News linked to both this project and an event.
According to official reports, privacy blockchain project Pirate Chain disclosed that it suffered a transaction verification vulnerability exploit, resulting in the unauthorized minting of approximately 39.8 million ARRR and an increase in the total token supply of about 20%. The attacker transferred the newly minted funds into the Sapling shielded pool, after which part of the funds flowed into the NonKYC exchange, with related deposit accounts restricted from withdrawals; due to the shielding features of the transactions, the complete subsequent flow of funds cannot be traced.
Odaily News: Crypto hardware wallet company Ledger will launch the Atom in mid-2027. The device supports running apps such as WhatsApp and Instagram, and can switch between smartphone functionality and a protected digital asset management mode.The Atom will feature a tamper-resistant casing, sensors, and specialized packaging, which can help prevent supply chain attacks like the recent CryptoBilis vulnerability even when the device is powered off.Ledger initially plans to sell the Atom exclusively through its official website to reduce third-party distribution risks, but will not offer trade-in services for customers affected by the vulnerability. (CoinDesk)
Odaily News: According to Bitcoin News monitoring, Bitcoin News released a podcast in which former Mt. Gox CEO Mark Karpelès and Foundation CEO Zach Herbert discussed the largest supply chain attack in crypto industry history. Mark Karpelès stated that he discovered the spy implant 3 weeks before the funds were stolen and contacted Ledger, but received no response. The implant had a built-in hidden cellular modem that could directly read the seed phrase on the screen and passed Ledger's own checks; even setting a passphrase could not prevent the seed phrase from being stolen. Mark Karpelès said that with $5 million, he could create an implant that would only be detectable through X-ray. The episode also discussed the hardware wallet reseller model, the Malaysian reseller behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The episode timeline shows that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.
According to monitoring by CryptoQuant analyst nocoffeenobrain, coins with a holding age of 1–3 years and over 3 years began showing signs of activity as early as late September, coinciding with BTC prices rising from the mid-$70,000 range to the mid-$80,000 range. Following the recent Ledger hack, which prompted numerous users to migrate assets to new signing devices and replace their seed phrases, the 7-day moving average is expected to climb further over the next few days. The analyst noted that a similar pattern occurred previously: during January to February this year, when BTC dropped from $90,000 to the mid-$60,000 range, and between July and August while BTC consolidated around the mid-$60,000 range, both of these holding age cohorts exhibited synchronized activity.
Hardware wallet manufacturer Trezor has announced that, in light of recent supply chain security incidents, the company has decided to reduce the number of its resellers in order to conduct more effective vetting of its partners.Trezor emphasized that there is currently no evidence suggesting its devices have been compromised, and that this adjustment is a precautionary measure taken out of an abundance of caution.
Odaily reports, according to monitoring by Bitcoin News, @0xJohannes stated that a Ledger hardware wallet purchased from an official European reseller several weeks ago was found to contain an unauthorized spy implant device. Suspicious wiring not present in genuine Ledger hardware was discovered inside the device, indicating it may have been physically tampered with before being sold. The implant appears to be an older version, as newer versions typically conceal the components behind the screen. Funds in the affected device have not been stolen thus far. Suspected cases have currently been reported in Asia, South America, and Europe. If the original secure element remains intact, Ledger's Genuine Check software cannot detect unauthorized physical modifications.
Odaily News: Crypto analyst Darkfost posted that following the security incident involving Ledger reseller CryptoBilis, other potentially related reseller names have emerged in community discussions, including some Lazada merchants.Darkfost stated that the full scope of the incident remains difficult to confirm. Although Ledger has confirmed a connection to the CryptoBilis incident, it is still unclear whether CryptoBilis is the only affected reseller. He compiled a list of potentially risky Ledger resellers, noting that due to their regional proximity, there is a possibility that their supply chains were compromised simultaneously. However, Darkfost emphasized that these assessments are speculative and have not yet been confirmed.Darkfost advised that if users have purchased Ledger devices from the relevant resellers within the past 6 months, they may consider moving their assets to other secure devices before the investigation concludes. He also noted that users can refer to a guide published by security researcher MagicalTux to check their Ledger devices for signs of tampering.
