Oct 11, 2026
1 new drain, 1 update.
New
-
Medium✓Contained
COLDCARD's X account posts fake 'security migration' phishing link
On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website.
COLDCARD hardware wallet users on X·Bitcoin·Since Oct 11, 2026·
Updated
-
Critical◐Partly contained
Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M
Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct.
Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers·Tron, Ethereum, BNB Chain, Polygon, Solana, Bitcoin·$102M stolen·Since Oct 9, 2026·