughly $31 million in crypto seized in February 2025 ends up now turns on restitution and forfeiture rulings still to come.
Perspective Coverage
10 publishers
- Builder
- Builder 30%
- Operator
- Operator 42%
- Investor
- Investor 28%
Reality
- Evidence85
- Adoption
- Not scored
- Hype gap+8
- Incentives40
- Confidence78
Attacker sells Frogman's $4 million of drained Solana tokens in nine minutes
Crypto trader Frogman lost about $4 million when his Solana wallets were drained at 4:14 a.m. as TOKEN2049 opened in Singapore. The attacker finished selling within nine minutes, hours before anyone noticed, and the route to his keys is still unknown.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence50
Prosecutors say the ruling upholding Bitcoin Fog's founder makes one Tornado Cash user's Manhattan transactions enough to try Roman Storm in New York. If Judge Katherine Polk Failla agrees, a mixer developer could be tried wherever one user deposits into the pool.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence68
FinCEN withdrew its proposal to make about 15,000 institutions report foreign crypto mixer transactions, work it estimated at 1.47 million hours a year. Banks keep their general duty to report suspicious activity, so mixer exposure stays a monitoring job without its own form.
Perspective Coverage
10 publishers
- Builder
- Builder 25%
- Operator
- Operator 48%
- Investor
- Investor 27%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+12
- Incentives60
- Confidence68
Drift's DFX recovery token opened at about 0.0104 USDT per dollar lost in the $295.4 million April exploit, roughly one cent on the dollar. Paying every capped pledge in full would lift that to about 50 cents, and the other half depends on Velocity's revenue and on funds recovered from the attacker.
Perspective Coverage
5 publishers
- Builder
- Builder 19%
- Operator
- Operator 42%
- Investor
- Investor 39%
Reality
- Evidence70
- Adoption8
- Hype gap+25
- Incentives55
- Confidence65
Aztec Labs is bringing back zk.money as a private DAI wallet that caps every transfer at $2,500 and all users' deposits combined at $50,000 a day. Raising either limit means a new contract that each user must opt into. The caps arrive while US law on privacy wallets remains unsettled.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+30
- Incentives55
- Confidence62
Suspected North Korean hackers have moved $3.8 million of Bitget's $387.5 million into Zcash's shielded pool, about 1% of the haul. About $24 million of stolen ZEC remains in transparent addresses that exchanges and police can still freeze.
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+12
- Incentives50
- Confidence60
MetaMask is pulling its Ethereum validators out of Lido after an infrastructure compromise, putting the stake on a round trip Lido says can take up to 45 days. The stake earns no rewards on the way, and stETH holders share that cost, for an attack whose only documented theft so far is diverted block rewards.
Perspective Coverage
4 publishers
- Builder
- Builder 26%
- Operator
- Operator 41%
- Investor
- Investor 33%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives65
- Confidence58
Bitget CEO Gracy Chen expects to recover little of the $388 million stolen from the exchange, citing Bybit's 3.5% freeze rate. On that benchmark about $13.6 million is frozen within a year and roughly $374 million stays with whoever carries the loss.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence50
One Bitget breach supplied half of September's record $766 million in crypto hack losses
Crypto hacks drained $766.49 million in September, a 2026 monthly record, and $387.5 million came from one breach of Bitget's hot wallets. After the money returned from the Liquid Network exploit, that one exchange accounts for about 80% of what stayed stolen.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
The judge moved the second trial to April 26, 2027, on the defense's own request. The count that would actually settle non-custodial developer liability is still waiting on sentencing.
Perspective Coverage
4 publishers
- Builder
- Builder 47%
- Operator
- Operator 34%
- Investor
- Investor 19%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence74
Moonwell attacker turned $1.95m of principal into $11.03m of Base borrows
The Moonwell post-mortem puts externally supplied capital at $1.95m. Recycled through repeated borrowing, that money moved $7.5m of MAMO buying. That ratio, rather than the loss total, sets an attacker's entry price.
Publishers:forum.moonwell.fi
Reality
- Evidence74
- Adoption68
- Hype gap−8
- Incentives76
- Confidence58
buildOne report1 publisher A $951 vote took $8.5M from Term Finance, and no audit was ever going to catch it
The contracts behaved as written. The hole was in the permission model, priced in public: a controlling stake in the vault's governance token was on sale for half an ETH.
Reality
- Evidence40
- Adoption20
- Hype gap+22
- Incentives32
- Confidence38
Term Labs' $8.5M drain needed no bug, only the votes depositors never claimed
The attacker bought a controlling stake in four vaults for a few dollars, because voting rights at Term required a manual second step that almost no depositor took.
Reality
- Evidence32
- Adoption28
- Hype gap+18
- Incentives58
- Confidence34
Two ETH bought a supermajority: Term Finance's $8.5M loss was a vote, not a bug
An attacker seeded with 2 ETH from Tornado Cash took full voting control of four USDC vaults and 91% of a meta vault, then voted the money out. The contracts held.
Reality
- Evidence34
- Adoption28
- Hype gap+14
- Incentives58
- Confidence33
A 2022 oracle hack starts moving again, three days after Pando shut its books
The Pando Rings exploiter swapped 3 million DAI for about 1,570 ETH on CoW Protocol, then pushed 800 ETH into Tornado Cash as the protocol entered maintenance mode.
Reality
- Evidence42
- Adoption48
- Hype gap+14
- Incentives58
- Confidence40