crypto theft

October 18 2026

Attackers stole $102 million from Ledger wallets by tampering with devices before resale

BlockWest News Team Digital Assets, Security & Hacks crypto theft, cryptocurrency security, hardware wallet compromise, Ledger vulnerability, supply chain attack

A widespread tampering campaign targeting Ledger hardware wallets through Southeast Asian resellers has exposed a fundamental vulnerability in the supply chain of self-custody devices. Attackers intercepted recovery phrases during wallet setup by installing hidden electronics, stealing an estimated $102 million from hundreds of customers who believed their private keys were physically isolated from the internet.

Attackers stole an estimated $102 million from 324 wallets across six networks by intercepting 24 recovery words during setup.
Hidden electronics embedded inside genuine Ledger devices used an LTE connection to transmit recovery phrases displayed on screens.
Ledger’s device verification tools cannot detect physical modifications inside the casing when the genuine security chip remains intact.

$102M Estimated total stolen across 324 compromised wallets by Bitquery analysis.
324 Number of affected wallets identified in the attack spanning six blockchain networks.
Oct. 10 Date Ledger confirmed an unauthorized implant in a customer’s hardware device.
24 Recovery words that must be kept secret and offline to protect wallet access.

In early October, customers in Southeast Asia discovered cryptocurrency missing from Ledger hardware wallets that remained fully functional. According to reporting by CryptoSlate, the devices had been purchased through CryptoBilis, an authorized reseller operating in Malaysia, Indonesia, and the Philippines. The customers believed their private keys were protected by tamper-resistant hardware, unaware that attackers had inserted a second piece of electronics inside the device casing before it reached their hands.

On October 10, Ledger confirmed that one customer’s device contained an unauthorized hardware implant.

Three days later, Ledger’s security team disclosed how the attack worked. The added electronics intercepted the wallet’s 24 recovery words as they appeared on the screen during initial setup and transmitted them over a mobile connection using an embedded SIM card. The device’s protected security chip, operating system, and transaction signatures remained unchanged and authentic. Blockchain analytics firm Bitquery estimates that attackers stole $102 million from 324 wallets across six networks, though Ledger has not confirmed this total or verified that every loss originated from an implanted device.

Recovery phrases exposed at the moment they first appear on screen

Hardware wallets do not store cryptocurrency directly. Coins remain on their respective blockchains, and the device’s sole function is to protect the private keys needed to authorize transactions, keeping those secrets isolated from malware on internet-connected computers and phones. When an owner approves a payment, the wallet signs the transaction cryptographically without exposing the keys to the computer.

This separation creates one critical vulnerability: the recovery phrase. During setup, Ledger devices display 24 words that can reconstruct the wallet and all its keys if the hardware is lost or damaged. Owners are instructed to write the phrase down, store it offline, and never share it. Anyone with access to those 24 words can restore the same accounts on another device, and a PIN protecting the original wallet will not prevent this. The CryptoBilis implant was engineered specifically for the brief window when these words appeared on the screen. A small controller intercepted the signal being sent to the display, reconstructed the complete recovery phrase, and transmitted it via LTE using an embedded SIM card inserted into the device. The attack required no breach of the protected chip, no deception of the owner, and no fake website. An owner could complete setup normally, use the wallet to approve legitimate transactions, and have no indication that someone else held an identical copy of the recovery words.

An optional additional passphrase can protect accounts created with it, but standard accounts are secured by the recovery words alone.

Device verification cannot detect components added inside the casing

Ledger’s Genuine Check feature verifies that a device contains an authentic Secure Element, the chip responsible for sensitive security operations. It can identify a counterfeit chip, but it cannot inspect every component inside the casing or prove that nothing has been added since manufacture. Ledger’s own security documentation warns that physical modifications may escape detection when the original chip remains intact, and this weakness was precisely what the implant exploited: the device could truthfully report on its Secure Element while concealing the extra circuitry beside it.

Tibane Labs examined modified Ledger Nano X devices fitted with electronics that monitored signals between the secure chip and the screen. More sophisticated specimens used a custom board hidden beneath the display and kept the device’s original battery, preventing detection through casual inspection. These specimens were separate from the CryptoBilis investigation and do not prove the same devices or attackers were involved, but they demonstrate why an authentic chip, correct signatures, and a normal-appearing wallet do not constitute proof that the entire device remains untampered.

Attackers intercepted genuine devices between manufacture and customer delivery

CryptoBilis was an authorized reseller operating across Malaysia, Indonesia, and the Philippines. Customers were not taking a reckless shortcut by buying through an authorized seller, as Ledger itself recommends this purchasing method. That makes this case more consequential than a counterfeit wallet bought from an anonymous seller: the question became whether a product could be trusted after passing through distributors, retailers, and anyone else with access to inventory.

