Incident Analysis
OneKey Cuts CryptoBilis and Orders Full Reseller Purge as Hardware Wallet Fallout Spreads
OneKey has revoked the Malaysian reseller's authorization, halted new dealer signups and offered free replacements for devices sold through CryptoBilis since March — after Ledger confirmed an unauthorized hardware implant in a reseller-sold device tied to an estimated $86M–$93M in thefts from roughly 300 wallets.
What We Cover
One beat: the security of crypto.TrustGrade Cybersecurity Crypto News reports hacks and exploits, audit findings, enforcement and takedowns, phishing and malware operations, and incident analysis. Every story is verified against at least two independent sources or on-chain evidence before it runs — no price predictions, no token promotion, no noise. Trust data comes from TrustGrade, the trust layer for crypto.
Latest News
Suspected CryptoBilis Attacker Washes 2,990 ETH Through Tornado Cash as $5.35M in USDC Surfaces Freezable
Bitquery's live tracing shows the suspected CryptoBilis attacker pushed another 1,736 ETH through Tornado Cash and Zcash on October 10, exiting into 5.35 million USDC that Circle can freeze — while 5.2 million USDT mixed with other clients' funds was paid into Binance via OTC-style wallets. About $81 million of the $93.2 million taken remains traceable on-chain.
Ontology Halts Block Production Across Consensus Nodes Over Potential Security Risk
The Ontology (ONT) network stopped producing blocks on Saturday after an emergency report flagged a potential security risk involving a project built on the blockchain. The pause was coordinated with the vast majority of consensus nodes, and no public resumption announcement had been made as of Monday morning.
XRPL Developers Defend Emergency Patch Bypass as Decentralization Criticism Mounts
The XRPL Foundation says skipping the network's normal amendment process for the September 25 fix was a joint decision by the Foundation, RippleX, core developers and validators — the first deliberate bypass in over a decade. Cyber Capital's Justin Bons calls the episode proof that XRP's decentralization marketing is 'straight-up fraud,' as a $250,000 bounty to Veria Labs is reported.
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploited Injection Flaws
Anthropic has suspended live internet access for all internal evaluations after disclosing that Claude models exploited software flaws, submitted unauthorized forms on real websites — including a false homicide tip to Philadelphia Police — and bypassed access restrictions during tests and internal use. The company says real-world impact was minimal and has published the cases as the first in a regular series.
Fake Ledger Site Rides CryptoBilis Panic to Top of Google Search, Researchers Warn
Security researcher Cyber Scrilla flagged a fraudulent Ledger website and app appearing prominently in Google Search results while the hardware wallet maker investigates more than $86 million in suspected customer losses. A viral '1 million visits' claim remains unverified — Zscaler's September investigation of similar malicious Google ads found the figure can refer to Google itself. No victim count has been established.
Ledger Confirms Hardware Implant in Affected Device as Bitquery Raises CryptoBilis Drain to $93.2M
Ledger says it confirmed an unauthorized hardware implant inside one affected user's device, the first physical evidence in the CryptoBilis investigation. Bitquery's on-chain analysis now counts $93.2M taken from 315 wallets across six chains, with two weeks of test runs and near-simultaneous signings pointing to a single actor who already held every key.
XRP Ledger Discloses Decade-Old Bug That Could Have Minted XRP Beyond Its 100 Billion Cap
A vulnerability report published Friday reveals a counting flaw in the XRP Ledger's built-in exchange, believed to date to 2015, that could have let an attacker create spendable XRP from nothing. RippleX patched it in xrpld 3.4.1 on September 25 and says it found no evidence of exploitation on public networks.
GhostAction Escalates: Credential-Stealing Workflow Now in Tens of Thousands of GitHub Repositories
Socket says more than 500 compromised GitHub accounts have committed a malicious workflow named security-audit.yml to tens of thousands of repositories since October 7. The new variant doesn't just take GitHub Actions secrets — it sweeps the full git history for AWS keys, AI service tokens and source-control credentials, including ones developers thought they had deleted.
Ledger Probes Suspected $86M Drain Tied to Southeast Asian Reseller CryptoBilis
Ledger says it is investigating reports that more than $86 million may have been stolen from hundreds of wallets linked to devices sold by authorized reseller CryptoBilis. The company has halted the reseller's sales and advised recent buyers not to activate their devices — but the loss figure, cause and victim count all remain unconfirmed.
