{
 "source": "https://cryptowalletguide.at/wallet-security-incidents/",
 "license": "CC BY 4.0",
 "entries": [
  {
   "date": "2026-10-09",
   "wallet": "Ledger",
   "wallet_slug": "ledger",
   "type": "supply-chain",
   "users_affected": "Hundreds of addresses (Galaxy: ~477; Bitquery: ~315 wallets)",
   "loss_usd": "~$86M–$93M (Specter, Galaxy ~$91M, Bitquery ~$93M on-chain estimates; not confirmed by Ledger)",
   "summary": "Ledger devices sold through CryptoBilis, a Southeast Asian reseller listed as authorised by Ledger, carried a hidden implant that read the 24-word phrase during setup and sent it out over a cellular (LTE) module; Ledger confirmed the implant in a statement dated 10 Oct. CryptoBilis suspended sales, Ledger told owners of its devices to move funds to a new device with a new seed, and on 13 Oct asked resellers in seven Asian markets to pull stock. MediaMarktSaturn also halted Ledger sales. Ledger's documentation says Genuine Check verifies the secure element and cannot detect physical modifications.",
   "source": "https://cryptoslate.com/ledger-confirms-hidden-implant-in-crypto-wallet-as-93-million-theft-investigation-widens/"
  },
  {
   "date": "2026-10-01",
   "wallet": "MetaMask",
   "wallet_slug": "metamask",
   "type": "other",
   "users_affected": "Not disclosed (staking validators)",
   "loss_usd": "None reported",
   "summary": "MetaMask disclosed an 'ongoing security incident' affecting part of its infrastructure and began exiting validators in its non-custodial staking service (including its validators in Lido, expected to finish exiting by 7 Oct) as a precaution. It said it had found no evidence that wallets or customer funds were affected and did not disclose the cause.",
   "source": "https://thehackernews.com/2026/10/metamask-security-incident-prompts-exit.html"
  },
  {
   "date": "2026-09-09",
   "wallet": "Trezor",
   "wallet_slug": "trezor",
   "type": "phishing",
   "users_affected": "347,000 newsletter emails; ~2,500 clicked",
   "loss_usd": "",
   "summary": "Attackers breached Trezor's email-marketing provider Brevo and sent phishing emails from help@trezor.io about a fake STM32 'microcontroller vulnerability' that led to a seed-phrase stealing page. Trezor took the domain down within about 20 minutes, suspended its Brevo account and said no other Trezor system was touched.",
   "source": "https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/"
  },
  {
   "date": "2026-08-16",
   "wallet": "SafePal",
   "wallet_slug": "safepal",
   "type": "data-leak",
   "users_affected": "39,798 customers",
   "loss_usd": "",
   "summary": "An attacker abused an authorization flaw in an order-tracking plug-in on SafePal's web shop and took names, emails, phone numbers, shipping addresses and order details for orders from Mar 2025 to Apr 2026; seed phrases and keys were not exposed. SafePal fixed the flaw, hired an outside security firm and took down more than 30 phishing sites.",
   "source": "https://bleepingcomputer.com/news/security/safepal-data-breach-impacts-39-798-customers-stolen-info-for-sale"
  },
  {
   "date": "2026-08-11",
   "wallet": "Rabby Wallet (browser extension)",
   "wallet_slug": "rabby",
   "type": "vulnerability",
   "users_affected": "Extension users with the 10-minute auto-lock setting",
   "loss_usd": "None reported",
   "summary": "Researcher V12 reported a 'silent signature extraction' flaw in the Rabby extension: a malicious site the user had connected to could obtain signatures without a prompt when the auto-lock timer was set to 10 minutes. Rabby released a fix on 11 Aug 2026, said the mobile app was not affected and reported no known exploitation.",
   "source": "https://techflowpost.com/en-US/newsletter/132723"
  },
  {
   "date": "2026-08-10",
   "wallet": "Trezor",
   "wallet_slug": "trezor",
   "type": "data-leak",
   "users_affected": "~81,000 customers (~14,000 disclosed 13 Aug, incl. 11,742 full exposure; 67,000 more US customers added 7 Sep)",
   "loss_usd": "",
   "summary": "Trezor's logistics provider ShipMonk was breached through a Metabase vulnerability, exposing names, emails, phone numbers and shipping addresses for orders placed 10 May to 8 Aug 2026. On 7 Sep Trezor said data on 67,000 US customers who ordered between Nov 2019 and Aug 2021 was also exposed because ShipMonk had not deleted it. Trezor said its own systems and devices were not compromised and warned of follow-on phishing.",
