$282.9M lost this week $2.0B lost in 30 days $95.2B lost this year
Hackers reportedly compromised a Ledger reseller, CryptoBilis, implanting hardware into devices to steal users' recovery phrases. Estimated losses range from $72 million to $93 million, with thefts occurring between October 9-10, 2026. Ledger confirmed an unauthorized hardware implant in at least one affected device and has instructed CryptoBilis to halt sales.
A Fomo user lost approximately $48,000 in assets after clicking a malicious bookmark on the Fomo website, which led to the theft of login tokens and wallet credentials. The attack involved a fake human verification process that tricked the user into executing JavaScript code from a bookmarklet.
Crypto trader Frogman reported that two of his wallets were compromised on October 7, 2026, resulting in a loss of approximately $4 million in digital assets. The stolen funds were quickly moved through privacy tools and converted into ETH, BNB, and SOL. The trader does not yet know how the breach occurred.
An on-chain investigation by analyst Wazz has uncovered a syndicate responsible for at least 53 token launches on Robinhood Chain, resulting in an estimated $18.43 million in rug pulls since the chain's launch in July 2026. The syndicate allegedly used coordinated wallet networks and hype campaigns to manipulate token prices before extracting funds.
A report by Kairos Research examines GHO and sGHO as potential backing assets for USDe, noting that while GHO's peg has held and Aave is overcollateralized, there are concerns about exit liquidity. The report highlights an asymmetry between minting and redemption capacities in Aave's stability modules, with exit capacity being significantly lower than minting capacity, particularly on the Ethereum chain.
The exploiter from the Term Labs exploit, which resulted in an $8.5M loss on August 23, 2026, has deposited 400 ETH (worth $982,400) into Tornado Cash. This brings their total deposits into Tornado Cash to 960 ETH (worth approximately $2.35M).
Stabl.fi Cash (CASH) depegged to $0.8973, a deviation of over 10% from its USD peg. This is the second consecutive check where the deviation exceeded the 10% threshold.
A suspicious outflow of $1.284 million USDC was detected on August 11th from a vultisig-related address. Approximately $1.092 million USDC was swapped for ETH and deposited into Tornado Cash.
Solido Cash on Supra was exploited due to an oracle misconfiguration, resulting in a loss of approximately $900,000.
ZetaChain's GatewayEVM contract was attacked on April 27, affecting only internal team wallets and resulting in an estimated loss of $334,000 across four chains. Cross-chain transactions were temporarily suspended but have been re-enabled after a patch was deployed and monitoring confirmed safety. No user funds were affected.
DeFi yield protocol Cyrus Finance on BNB Chain was exploited via a flash loan attack that manipulated the PancakeSwap V3 ETH/USDT pool spot price, leading to an over-extraction of liquidity and a profit of approximately $516,840 for the attacker.
The DeFi protocol Neutrl announced its frontend was compromised via a DNS hijack and supply chain attack. Users were advised to revoke approvals and refrain from interacting with the website until further notice. No losses have been reported.
Veil.Cash, a privacy protocol on Base, suffered an exploit on its legacy privacy pools due to a misconfigured zk-SNARK verifier, allowing an attacker to drain approximately 2.9 ETH (~$5,000). Whitehats and the exploiter returned the funds, resulting in a 100% recovery. The project's newer pools were unaffected.
The IPOR USDC Fusion Optimizer on Arbitrum experienced a smart contract vulnerability allowing arbitrary external calls, resulting in a loss of approximately $336,000 USDC from an older vault version. The IPOR DAO will cover the deficit, and the funds were later recovered through a white-hat security event with a bounty agreement.