Odaily reports: Bitcoin News posted on X platform that Ledger has confirmed at least one affected user's device contained an unauthorized hardware implant, and is currently investigating the matter with relevant authorities and SEAL_911. Hardware wallet reseller CryptoBilis has suspended sales of all hardware wallets. Ledger stated there is currently no indication that its internal security infrastructure, systems, or services have been compromised. Ledger advises users who purchased devices from CryptoBilis and have not yet completed setup to refrain from doing so; users who have already completed setup should consider generating a new seed phrase and transferring their Bitcoin to a new hardware wallet. Ledger also stated it is developing additional tamper-proof protections.
Odaily News: According to monitoring by Galaxy's head of research, the Bitcoin losses caused by the Ledger cryptocurrency supply chain attack currently amount to 213.42 BTC, valued at $17.7 million. Of this, 92% of the funds were transferred in less than 90 days ago, while some funds were transferred even earlier. All Bitcoin traced so far remains unspent and is held in 3 aggregation addresses.
Odaily News — According to monitoring by Bitcoin News, former Mt. Gox CEO Mark Karpelès may have inadvertently triggered a coordinated transfer of funds across multiple wallets after publicly disclosing physical tampering with Ledger devices equipped with hidden surveillance implants. On October 8, Karpelès warned that counterfeit or tampered Ledger devices with hidden SIM cards were being sold on the market, and these SIM cards were capable of transmitting stolen seed phrases. The implants were reportedly able to intercept data sent to the device screen, thereby capturing the recovery phrases displayed to users during wallet setup. Such devices could allegedly still pass Ledger's official genuine product verification, because the original secure element remained intact and the verification process was unable to detect unauthorized physical modifications. One emerging speculation is that attackers collected seed phrases from affected devices and waited to simultaneously transfer funds from multiple wallets. Karpelès's warning reportedly received approximately 90,000 views, which may have made the attackers aware that their operation had been exposed and prompted them to move the stolen funds. Karpelès stated that one affected Ledger device he examined came from Malaysia, was packaged in intact shrink wrap, and had an implant hidden beneath the screen. The suspected attack path is currently a compromised hardware supply chain rather than a vulnerability in cryptographic algorithms. The connection between Karpelès's warning and the subsequent wallet fund transfers has not yet been confirmed, nor has it been verified whether the same batch of implants was responsible. If the relevant circumstances are confirmed, the incident would demonstrate that even if a device is certified by the manufacturer, compromised hardware can still undermine users' self-custody security.
Odaily News: According to PeckShield monitoring, the attacker behind 79AU's operational hot wallet 79thVault has returned 15,000 BNB, worth approximately $11 million, to a wallet address designated by the project team. Additionally, the attacker had previously deposited 30 BNB into KuCoin. The disposition of the remaining funds is currently unclear. Earlier, 79thVault on BNB Chain suffered losses of approximately $12.5 million, possibly due to a private key leak. The team's operational hot wallet typically only makes small transfers to the reward pool, but recently the address transferred 2.01 million 79AU from trading pairs to external addresses in 7 transactions, with amounts of 10,000, 100,000, 100,000, 300,000, 500,000, 500,000, and 500,000 tokens respectively.
According to Spot On Chain monitoring, a vault on the Base chain was attacked, with losses expanding to approximately $6 million, involving around 1,783 wstETH. The attacker added a new contract to the vault's whitelist, borrowed aBaswstETH, and transferred it to an attacker-controlled contract.
According to Spot On Chain monitoring, the losses from the vault attack on Base chain have expanded to approximately $6 million, involving about 1,783 wstETH. The attacker added a new contract to the vault's whitelist, borrowed aBaswstETH from the vault, and transferred it to the attacker's contract. The attacker's address is a certain address. Spot On Chain stated that systemic risk is currently limited, but caution is needed regarding the potential short-term pressure on the peg of liquid staking tokens caused by the attacker selling off wstETH.