   "source": "https://bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers"
  },
  {
   "date": "2026-07-30",
   "wallet": "Coldcard (Coinkite)",
   "wallet_slug": "coldcard",
   "type": "vulnerability",
   "users_affected": ">5,200 addresses",
   "loss_usd": "~$116M / ~1,816 BTC (TRM, citing Galaxy's preliminary tally); Galaxy said losses could reach ~$130M",
   "summary": "A build configuration error dating to Coldcard firmware 4.0.1 (March 2021) made seeds on affected Mk2/Mk3, and to a lesser degree Mk4, Mk5 and Q firmware, come from a weak software RNG instead of the hardware entropy source, so they could be brute-forced; thefts started 30 Jul 2026. Coinkite shipped fixed firmware on 31 Jul (Mk3 4.2.0, Mk4/Mk5 5.6.0, Q 1.5.0Q) and told owners of exposed seeds to create a new seed and move funds; the update protects new seeds only.",
   "source": "https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"
  },
  {
   "date": "2026-07-24",
   "wallet": "Sparrow Wallet (impersonated)",
   "wallet_slug": "sparrow",
   "type": "fake-app",
   "users_affected": "3 plaintiffs",
   "loss_usd": "~$1.8M alleged",
   "summary": "Three users sued Apple in federal court in California, alleging a fake 'Sparrow Wallet' iOS app (the real Sparrow has no iOS version) stole their seed phrases and bitcoin in mid-2025. Apple declined to comment on the suit but said there were currently no Sparrow Wallet copycats on the App Store.",
   "source": "https://decrypt.co/374628/apple-sued-after-fake-iphone-wallet-app-drained-1-8m-in-bitcoin"
  },
  {
   "date": "2026-06-03",
   "wallet": "Trezor (Safe 7, TROPIC01 chip)",
   "wallet_slug": "trezor",
   "type": "vulnerability",
   "users_affected": "Trezor Safe 7 owners",
   "loss_usd": "None reported",
   "summary": "Ledger's Donjon found a laser fault-injection flaw in the TROPIC01 secure chip used in the Trezor Safe 7; it needs physical possession, decapsulation and lab equipment, and cannot be fixed by firmware on existing chips. Trezor said wallet keys and the backup are not stored on that chip, so funds, the PIN and the backup cannot be revealed, and that users need take no action.",
   "source": "https://trezor.io/blog/news/Trezor-response-TROPIC01-chip-disclosure-no-impact-to-your-funds"
  },
  {
   "date": "2026-04-20",
   "wallet": "Multiple (MetaMask, Ledger, Trust Wallet, Coinbase and others impersonated)",
   "wallet_slug": "",
   "type": "fake-app",
   "users_affected": "",
   "loss_usd": "",
   "summary": "Kaspersky reported 26 fake wallet apps on Apple's App Store, part of a campaign active since at least autumn 2025. They pushed users to install trojanized wallet builds via a developer profile, or asked for the recovery phrase on fake screens.",
   "source": "https://kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets"
  },
  {
   "date": "2026-04-07",
   "wallet": "Ledger (impersonated)",
   "wallet_slug": "ledger",
   "type": "fake-app",
   "users_affected": ">50 users",
   "loss_usd": "~$9.5M",
   "summary": "A fake Ledger Live app on Apple's Mac App Store collected recovery phrases; ZachXBT tied about $9.5M in thefts between 7 and 13 Apr 2026 to it, with three victims losing over $1M each. Apple removed the listing without explaining how it passed review.",
   "source": "https://theblock.co/post/397388/fake-ledger-app-apple-app-store-crypto-theft-bitcoin-tron-solana-zachxb"
  },
  {
   "date": "2026-02-14",
   "wallet": "Trezor, Ledger",
   "wallet_slug": "",
   "type": "phishing",
   "users_affected": "",
   "loss_usd": "",
   "summary": "Physical letters on fake Trezor and Ledger letterhead said a mandatory 'Authentication Check' or 'Transaction Check' was required and used QR codes to send recipients to phishing sites that collected recovery phrases. Both vendors say they never ask for a recovery phrase.",
   "source": "https://bleepingcomputer.com/news/security/snail-mail-letters-target-trezor-and-ledger-users-in-crypto-theft-attacks"
  },
  {
   "date": "2026-01-05",
   "wallet": "Ledger",
   "wallet_slug": "ledger",
   "type": "data-leak",