In an October 15 update, Ledger said attackers bought genuine devices over several months, opened them, fitted custom components, and returned them to distribution through Southeast Asian resellers. The company described the incident as an attack on the distribution channel and stated that samples checked in warehouses and stores showed no tampering. Ledger asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales, tightened controls on returned products, and requested that sellers keep devices off display shelves. These measures acknowledge how critical physical access becomes when attackers can modify a product without altering the software inside it.

Germany’s MediaMarktSaturn suspended Ledger sales following a report of a tampered device, while rival wallet maker Trezor moved to reduce its reseller network despite finding no evidence that its own products were compromised.

Blockchain records cannot identify who tampered with devices before sale

Bitquery found that 25 Tron wallets signed the same approval within three seconds, a pattern consistent with someone already controlling multiple accounts. Blockchain records alone cannot identify who opened a package, installed a component, or returned a device to a shop. Investigating such a breach requires hardware examinations and distribution records that may never be fully disclosed.

For anyone who may have received a compromised wallet, the critical distinction lies between the device itself and the recovery phrase. A PIN protects the original device from unauthorized use, but it does nothing to prevent someone from restoring the same keys elsewhere. Buying a new hardware device and entering the old 24 words recreates the same risk. The only solution is to move assets to accounts generated from a fresh recovery phrase on a trusted device, using carefully verified addresses and instructions. Ledger has told customers who bought from CryptoBilis not to initialize unused devices and advised those who already set them up to transfer funds to a new signer with a new phrase, using only official support channels and preserving potentially relevant evidence.

The BlockWest read. Self-custody removes the need to trust an exchange with private keys, but not the need to trust the hardware that creates and displays them. The distribution chain, the supply warehouse, and the reseller shelf are now part of the security boundary. This incident signals that hardware wallet buyers must evaluate not only the device manufacturer’s engineering but also the integrity of every link between the factory and their hands.

Ledger has not disclosed whether it has identified additional tampered devices beyond those Bitquery flagged, whether it is working with law enforcement to trace the attackers, or whether it plans to redesign the wallet setup process to eliminate the moment when recovery words appear on an untrusted screen.

October 2 2026

Crypto thefts reach $2.7 billion in 2026 as North Korea-linked hackers dominate losses

BlockWest News Team Digital Assets, Security & Hacks blockchain, crypto theft, cryptocurrency, cybersecurity, north korea

Crypto security incidents have cost the industry nearly $2.7 billion in 2026, with a handful of mega-breaches at exchanges and protocols driving most of the damage. North Korea-linked hackers account for more than a third of that total, a concentration that is reshaping how firms assess and insure against theft.

CertiK recorded 658 security incidents through September, with $420.4 million later frozen or returned
Bitget’s $387.5 million breach and the $318.7 million Liquid Network incident together exceeded $700 million
Elliptic says suspected North Korean hackers stole more than $1 billion across over 51 incidents in 2026

$2.7B total 2026 crypto losses, down to $2.26B after recoveries
$1B+ North Korea-linked thefts, over 37% of CertiK’s tally
$766.5M September losses, topping April’s prior high of $651.3M
$1.46B Bybit theft in February 2025, the largest confirmed crypto heist on record

Crypto firms and users have lost roughly $2.7 billion to hacks, exploits and fraud so far this year, according to CryptoSlate reported, citing data from blockchain security firm CertiK. Blockchain analytics firm Elliptic separately puts the share tied to North Korea above $1 billion, a threshold it says underscores how dependent the industry’s annual loss figures have become on a small number of state-linked attacks.

CertiK’s dashboard logged 658 security incidents through September. About $420.4 million of stolen funds have since been frozen or returned, cutting the adjusted loss figure to roughly $2.26 billion, or an average of $4.1 million per incident.

September becomes 2026’s costliest month at $766.5 million

Losses spiked sharply last month, reaching about $766.5 million and surpassing April’s prior high of $651.3 million as the year’s most damaging stretch. Two incidents did most of the work: the $387.5 million Bitget breach and the $318.7 million Liquid Network exploit, which together accounted for more than $700 million, equivalent to over a quarter of all gross losses CertiK has tracked in 2026.

Bitget’s breach alone represents about 14.4% of CertiK’s year-to-date losses and now ranks as 2026’s single largest reported crypto incident. It is followed by Liquid Network, then KelpDAO at $291.3 million, Drift Protocol at $285.3 million, and an unidentified victim at $284.8 million. Those five incidents total roughly $1.57 billion, or almost 59% of the $2.68 billion CertiK has recorded this year.