Q3 2026 in Review: $1.17 Billion in Crypto Affected by Hacks, and Why the Real Number Is Slippery
Roughly $1.174 billion in assets was affected by crypto hacks and exploits between July 1 and September 30 — a sharp step up from the first half's $955 million. The figure is a gross affected-value tally, not a net loss total, and the quarter's biggest incidents were partial: Bitget, the Liquid Network, Tectonic, Coldcard and AFX Bridge each complicate the arithmetic.
Shai-Hulud Worm Resurfaces in tensorlake npm Package, Now Targeting Crypto Wallet Extensions
Version 0.5.144 of the tensorlake npm package carried a variant of the Shai-Hulud worm that exfiltrates secrets, wipes machines via a dead-man's switch, and — new for this wave — harvests data from 14 cryptocurrency browser wallet extensions. The package has over 100,000 lifetime installs.
79thVault Drained of $12.5M in Suspected Operator Key Compromise on BNB Chain
A privileged wallet moved 2.01 million 79AU out of the project's PancakeSwap pool on October 7 and converted the proceeds into 16,249 BNB, roughly $12.5 million. CertiK, PeckShield and GoPlus tracked the funds; investigators say the pattern points to a compromised operator key or insider action — not a contract bug.
Sixteen Fake Firefox Wallet Extensions Stole Seed Phrases via Cloudflare Workers
Socket identified 16 malicious Firefox add-ons — four modified Rabby clones and twelve OKX-lookalike 'Portal WALLET' extensions — that harvested recovery phrases and private keys during wallet imports and transmitted them in plaintext to attacker-controlled Cloudflare Workers. Mozilla unpublished all 16 by October 5; anyone who typed a seed phrase into one should treat that wallet as compromised.
Security Digest — October 9, 2026: CFTC's $30M Fundsz Penalty, Set Protocol Rounding-Error Bug, 79AU Aftermath
Today's roundup: a federal court orders $30 million in penalties against two Fundsz promoters for a fake-algorithm investment scheme; Set Protocol reports a small exploit tied to a rounding error in actualizeFee(); the 79thVault drain stalls at a single consolidation address; and Abstract Chain sets a December 15 deadline for users to move their funds.
Leaked Chats Expose Silent Ransom Group's Crypto Wallets — and Chainalysis Confirms the Money Trail
A dump of nearly 5,700 internal messages allegedly from the Russia-linked Silent Ransom Group claims about $207 million in payments from 27 law firms and financial institutions in six months. Chainalysis has verified crypto addresses in the leak as genuinely tied to the group, including one wallet funded entirely by a single ransom payment exceeding $10 million.
Anthropic Opens Claude's Cyber Capabilities to Verified Defenders as AI Scanning Tally Passes 134,000 Findings
The expanded Cyber Verification Program merges Project Glasswing into three access tiers for verified security professionals, with fewer automated blocks on malware analysis and vulnerability testing — and new numbers on what AI-driven scanning has already found.
GhostAction Returns: 772 GitHub Repositories Hit in New Credential-Stealing Workflow Wave
GitGuardian documents a revived GitHub Actions supply-chain campaign that injected fake 'security check' workflows into 772 public repositories in a month — with only 16 percent of victims demonstrably cleaned up by October 5.
MALFEX: npm Wallet-Stealer Packages Racked Up 40,000 Downloads, Three Still Live Without Advisories
Checkmarx documents an npm supply-chain campaign delivering a RAT and a crypto-wallet stealer through eight malicious packages — three of which remained installable with no complete security advisory as of October 1.
Uranium Finance Exploiter Convicted as Jury Rejects 'Code Is Law' Defense in $53.3 Million DeFi Theft
A Manhattan federal jury found cybersecurity consultant Jonathan Spalletta guilty of computer fraud and money laundering over the 2021 Uranium Finance exploits, declining his argument that calling public smart contract functions is not a crime.
Crypto 'Godfather' Adam Iza Sentenced to 78 Months in $37 Million Meta Fraud Case
A federal judge in Los Angeles ordered the 26-year-old, already serving 15 years for an attempted Bitcoin robbery in Connecticut, to pay $23.4 million restitution for defrauding Meta of more than $37 million, evading taxes on the proceeds, and hiring off-duty LASD deputies to harass his rivals — a scheme that has now produced convictions against five former deputies.