   "users_affected": "Not disclosed",
   "loss_usd": "",
   "summary": "Global-e, the payment processor for some Ledger.com orders, was breached and customer names and contact details were exposed. Ledger said its own hardware, software and platform were not breached and that no funds were at risk.",
   "source": "https://bravenewcoin.com/insights/ledger-hardware-wallet-users-hit-by-third-party-data-breach"
  },
  {
   "date": "2025-12-24",
   "wallet": "Trust Wallet (browser extension)",
   "wallet_slug": "trust-wallet",
   "type": "supply-chain",
   "users_affected": "2,520 drained addresses (Trust Wallet update; 2,596 in its first count)",
   "loss_usd": "~$8.5M linked to attacker wallets (Trust Wallet update); ~$7M in its first estimate",
   "summary": "A malicious Chrome extension v2.68, published outside Trust Wallet's own release process, exfiltrated recovery phrases from users who logged in between 24 and 26 Dec. Trust Wallet says it has high confidence the attack stemmed from the Nov 2025 Sha1-Hulud npm worm, which exposed developer GitHub secrets and a Chrome Web Store API key. It shipped v2.69, revoked its release APIs, took down the exfiltration domain and opened a claims process to reimburse affected users.",
   "source": "https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update"
  },
  {
   "date": "2025-12-20",
   "wallet": "General (address poisoning)",
   "wallet_slug": "",
   "type": "phishing",
   "users_affected": "1 user",
   "loss_usd": "~$50M (49,999,950 USDT)",
   "summary": "A trader copied a lookalike address planted in their transaction history by an address-poisoning script and sent nearly $50M USDT to it after a small test transfer. The attacker laundered the funds via DAI, ETH and Tornado Cash; the victim offered a $1M bounty.",
   "source": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return"
  },
  {
   "date": "2025-12-16",
   "wallet": "Exodus",
   "wallet_slug": "exodus",
   "type": "policy",
   "users_affected": "",
   "loss_usd": "None (compliance case; $3,103,360 settlement)",
   "summary": "The US Treasury's OFAC announced a $3,103,360 settlement with Exodus Movement over 254 apparent violations of Iran sanctions (12 deemed egregious). Between Oct 2017 and Jan 2019 Exodus support staff helped users in Iran, in some cases helping them reach partner exchanges and on 12 occasions suggesting VPNs. Not a hack; no user funds were affected.",
   "source": "https://ofac.treasury.gov/recent-actions/20251216_33"
  },
  {
   "date": "2025-09-08",
   "wallet": "General (npm supply chain)",
   "wallet_slug": "",
   "type": "supply-chain",
   "users_affected": "Packages with >2B weekly downloads",
   "loss_usd": "~$600 (Socket)",
   "summary": "After phishing a maintainer, attackers published malicious versions of chalk, debug and about 18 other npm packages. The code hooked window.ethereum and network calls in browsers to swap crypto recipient addresses. The malicious versions were caught quickly and earned the attackers very little.",
   "source": "https://thehackernews.com/2025/09/20-popular-npm-packages-with-2-billion.html"
  },
  {
   "date": "2025-06-23",
   "wallet": "Trezor",
   "wallet_slug": "trezor",
   "type": "phishing",
   "users_affected": "",
   "loss_usd": "",
   "summary": "Attackers submitted Trezor support-form requests in victims' names so that Trezor's own auto-reply emails carried phishing content. Trezor said its systems and data were not accessed, had the phishing site taken down and said it was working to prevent further abuse.",
   "source": "https://www.theblock.co/post/359172/trezor-phishing-scam"
  },
  {
   "date": "2025-05-07",
   "wallet": "General (Inferno Drainer)",
   "wallet_slug": "",
   "type": "drainer",
   "users_affected": ">30,000 wallets",
   "loss_usd": ">$9M over ~6 months",
   "summary": "Check Point reported that Inferno Drainer was back in use, lured victims through fake Collab.Land Discord verification pages and had added single-use contracts and encrypted on-chain configuration to avoid detection.",
   "source": "https://decrypt.co/318561/inferno-drainer-malware-returns-stealing-9m-from-crypto-wallets-in-six-months"
  },
  {
   "date": "2025-04",
   "wallet": "Ledger",
   "wallet_slug": "ledger",
