Skip to content

Topic

Cryptocurrency Theft

Theft of digital assets from individuals, exchanges and custodians, including wallet drains, key compromise and the laundering of proceeds across chains.

Current stories

investConfirmed11 publishers

Ledger plans to sell its Android-based Atom only from its own website after the CryptoBilis breach

Ledger plans to release its Android-based Atom wallet in mid-2027, after a breach that onchain researchers put at up to $93.2 million. It plans no trade-ins for customers hit by the tampering, so victims who want the new hardware will pay for it.

Perspective Coverage

11 publishers
Builder
Builder 33%
Operator
Operator 34%
Investor
Investor 33%

Reality

Evidence50
Adoption
Not scored
Hype gap+30
Incentives65
Confidence62
investConfirmed8 publishers

Ledger finds a cellular implant inside a CryptoBilis-sold signer that copies recovery phrases at setup

Ledger disclosed on October 13 that an implant in a signer sold by CryptoBilis captures 24-word recovery phrases and sends them over LTE. Every fund loss Ledger has verified involved devices bought through that reseller.

Perspective Coverage

8 publishers
Builder
Builder 23%
Operator
Operator 48%
Investor
Investor 29%

Reality

Evidence60
Adoption
Not scored
Hype gap+30
Incentives45
Confidence70
investConfirmed22 publishers

Ledger confirms a hardware implant in one wallet caught up in the $93 million CryptoBilis drains

Ledger confirmed on Oct. 10 that one affected customer's wallet held an unauthorized implant, after drains that trackers put near $93 million. That proves tampered hardware reached a victim, but investigators have not tied comparable equipment to the rest of the losses.

Perspective Coverage

22 publishers
Builder
Builder 24%
Operator
Operator 44%
Investor
Investor 32%

Reality

Evidence68
Adoption
Not scored
Hype gap+18
Incentives55
Confidence72
investOne report1 publisher

Ledger bars resale of returned wallets after implants sent recovery phrases over cellular links

Ledger suspended reseller sales in seven Asian markets and barred resale of returned wallets after implants captured recovery phrases. Independent blockchain investigators estimate losses above $86 million, a figure Ledger has not verified.

Publishers:crypto.news

Reality

Evidence35
Adoption
Not scored
Hype gap
Not scored
Incentives60
Confidence45
investConfirmed6 publishers

MediaMarktSaturn pulled the full Ledger range within four days of losses surfacing at another reseller

MediaMarktSaturn removed all Ledger products from its stores and online platforms over tampering reports. The public German evidence is an X user's claim that two wallets held cellular modules. Ledger did not answer Cointelegraph on whether it has confirmed any tampered device in Europe.

Perspective Coverage

6 publishers
Builder
Builder 23%
Operator
Operator 42%
Investor
Investor 35%

Reality

Evidence50
Adoption
Not scored
Hype gap+25
Incentives
Not scored
Confidence60
scienceConfirmed6 publishers

Ledger asks resellers in seven Asian markets to pull its wallets while it traces the tampering

Ledger asked resellers in seven Asian markets to pull its wallets from shelves on October 14. It has not tied a suspected implant in a Flex from a second reseller to the first cases, so how far the tampering reaches is open.

Perspective Coverage

7 publishers
Builder
Builder 16%
Operator
Operator 51%
Investor
Investor 33%

Reality

Evidence58
Adoption
Not scored
Hype gap+15
Incentives50
Confidence62
investOne report1 publisher

Ledger halts sales at Malaysian reseller CryptoBilis while it investigates user losses

Ledger told Malaysian reseller CryptoBilis to stop all sales while it investigates losses a pseudonymous analyst puts above $86 million. For anyone holding crypto on hardware wallets, the shop each device came from is now part of its security.

Reality

Evidence35
Adoption
Not scored
Hype gap+15
Incentives
Not scored
Confidence40
securityConfirmed3 publishers

Cronos validators halted the chain to strand $68m of a $74m Tectonic borrow

A 20-minute push on TONIC's price bought the attacker $74 million in borrows against it, but only about $6 million reached Ethereum before Cronos stopped producing blocks and rewound its own state.

Perspective Coverage

3 publishers
Builder
Builder 22%
Operator
Operator 50%
Investor
Investor 28%

Reality

Evidence68
Adoption12
Hype gap+20
Incentives50
Confidence62
investOne report1 publisher

Seven agencies price North Korea's fake-recruiter funnel at $1,530 a wallet

Japan, the US, Australia and Germany put eight months of North Korea's developer-targeting campaign at $10.71 million taken from more than 7,000 wallets. CertiK counted $2.06 billion of North Korea-linked crypto theft in 2025 alone.

Publishers:decrypt.co

Reality

Evidence72
Adoption70
Hype gap+8
Incentives45
Confidence62