Recoveries have softened some of the blow. Liquid Network clawed back a large share of the stolen assets, and other incidents produced partial or full returns, which is why CertiK’s adjusted total runs about $420 million below the gross figure. That recovery, however, does not erase the operational cost: affected platforms still had to suspend services, replenish customer balances and rebuild systems before any funds came back.

North Korea’s crypto theft crosses $1 billion for the year

Elliptic says the Bitget breach pushed thefts it attributes to North Korea past $1 billion in 2026, spread across more than 51 suspected incidents, according to the firm’s analysis. Measured against CertiK’s $2.68 billion industrywide gross-loss figure, that tally equals more than 37% of this year’s total security losses. Elliptic assessed the Bitget attack as highly likely linked to the Democratic People’s Republic of Korea, citing laundering behavior and infrastructure shared with earlier operations.

Elliptic previously linked the roughly $286 million Drift Protocol exploit to North Korean actors, putting suspected DPRK operations behind more than one of 2026’s five largest crypto thefts.

The campaign extends a pattern stretching back nearly a decade. Elliptic estimated last year that DPRK-linked hackers have stolen more than $6 billion in crypto since 2017, with governments saying the proceeds help fund North Korea’s nuclear weapons and ballistic missile programs, a concern the US Treasury has flagged in designating Lazarus Group and related units as operations controlled by North Korea’s Reconnaissance General Bureau. US authorities previously tied Lazarus to the roughly $620 million Ronin Bridge theft in 2022 and to laundering proceeds from the $100 million Atomic Wallet attack.

Wrench attacks and the shadow of a $1.46 billion record

The escalation of state-linked hacking peaked in February 2025, when attackers stole about $1.46 billion from Bybit, the largest confirmed crypto theft on record. The FBI formally attributed that breach to North Korea, and Elliptic tracked the subsequent laundering of funds through thousands of addresses and cross-chain services.

Physical theft has grown too. CertiK recorded 52 so-called wrench attacks in the first half of 2026, up from 39 a year earlier, with exposure climbing to $124.2 million from $10.5 million and the average loss per incident rising to about $2.4 million from roughly $270,000.

CertiK’s annual data also show incidents spanning multiple blockchains have produced the largest dollar losses, while Ethereum has logged the greatest number of discrete security events. North Korean operators, Elliptic says, are increasingly relying on repeated cross-chain transfers and mixers to break the transaction trail as exchanges and analytics firms get faster at freezing stolen assets.

The BlockWest read. The concentration in these numbers matters more for insurers and exchange treasuries than for headline totals. When five incidents drive 59% of a year’s losses, underwriting and custody decisions should price for tail risk at a handful of large venues rather than for an average breach, and boards should treat state-linked actors as a distinct, higher-severity category requiring separate controls and capital buffers.

Elliptic’s North Korea tally and CertiK’s loss dashboard are both live counts that will keep moving as 2026 closes, and neither firm has indicated the pace of attacks is slowing. The open question for exchanges and protocols is whether faster freezing and recovery, which has already clawed back $420.4 million this year, can keep up with the size of individual breaches before the next nine-figure incident resets the annual tally again.

September 11 2026

XRP project closes following security breach that compromised 4,000 accounts and resulted in $450,000 in losses

BlockWest News Team Digital Assets, Security & Hacks blockchain security, crypto theft, cryptocurrency security, wallet vulnerability, XRP Ledger

A healthcare platform built on XRP Ledger is shutting down after a critical wallet vulnerability drained approximately $450,000 from thousands of user accounts. The incident underscores persistent security risks in decentralized applications and highlights challenges facing blockchain startups even as recovery and investigation efforts continue.

XRPH Wallet flaw exposed 4,010 user accounts and resulted in roughly $450,000 in stolen assets between September 3 and 4.
The vulnerability reduced the cryptographic keyspace from the intended 2^128 to approximately 2^46, enabling attackers to derive private keys from public information.
XRP Healthcare will delist tokens and cease operations while pursuing recovery efforts and coordinating with exchanges, platforms, and authorities.

$450,000 Value of stolen assets moved to collector account during the breach
4,010 User wallets classified as victims after the mass sweep attack
2^46 Effective cryptographic keyspace after bug versus intended 2^128
Sept. 3 Date the XRPH Wallet incident occurred and funds were drained

XRP Healthcare announced its operational shutdown on September 10, citing the wallet vulnerability alongside existing pressures including prolonged market downturn, elevated development costs, and a failed public-listing attempt. The platform disclosed that a flaw in how its XRPH Wallet application generated user credentials had enabled attackers to systematically drain accounts over a 48-hour window. Analytics service XRPL.to traced 10,281 payments across this period, originating from what the company determined to be 4,010 compromised wallets sending funds to a single collector address.