   "type": "phishing",
   "users_affected": "",
   "loss_usd": "",
   "summary": "Ledger users received physical letters demanding a 'mandatory wallet validation' via QR code and recovery-phrase entry. Ledger confirmed the letters were a scam and said it never asks for the 24 words.",
   "source": "https://www.theblock.co/post/352479/ledger-confirms-physical-scam-letters-requesting-seed-phrase"
  },
  {
   "date": "2025-03-05",
   "wallet": "Trezor",
   "wallet_slug": "trezor",
   "type": "vulnerability",
   "users_affected": "Older Safe 3 units (mainly secondhand)",
   "loss_usd": "",
   "summary": "Ledger's Donjon showed that voltage glitching a desoldered microcontroller could bypass some supply-chain protections on the older Trezor Safe 3. Trezor disclosed the issue, called it hard to exploit, pointed to passphrases and firmware checks, and noted that the Safe 5 uses a glitch-resistant chip.",
   "source": "https://www.theblock.co/post/346018/trezor-discloses-vulnerability-safe-3-crypto-wallet-rival-ledger"
  },
  {
   "date": "2025-02-21",
   "wallet": "Safe{Wallet} (Bybit)",
   "wallet_slug": "safe",
   "type": "supply-chain",
   "users_affected": "Bybit (1 institution)",
   "loss_usd": "~$1.5B",
   "summary": "Attackers attributed to Lazarus compromised a Safe{Wallet} developer's machine and changed front-end JavaScript in Safe's AWS S3 bucket, which made Bybit's signers approve a disguised malicious transaction on its cold wallet. Safe rebuilt its infrastructure, rotated all credentials and restored service, and said its smart contracts were not vulnerable.",
   "source": "https://slowmist.medium.com/bybits-1-5-billion-theft-unveiled-safe-wallet-front-end-code-tampered-84b78f0fa9c2"
  },
  {
   "date": "2025-02-06",
   "wallet": "General (SparkCat)",
   "wallet_slug": "",
   "type": "fake-app",
   "users_affected": ">242,000 Google Play downloads",
   "loss_usd": "",
   "summary": "Kaspersky found the SparkCat SDK in App Store and Google Play apps; it used on-device OCR to find screenshots of recovery phrases in photo galleries and upload them. Both stores removed the apps.",
   "source": "https://thehackernews.com/2025/02/sparkcat-malware-uses-ocr-to-extract.html"
  },
  {
   "date": "2025-01-21",
   "wallet": "Ledger",
   "wallet_slug": "ledger",
   "type": "other",
   "users_affected": "Ledger co-founder David Balland and partner",
   "loss_usd": "Ransom partly paid; most seized",
   "summary": "Balland and his partner were kidnapped in France for a crypto ransom and freed by police within days, after Balland's finger was injured; ten suspects were arrested. It is a prominent case in the rise of physical 'wrench attacks' against crypto holders.",
   "source": "https://www.thelocal.fr/20250124/french-police-arrest-10-over-crypto-executives-kidnapping"
  },
  {
   "date": "2025-01",
   "wallet": "General (address poisoning)",
   "wallet_slug": "",
   "type": "phishing",
   "users_affected": "17M targeted",
   "loss_usd": ">$83.8M (6,633 incidents)",
   "summary": "A USENIX Security 2025 study measured about 270 million address-poisoning attempts on Ethereum and BSC over roughly two years, with at least $83.8M lost.",
   "source": "https://arxiv.org/abs/2501.16681v1"
  },
  {
   "date": "2024-12-30",
   "wallet": "Tangem",
   "wallet_slug": "tangem",
   "type": "vulnerability",
   "users_affected": "<0.1% of users",
   "loss_usd": "None reported",
   "summary": "A mobile-app logging bug wrote private keys into logs when a user created a seed-phrase wallet, and those logs could reach Tangem support. Tangem fixed it on 30 Dec 2024, deleted the support logs, contacted affected users and said no funds were lost, but was criticised for saying little publicly.",
   "source": "https://cointelegraph.com/news/tangem-security-vulnerability-fixed-private-key-leak"
  },
  {
   "date": "2024-09",
   "wallet": "WalletConnect (impersonated)",
   "wallet_slug": "",
   "type": "fake-app",
   "users_affected": ">150 victims; >10,000 downloads",
   "loss_usd": "~$70,000",
   "summary": "Check Point found a fake 'WalletConnect' app on Google Play that drained wallets for about five months, the first mobile-only crypto drainer it had seen. The app was removed.",
   "source": "https://thehackernews.com/2024/09/crypto-scam-app-disguised-as.html"