According to Blockaid monitoring, a vault on the Base chain is currently under attack. The attacker added a brand-new contract to the vault's whitelist, then borrowed aBaswstETH and transferred it to the attacker's contract. The attack is still ongoing, and approximately 4 transactions have resulted in about $2.02 million in assets being stolen.
Odaily reports: The privacy-focused public chain Zano team has stated that in response to the inflation vulnerability discovered last Friday, a hotfix has been deployed, and the network is now running stably on the updated chain. The chain previously rolled back the block height to 3,833,000, erasing 30 days of previously confirmed transaction records.The Zano team stated that third-party wallets, exchanges, and payment service providers must first update their own nodes to the updated chain before they can safely resume transfers of ZANO and Zano-issued assets. Service providers will announce recovery progress through official channels, and recovery procedures for affected users are being prepared.The native asset ZANO has dropped 32% in price this week and 40.6% since the start of 2026. Zano's official X account stated that users can update their iOS, Android, and desktop wallets, and the team will soon release more details on the recovery process. (Bitcoin.com News)
MistTrack monitoring indicates that a Bitget attacker recently attempted to transfer stolen funds through the cross-chain liquidity network Chainflip, but the deposit was rejected by the relevant broker (Broker). The platform did not freeze the funds, but instead executed a return to the originating address. MistTrack stated it will continue to track the subsequent flow of the stolen funds.
Odaily News: Cross-chain protocol Chainlink has released CCIP 2.0, allowing enterprises to add their own security checks for cross-blockchain transfers on top of its default network of 16 operator validators.The upgrade comes after Kelp DAO suffered a $292 million hack in April, an incident attributed to a LayerZero cross-chain bridge setup using a single validator; Kelp DAO subsequently migrated its rsETH token to Chainlink.Chainlink's risk management network no longer operates as a standalone security safeguard, and users who do not add their own validators will rely on one validation network rather than two. (CoinDesk)
DYORSWAP has released an "Official Statement Regarding the Fake GIWA Mainnet 9134 Incident," stating that the incident was not a DYOR contract vulnerability, but rather was caused by a fraudulent network impersonating GIWA Chain 9134. This network had a bridge and batcher similar to OP Stack, deployed on September 27, 2026, at 02:10:59 (UTC+8). Approximately 8.5 hours before deployment, the address received about 0.045 ETH from a ChangeHero-related address. Data shows that a total of 1,335 addresses bridged approximately 767.65 ETH to it, of which about 766.25 ETH was ultimately transferred out from the cross-chain bridge.DYORSWAP stated that it has already used its own funds to compensate affected users with over 200 ETH. Additionally, the team is still tracking the cross-chain bridge deployer, the source of funds, early test wallets, and the subsequent flow of the transferred funds.
MistTrack (@MistTrack_io) disclosed that, following the transfer of nearly $1.2 billion in stolen funds from last year's $1.46 billion Bybit hack via THORChain, Bitget has recently suffered another major security breach, with stolen funds suspected of again flowing through THORChain. In response, the official THORChain team stated that its protocol is a decentralized, permissionless network, just like Bitcoin, Ethereum, and BNB Chain.
Odaily News: Today, THORChain officially posted on X platform stating, "We have noticed the recent Bitget hack and are deeply saddened by it. We can imagine this is a difficult time for everyone in the industry. (However,) THORChain is as decentralized and permissionless as Bitcoin, Ethereum, and BNB Chain. When dealing with known stolen funds, what responsibility should Bitcoin, Ethereum, and BNB Chain bear?" Subsequently, it called out OKX CEO Star and Bitget CEO Gracy.However, crypto community members in the comments pointed out that when THORChain previously suffered an attack, it once suspended services for 39 days, and they are deeply ashamed of the differentiated treatment between the two situations.