NEAR Intents: the $3.8M came back — partly in Monero

The attacker who drained about $3.8 million from NEAR Intents on October 1 returned the funds split across two routes: roughly 78% in Bitcoin and the rest in Monero, general manager Alex Shevchenko said on Unchained in an episode recorded October 8.

The on-chain record flagged the split early: independent analyst Kuncoro checked the published return addresses on October 2 and found the Bitcoin address had received 34.59 BTC — about 78% of the total — concluding the rest "came back through a different" route. Shevchenko confirmed it: the non-Bitcoin portion "in fact they have been traded into XMR." One reason the attacker made contact, he said, was to ask for the Monero address to return the funds.

The protocol has already refilled its smart contracts from its own funds, but converting the returned XMR into USDT is proving harder than getting it back. "They're asking for the source of funds, and what are we gonna say the source of funds?" Shevchenko said of the counterparties now questioning the team. He did not say how much arrived in Monero. The two sides established a private channel after the attacker sent an on-chain message: Shevchenko posted an encrypted message containing a Signal group invite, encrypted with the attacker's public key so only they could decrypt it. Since the exploit, NEAR Intents has received several bug bounty submissions — one valid, and it will be paid.

Full coverage of the incident: the October 1 exploit, the attacker's full return and the closed probe.

Ledger/CryptoBilis: tally passes $86M; OneKey cuts the reseller

Web3 Is Going Just Great, which catalogs crypto hacks and exploits, now tallies at least $86 million stolen through tampered Ledger hardware wallets sold by the Southeast Asian reseller CryptoBilis, as relayed by KuCoin on October 13. Ledger maintains that its own systems and direct sales channels were untouched and that all confirmed cases involve devices sold through the reseller, with roughly 300 wallets drained across Bitcoin, Ethereum and Tron by analyst estimate.

The fallout widened today: OneKey terminated CryptoBilis's dealer authorization, froze new dealer signups, ordered a full re-review of its reseller network and offered free replacements for devices bought from the reseller since March 1 — with dealers showing "unverifiable operating entities or unclear ultimate beneficiaries" to be delisted. Full story: OneKey cuts CryptoBilis and orders full reseller purge.

One predictable secondary attack is already here: fake Ledger websites and apps surfacing in search results to phish frightened device owners. TrustGrade covered the first confirmed case on October 11. Incident-related "support" outreach is the threat, not the fix.

AhsayCBS backup flaws exploited to mine Monero

Threat actors are exploiting two recently disclosed flaws in the AhsayCBS backup utility — CVE-2026-105133, an improper authentication weakness in the checkSysPwd() function, and CVE-2026-105134, an OS command injection — to take over affected servers, Huntress reported October 8, with coverage by BleepingComputer and SecurityWeek.

After gaining access, the attacker performed reconnaissance, dropped a Java Server Page webshell into the application directory served by the CBS application, and downloaded an XMRig cryptocurrency miner disguised as edge.exe. The takeaway for crypto-adjacent infrastructure is unglamorous but real: backup consoles and remote-access appliances are perimeter assets that end up guarding keys, seed backups and treasury data. Huntress urges operators to update and to restrict access to the CBS console — the same hardening advice that followed September's NetScaler zero-day.

Two-week loss count: $422M

Crypto Economy counts an estimated $422 million in losses across at least twelve major security incidents in the two-week stretch that closed October 11 — an aggregator tally, but one whose components (Bitget, the CryptoBilis wallet drain, and the protocol exploits covered in this digest among them) are individually documented. The number that matters more than the total: how much of it traces back to key compromise and supply-chain failure rather than novel smart-contract bugs. The answer this month is most of it.

TrustGrade tracks the security posture of platforms and protocols in digital assets. Verified trust data: trustgrade.ai.