  },
  {
   "date": "2024-05-17",
   "wallet": "General (Pink Drainer)",
   "wallet_slug": "",
   "type": "drainer",
   "users_affected": ">21,000 victims",
   "loss_usd": "~$85M",
   "summary": "Pink Drainer, a drainer-as-a-service operation known for hijacking Discord and X accounts, announced it was shutting down after about $85M in thefts (ScamSniffer).",
   "source": "https://www.theblock.co/post/295041/pink-drainer-shutting-down"
  },
  {
   "date": "2024-05-03",
   "wallet": "General (address poisoning)",
   "wallet_slug": "",
   "type": "phishing",
   "users_affected": "1 user",
   "loss_usd": "~$68M WBTC (returned)",
   "summary": "A whale sent $68M in WBTC to a poisoned lookalike address. After on-chain negotiations, the attacker returned almost all of the funds within about a week.",
   "source": "https://unchainedcrypto.com/68-million-stolen-in-dust-attack-returned-to-victim/"
  },
  {
   "date": "2024-02-12",
   "wallet": "Safe (abused by Angel Drainer)",
   "wallet_slug": "safe",
   "type": "drainer",
   "users_affected": "128 wallets",
   "loss_usd": "~$403,000",
   "summary": "Angel Drainer deployed a malicious Safe vault contract and got victims to sign Permit2 approvals, with Etherscan's 'verified' badge giving false reassurance. Blockaid said Safe itself was not attacked.",
   "source": "https://cointelegraph.com/news/angel-drainer-attack-gnosis-safe-vault-contract-etherscan"
  },
  {
   "date": "2024-02-06",
   "wallet": "Exodus (impersonated)",
   "wallet_slug": "exodus",
   "type": "fake-app",
   "users_affected": "",
   "loss_usd": "~9 BTC (~$490K, unverified)",
   "summary": "A fake 'Exodus' wallet snap on Ubuntu's Snap Store stole recovery phrases; Canonical quarantined it after a 12 Feb report. A fake Ledger Live snap in Sept 2023 had cost one user about $10K.",
   "source": "https://blog.popey.com/2024/02/exodus-bitcoin-wallet-490k-swindle/"
  },
  {
   "date": "2024-01-17",
   "wallet": "Trezor",
   "wallet_slug": "trezor",
   "type": "data-leak",
   "users_affected": "~66,000 support contacts",
   "loss_usd": "None reported",
   "summary": "An attacker accessed a third-party support-ticketing portal and exposed names and emails of people who had contacted Trezor support since Dec 2021; at least 41 received seed-phrase phishing. Trezor emailed affected users and said no assets were compromised.",
   "source": "https://forklog.com/en/data-breach-affects-66000-trezor-users/"
  },
  {
   "date": "2023-12-14",
   "wallet": "Ledger (Connect Kit)",
   "wallet_slug": "ledger",
   "type": "supply-chain",
   "users_affected": "Users of dApps such as SushiSwap and Revoke.cash",
   "loss_usd": "~$600,000",
   "summary": "A phished former employee's npm account was used to publish a malicious Ledger Connect Kit that injected a drainer into dApps using the library. Ledger pushed a fix, pledged to compensate victims fully and announced it would phase out blind signing in favour of Clear Signing.",
   "source": "https://cointelegraph.com/news/ledger-reimburse-connect-kit-exploit"
  },
  {
   "date": "2023-12-12",
   "wallet": "OKX Wallet / OKX DEX",
   "wallet_slug": "okx-wallet",
   "type": "hack",
   "users_affected": "",
   "loss_usd": "~$2.7M",
   "summary": "A suspected leak of a proxy-admin key let attackers upgrade a deprecated OKX DEX contract and drain tokens users had approved. OKX revoked the permissions and pledged to reimburse affected users.",
   "source": "https://www.theblock.co/post/267405/okx-dex-suffers-apparent-2-7-million-exploit-following-suspected-private-key-leak"
  },
  {
   "date": "2023-11-14",
   "wallet": "General (BitcoinJS 'Randstorm')",
   "wallet_slug": "",
   "type": "vulnerability",
   "users_affected": ">1M wallets created 2011–2015",
   "loss_usd": "~$2.1B estimated at risk",
   "summary": "Unciphered disclosed 'Randstorm', weak randomness in BitcoinJS-based browser wallets generated in 2011–2015 (from JSBN SecureRandom and browser Math.random) that may let keys be brute-forced. Owners were told to move funds.",
   "source": "https://forklog.com/en/unciphered-highlights-2-1-billion-risks-in-bitcoinjs-wallets/"
  },
  {
   "date": "2023-11",
   "wallet": "General (Inferno Drainer)",
   "wallet_slug": "",