The incident represents one of the most significant security failures within the XRP Ledger ecosystem and demonstrates how implementation errors in cryptocurrency wallet design can rapidly compromise user funds at scale. Even as blockchain technology matures, wallet security remains a critical vulnerability, particularly for platforms that manage both crypto assets and sensitive personal health information.

How The Wallet Flaw Collapsed Cryptographic Security

XRP Healthcare’s investigation identified the root cause: the application passed a 55-character string into xrpl.Wallet.fromEntropy(), a function designed to accept raw bytes as input. Only the first 16 characters were retained by the system, leaving 39 characters unused and drastically reducing the effective entropy to approximately 72.9 trillion possible combinations, or roughly 2^46, versus the intended 2^128 security level.

The developers also discovered that the wallet generation process relied on Math.random(), a function known to have limited cryptographic strength compared to secure random number generators, potentially reducing the practical search space further. Using only public information and a partial scan of the reduced keyspace, the team successfully reproduced private keys for nine live wallets, including four that had already been drained. This reproduction required no access to user devices or the underlying XRP Ledger protocol itself.

The flaw meant that users could not protect exposed wallets simply by importing the same seed phrase into different software applications.

The vulnerability illustrates a common pitfall in blockchain development: cryptographic security requires precision at every step of key generation and storage. Small oversights in how entropy is passed between functions or how random number generators are selected can cascade into catastrophic failures affecting thousands of users. Security audits and code reviews by external specialists are increasingly viewed as essential for platforms handling user assets.

Stolen Assets Traced To Ethereum Address

The attack resulted in the movement of approximately 267,664 XRP, 23.2 million XRPH tokens, and 2.43 million XRPHAI tokens to the identified collector wallet. XRP Healthcare traced the stolen assets end-to-end to an Ethereum address holding roughly 445,198 DAI, providing a clear on-chain record of the funds’ destination.

The cross-chain movement of funds reflects how attackers often bridge stolen assets across multiple blockchains to obscure the trail and access liquidity on different platforms. Despite the transparency of blockchain ledgers, tracing and recovering funds remains challenging without cooperation from centralized exchange operators and law enforcement agencies equipped to handle cryptocurrency theft investigations.

The company has advised all affected users to abandon any credentials generated through XRPH Wallet and transfer remaining assets using newly created keys generated through secure methods. XRP Healthcare requested that affected users submit detailed factual reports on Etherscan, including transaction records documenting their drained wallets, to support ongoing recovery and investigation efforts.

Platform Delisting And Continued Coordination

XRP Healthcare announced plans to delist its native tokens, XRPH and XRPHAI, from exchanges, with individual platforms expected to establish their own withdrawal deadlines. The XRPH Wallet applications will remain offline, though the company stated it is retaining its intellectual property and global trademark portfolio.

The decision to retain intellectual property suggests the possibility that XRP Healthcare’s technology, once remediated, could be acquired or rebuilt under new ownership. However, the reputational damage from a major security breach typically makes it difficult for platforms to rebuild user trust, even with improved security measures.

Despite ceasing normal operations, the company said recovery efforts will continue in parallel with its wind-down. XRP Healthcare committed to ongoing coordination with exchanges, platforms, law enforcement authorities, and other parties while preserving all technical records and transaction documentation related to the incident.

The company has preserved technical and transaction records connected to the incident and will continue working with law enforcement and platform operators; affected users should monitor their email and official XRP Healthcare channels for exchange-specific withdrawal deadlines and recovery procedures.

September 9 2026

Young Cryptocurrency Crime Boss Malone Lam, 22, Admits Guilt as Criminal Network Collapses

BlockWest News Team Digital Assets, Security & Hacks crypto theft, cryptocurrency crime, cybercrime, money laundering, RICO conspiracy

A 22-year-old Singaporean has pleaded guilty to leading an international cryptocurrency theft ring that stole and laundered over $245 million, marking a significant law enforcement success in tackling organized cybercrime targeting digital asset holders. The case reveals how criminal networks exploit social engineering and home invasions to compromise crypto wallets, then convert stolen funds into luxury spending across multiple jurisdictions.

Malone Lam pleaded guilty to RICO conspiracy charges for leading a $245 million crypto theft operation spanning October 2023 through May 2025.
The criminal enterprise used social engineering and home break-ins to target victims, with members recruited from online gaming platforms across multiple US states and countries.
Investigators will determine sentencing at a status hearing scheduled for December 8, 2026, as federal prosecutors pursue additional members of the conspiracy.