   "type": "drainer",
   "users_affected": "",
   "loss_usd": ">$80M (ScamSniffer)",
   "summary": "Inferno Drainer, active from Nov 2022 and spoofing more than 100 crypto brands across over 16,000 phishing domains, announced its shutdown in Nov 2023 (Group-IB).",
   "source": "https://www.group-ib.com/media-center/press-releases/inferno-drainer"
  },
  {
   "date": "2023-10-19",
   "wallet": "Ledger Live (impersonated)",
   "wallet_slug": "ledger",
   "type": "fake-app",
   "users_affected": "",
   "loss_usd": "~$768,000",
   "summary": "A fake Ledger Live app on the Microsoft Store from 19 Oct 2023 stole recovery phrases, as flagged by ZachXBT. Microsoft removed it.",
   "source": "https://www.bitdefender.com/blog/hotforsecurity/rogue-developer-steals-768-000-in-crypto-with-fake-ledger-live-app/"
  },
  {
   "date": "2023-09-05",
   "wallet": "General (LastPass breach)",
   "wallet_slug": "",
   "type": "data-leak",
   "users_affected": ">150 victims",
   "loss_usd": ">$35M",
   "summary": "Researchers linked a series of crypto thefts to seed phrases kept in LastPass vaults stolen in the 2022 breach and cracked offline. They said the link was likely but not conclusive.",
   "source": "https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/"
  },
  {
   "date": "2023-08-08",
   "wallet": "Libbitcoin Explorer (bx) — 'Milk Sad'",
   "wallet_slug": "",
   "type": "vulnerability",
   "users_affected": "~2,600 BTC wallets",
   "loss_usd": ">$900,000",
   "summary": "The `bx seed` command used a time-seeded PRNG with only 32 bits of entropy (CVE-2023-39910), so seeds could be brute-forced. Libbitcoin disputed that it was a bug, citing its documentation warnings.",
   "source": "https://unchainedcrypto.com/milk-sad-issue-results-in-900000-stolen-from-crypto-wallets/"
  },
  {
   "date": "2023-06-03",
   "wallet": "Atomic Wallet",
   "wallet_slug": "atomic-wallet",
   "type": "hack",
   "users_affected": "<0.1% of ~5M users (Atomic); >5,000 wallets (Elliptic)",
   "loss_usd": ">$100M (Elliptic)",
   "summary": "Funds were drained from thousands of Atomic Wallet users in an attack Elliptic attributed to North Korea's Lazarus Group. Atomic never confirmed a root cause, listing four possible vectors; it worked with exchanges, Chainalysis and Crystal to freeze funds and did not announce reimbursement.",
   "source": "https://decrypt.co/145765/atomic-wallet-claims-less-than-0-1-of-users-affected-by-100m-hack"
  },
  {
   "date": "2023-05",
   "wallet": "Ledger (Recover)",
   "wallet_slug": "ledger",
   "type": "policy",
   "users_affected": "",
   "loss_usd": "",
   "summary": "Ledger announced Ledger Recover (16 May 2023), an optional paid service that encrypts and splits the seed phrase across three custodians. Users objected that firmware could extract keys, and CEO Pascal Gauthier apologised for the communication, promised faster open-sourcing and delayed the launch.",
   "source": "https://forklog.com/en/news/ledger-to-publish-recover-protocol-code-amid-negative-user-reaction"
  },
  {
   "date": "2023-04-22",
   "wallet": "Trust Wallet (browser extension)",
   "wallet_slug": "trust-wallet",
   "type": "vulnerability",
   "users_affected": "Wallets created 14–23 Nov 2022 in the extension",
   "loss_usd": "~$170,000",
   "summary": "A WebAssembly entropy flaw in Trust Wallet Core made some extension-generated wallets guessable, and two exploits followed. Trust Wallet fixed the issue, secured most at-risk funds and set up reimbursements.",
   "source": "https://www.theblock.co/post/227730/trust-wallet-vulnerability-fix"
  },
  {
   "date": "2023-02",
   "wallet": "OneKey",
   "wallet_slug": "onekey",
   "type": "vulnerability",
   "users_affected": "OneKey Mini owners",
   "loss_usd": "None reported",
   "summary": "Unciphered published a video of extracting secrets from a OneKey Mini through a firmware flaw in about one second. OneKey said it had fixed the flaw.",
   "source": "https://www.unciphered.com/onekey-says-it-has-fixed-flaw-that-got-its-hardware-wallet-hacked-in-1-second"
  },
  {
   "date": "2022-12",
   "wallet": "BitKeep (now Bitget Wallet)",
   "wallet_slug": "bitget-wallet",
   "type": "fake-app",
   "users_affected": "",
   "loss_usd": "~$8M",
   "summary": "Trojanized BitKeep Android APKs spread through phishing sites stole private keys; the Google Play version was not affected.",
   "source": "https://www.halborn.com/blog/post/explained-the-bitkeep-hack-december-2022"
  },
  {
   "date": "2022-10-18",
   "wallet": "BitKeep Swap (now Bitget Wallet)",
   "wallet_slug": "bitget-wallet",
   "type": "hack",
   "users_affected": "",
   "loss_usd": "~$1M",
   "summary": "BitKeep's Swap feature was exploited on BNB Chain and Polygon. BitKeep suspended Swap and promised 100% compensation through a claims portal.",
   "source": "https://web3.bitget.com/blog/articles/6692"
  },
  {
   "date": "2022-10-11",
   "wallet": "Rabby Wallet",
   "wallet_slug": "rabby",
   "type": "hack",
   "users_affected": "Users who had approved Rabby Swap",
   "loss_usd": "Not disclosed",
   "summary": "Less than a month after launch, an exploit in the Rabby Swap router contract drained tokens users had approved. Rabby told Swap users to revoke all approvals.",
   "source": "https://theblock.co/post/176284/rabby-wallet-exploit-prompts-users-to-revoke-access"
  },
  {
   "date": "2022-09-20",
   "wallet": "Profanity vanity addresses (Wintermute)",
   "wallet_slug": "",
   "type": "vulnerability",
   "users_affected": "Wintermute and other Profanity users",
   "loss_usd": "~$160M (Wintermute)",
   "summary": "Market maker Wintermute lost $160M, widely attributed to its admin hot wallet being a Profanity-generated vanity address whose key could be brute-forced. 1inch had disclosed the Profanity flaw a week earlier.",
   "source": "https://www.theblock.co/post/171192/experts-blame-a-vanity-address-bug-for-wintermutes-160-million-hack"
  },
  {
   "date": "2022-08-02",
   "wallet": "Slope Wallet",
   "wallet_slug": "slope",
   "type": "vulnerability",
   "users_affected": "~8,000–9,000 Solana wallets",
   "loss_usd": "~$4M–$5M+",
   "summary": "Slope's mobile app sent seed phrases to a Sentry logging server where they were stored unencrypted (Otter Sec). Slope told users to move funds; Phantom said its systems were not compromised and affected Phantom users had imported Slope seeds.",
   "source": "https://www.theblock.co/post/161425/slope-wallet-provider-saved-user-seed-phrases-in-plain-text-solana-security-researchers-find"
  },
  {
   "date": "2022-06-16",
   "wallet": "MetaMask, Phantom (and Brave)",
   "wallet_slug": "metamask",
   "type": "vulnerability",
   "users_affected": "",
   "loss_usd": "None reported",
   "summary": "Halborn's 'Demonic' disclosure showed browser 'restore session' files could store seed phrases unencrypted on disk. MetaMask and Phantom shipped fixes.",
   "source": "https://www.theblock.co/post/152374/metamask-and-phantom-crypto-wallets-fix-browser-extension-vulnerability"
  },
  {
   "date": "2022-04-17",
   "wallet": "MetaMask (iOS)",
   "wallet_slug": "metamask",
   "type": "phishing",
   "users_affected": "1 user publicised",
   "loss_usd": "~$650,000 claimed",
   "summary": "A phone scam took over a user's Apple ID and used the iCloud backup of his MetaMask vault to drain the wallet. MetaMask warned users and published steps to turn off iCloud backup for the app.",
   "source": "https://decrypt.co/98078/metamask-warns-users-apple-icloud-phishing-scam"
  },
  {
   "date": "2022-04-03",
   "wallet": "Trezor",
   "wallet_slug": "trezor",
   "type": "phishing",
   "users_affected": "",
   "loss_usd": "",
   "summary": "An insider-assisted breach at Mailchimp led to Trezor customers receiving phishing emails that pushed a fake 'Trezor Suite' app designed to steal seed phrases. Trezor took the domain down and paused newsletters.",
   "source": "https://siliconrepublic.com/enterprise/mailchimp-hack-data-breach-trezor-crypto-wallet"
  },
  {
   "date": "2021-06-16",
   "wallet": "Ledger",
   "wallet_slug": "ledger",
   "type": "phishing",
   "users_affected": "",
   "loss_usd": "",
   "summary": "Using data from the 2020 leak, criminals mailed tampered fake Ledger Nano X 'replacement' devices that told victims to run software and enter their recovery phrase. Ledger reiterated that it never asks for the phrase.",
   "source": "https://www.bleepingcomputer.com/news/cryptocurrency/criminals-are-mailing-altered-ledger-devices-to-steal-cryptocurrency"
  },
  {