$245M Total cryptocurrency stolen and laundered by the international conspiracy ring
22 Age of Malone Lam, the conspiracy’s alleged ringleader and organizer
$500K Maximum amount spent in a single nightclub outing by stolen funds
Oct 2023 Month the criminal enterprise began operations, court documents allege

Malone Lam, a Singaporean national who had relocated to Miami, pleaded guilty in Washington, D.C., federal court to one count of participating in a RICO conspiracy involving the theft and laundering of more than $245 million in cryptocurrency. US Attorney Jeanine Ferris Pirro announced the plea following Lam’s appearance before US District Judge Colleen Kollar-Kotelly. Law enforcement arrested Lam on September 18, 2025, at his Miami rental home.

The case underscores the growing vulnerability of cryptocurrency holders to organized criminal networks that operate across international borders. Unlike traditional financial systems with built-in security protocols and regulatory oversight, cryptocurrency transactions often depend heavily on individual security practices and the integrity of digital wallet management. Once stolen assets enter the cryptocurrency ecosystem, their decentralized nature makes recovery challenging for law enforcement.

Social Engineering and Home Invasions Funded Luxury Spending Spree

Court documents describe a criminal operation that began no later than October 2023 and continued through at least May 2025, with members based across California, Connecticut, New York, Florida, and other countries. The group recruited participants through connections made on online gaming platforms, then relied on social engineering tactics and, in some cases, home break-ins to obtain information needed to compromise victims’ cryptocurrency wallets.

Social engineering attacks represent one of the most effective methods for targeting crypto asset holders because they exploit human psychology rather than technological vulnerabilities. Attackers typically pose as trusted parties, extract sensitive information through deception, or use that information to gain access to wallet recovery phrases and private keys. Home invasion tactics add a violent physical component to these digital crimes, elevating the risk profile for victims.

Rather than holding stolen funds, the conspiracy immediately converted them into high-end purchases and experiences. The group spent as much as $500,000 on a single night of nightclub services, purchased handbags worth tens of thousands of dollars to distribute at nightclub events, and acquired watches priced between $100,000 and $500,000. Members also rented homes in Los Angeles, the Hamptons, and Miami; hired private jets and private security details; purchased exotic cars valued between $100,000 and $3.8 million each; and spent tens of thousands on luxury apparel.

This conspicuous spending pattern, while providing immediate gratification for conspiracy members, also created multiple investigative opportunities for law enforcement. Cash-intensive luxury transactions, vehicle registrations, and high-end property rentals generate paper trails that financial investigators and intelligence agencies can follow. The rapid movement of funds through consumer channels contrasts sharply with traditional money laundering schemes that employ shell companies and cross-border transfers to obscure criminal proceeds.

Lam Allegedly Orchestrated Targeting and Role Assignment Across the Network

Lam, who operated under aliases including “Anne Hathaway,” “$$$,” and “King Greavy,” allegedly served as the conspiracy’s primary organizer and strategist. His responsibilities included identifying targets for theft and assigning specific roles and tasks to other members of the criminal network.

The use of multiple aliases reflects operational security practices common in organized cybercrime, allowing Lam to compartmentalize different aspects of the criminal enterprise and maintain plausible deniability. Recruiting participants through gaming platforms allowed the conspiracy to identify technically skilled individuals already accustomed to operating in online environments and managing digital identities.

If you build a cybercrime empire, we will find you, dismantle your operation, and hold you accountable. This defendant led an international network that preyed on victims through deception, invaded their privacy, and stole hundreds of millions of dollars in cryptocurrency.

Jeanine Ferris Pirro, US Attorney

Sentencing Delayed as Investigation Expands to Additional Conspirators

Judge Kollar-Kotelly scheduled a status hearing for December 8, 2026, to determine Lam’s sentencing date. The guilty plea suggests that federal authorities, working with the FBI and IRS Criminal Investigation division, continue pursuing other members of the conspiracy for their roles in the theft and money laundering scheme.

RICO conspiracy convictions carry substantial penalties, including lengthy prison sentences and substantial financial restitution obligations. Federal prosecutors often use RICO statutes in organized crime cases because they allow prosecution of enterprise leaders even when they did not directly commit every underlying crime. Lam’s conviction establishes his criminal liability regardless of which specific thefts he personally orchestrated.

The December 2026 hearing will establish the sentencing timeline for Lam and provide prosecutors an opportunity to update the court on ongoing investigations into co-conspirators and the recovery of stolen cryptocurrency assets.