   "date": "2021-01-22",
   "wallet": "Trezor (impersonated)",
   "wallet_slug": "trezor",
   "type": "fake-app",
   "users_affected": "~1,000 App Store downloads",
   "loss_usd": ">$1M (one victim lost 17.1 BTC)",
   "summary": "A fake 'Trezor' app on Apple's App Store from 22 Jan to 3 Feb 2021 harvested seed phrases; a similar fake appeared on Google Play.",
   "source": "https://www.malwarebytes.com/blog/news/2021/04/fake-trezor-app-steals-more-that-1-million-worth-of-crypto-coins"
  },
  {
   "date": "2020-12-20",
   "wallet": "Ledger",
   "wallet_slug": "ledger",
   "type": "data-leak",
   "users_affected": "~272,000 postal addresses/phones; >1M emails",
   "loss_usd": "",
   "summary": "The Ledger e-commerce database stolen in June 2020 was dumped publicly on RaidForums, fuelling years of phishing, extortion and fake-device campaigns. Ledger had disabled the abused API key and notified France's CNIL in July 2020.",
   "source": "https://decrypt.co/52118/hacked-ledger-database-dumped-on-raidforums"
  },
  {
   "date": "2020-03-24",
   "wallet": "General (unlimited token approvals)",
   "wallet_slug": "",
   "type": "vulnerability",
   "users_affected": "",
   "loss_usd": "",
   "summary": "ZenGo showed that most dApp wallets granted unlimited ERC-20 allowances that a rogue dApp could later drain. Trust Wallet said it would upgrade; MetaMask and Brave already offered advanced allowance controls.",
   "source": "https://cointelegraph.com/news/zengo-warns-of-major-security-flaw-among-dapp-wallets"
  },
  {
   "date": "2020-01-31",
   "wallet": "Trezor",
   "wallet_slug": "trezor",
   "type": "vulnerability",
   "users_affected": "Trezor One / Model T owners",
   "loss_usd": "None reported",
   "summary": "Kraken Security Labs extracted encrypted seeds from Trezor devices in under 15 minutes of physical access using voltage glitching; the microcontroller flaw cannot be patched. Trezor said a BIP39 passphrase defeats the attack.",
   "source": "https://www.theblock.co/post/54631/kraken-security-labs-hackers-can-exploit-trezor-hardware-wallets-with-only-15-minutes-of-physical-access-to-the-device"
  },
  {
   "date": "2019-04",
   "wallet": "Electrum",
   "wallet_slug": "electrum",
   "type": "other",
   "users_affected": "Botnet of >25,000 IPs",
   "loss_usd": "",
   "summary": "A botnet spread via Smoke Loader/RIG DDoSed honest Electrum servers to push old clients onto malicious phishing servers. Electrum used a DoS flaw in pre-3.3 clients to force upgrades and published guidance for server operators.",
   "source": "https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege"
  },
  {
   "date": "2019-02-22",
   "wallet": "Coinomi",
   "wallet_slug": "coinomi",
   "type": "vulnerability",
   "users_affected": "",
   "loss_usd": "None confirmed (claimant cited $60–70K)",
   "summary": "A user showed that Coinomi's desktop wallet sent restore-field text, including seed phrases, to Google's spellcheck API. Coinomi blamed a misconfigured plug-in and patched it on 22 Feb 2019.",
   "source": "https://www.theblock.co/news/regulation/2019-02-27-coinomi-user-claims-critical-vulnerability-in-wallet-exposes-private-keys-company-releases-official-response-13689"
  },
  {
   "date": "2018-12-27",
   "wallet": "Trezor, Ledger",
   "wallet_slug": "",
   "type": "vulnerability",
   "users_affected": "",
   "loss_usd": "None reported",
   "summary": "The wallet.fail team showed attacks on the Trezor One (key extraction without a passphrase) and Ledger Nano S/Blue at 35C3. Trezor promised a firmware fix and criticised the lack of coordinated disclosure.",
   "source": "https://www.crowdfundinsider.com/2018/12/142809-researchers-hack-top-cryptocurrency-hardware-wallets/"
  },
  {
   "date": "2018-12-21",
   "wallet": "Electrum",
   "wallet_slug": "electrum",
   "type": "phishing",
   "users_affected": "",
   "loss_usd": ">771 BTC (~$4M) through 2019",
   "summary": "Malicious Electrum servers abused the client's ability to display rich-text error messages to show fake 'update' prompts linking to trojanized wallets that stole seeds or redirected payments. Electrum fixed the issue in 3.3.3/3.3.4 and later forced upgrades.",
   "source": "https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege"
  }
 ]
}