Crypto wallet security incident tracker
As of 25 October 2026, we track 60 security incidents affecting popular self-custody wallets and their users since 2018, including 20 hacks, exploits or disclosed vulnerabilities and 5 supply-chain attacks. Most user losses came from phishing, drainers and fake apps rather than broken wallet cryptography.
Quick facts
- Safe{Wallet} (Bybit) (2025-02, ~$1.5B); Profanity vanity addresses (Wintermute) (2022-09, ~$160M); Coldcard (Coinkite) (2026-07, ~$116M); Atomic Wallet (2023-06, >$100M)
- What is the latest incident?
- 2026-10-09: Ledger devices sold through CryptoBilis, a Southeast Asian reseller listed as authorised by Ledger, carried a hidden implant that read the 24-word phrase during setup and sent it out over a cellular (LTE) module; Ledger confirmed the implant in a statement dated 10 Oct. CryptoBilis suspended sales, Ledger told owners of its devices to move funds to a new device with a new seed, and on 13 Oct asked resellers in seven Asian markets to pull stock. MediaMarktSaturn also halted Ledger sales. Ledger's documentation says Genuine Check verifies the secure element and cannot detect physical modifications.
- What is the main lesson?
- Most losses start outside the wallet's cryptography: phishing sites, fake apps, malicious approvals and compromised supply chains. Verify downloads, never type your seed phrase into a website, and check what you sign.
Timeline
| Date | Wallet | Type | Reported loss | What happened | Source |
|---|---|---|---|---|---|
| 2026-10-09 | Ledger | supply chain | ~$86M–$93M | Ledger devices sold through CryptoBilis, a Southeast Asian reseller listed as authorised by Ledger, carried a hidden implant that read the 24-word phrase during setup and sent it out over a cellular (LTE) module; Ledger confirmed the implant in a statement dated 10 Oct. CryptoBilis suspended sales, Ledger told owners of its devices to move funds to a new device with a new seed, and on 13 Oct asked resellers in seven Asian markets to pull stock. MediaMarktSaturn also halted Ledger sales. Ledger's documentation says Genuine Check verifies the secure element and cannot detect physical modifications. | cryptoslate.com |
| 2026-10-01 | MetaMask | other | — | MetaMask disclosed an 'ongoing security incident' affecting part of its infrastructure and began exiting validators in its non-custodial staking service (including its validators in Lido, expected to finish exiting by 7 Oct) as a precaution. It said it had found no evidence that wallets or customer funds were affected and did not disclose the cause. | thehackernews.com |
| 2026-09-09 | Trezor | phishing | — | Attackers breached Trezor's email-marketing provider Brevo and sent phishing emails from [email protected] about a fake STM32 'microcontroller vulnerability' that led to a seed-phrase stealing page. Trezor took the domain down within about 20 minutes, suspended its Brevo account and said no other Trezor system was touched. | bleepingcomputer.com |
| 2026-08-16 | SafePal | data leak | — | An attacker abused an authorization flaw in an order-tracking plug-in on SafePal's web shop and took names, emails, phone numbers, shipping addresses and order details for orders from Mar 2025 to Apr 2026; seed phrases and keys were not exposed. SafePal fixed the flaw, hired an outside security firm and took down more than 30 phishing sites. | bleepingcomputer.com |
| 2026-08-11 | Rabby Wallet (browser extension) | vulnerability | — | Researcher V12 reported a 'silent signature extraction' flaw in the Rabby extension: a malicious site the user had connected to could obtain signatures without a prompt when the auto-lock timer was set to 10 minutes. Rabby released a fix on 11 Aug 2026, said the mobile app was not affected and reported no known exploitation. | techflowpost.com |
| 2026-08-10 | Trezor | data leak | — | Trezor's logistics provider ShipMonk was breached through a Metabase vulnerability, exposing names, emails, phone numbers and shipping addresses for orders placed 10 May to 8 Aug 2026. On 7 Sep Trezor said data on 67,000 US customers who ordered between Nov 2019 and Aug 2021 was also exposed because ShipMonk had not deleted it. Trezor said its own systems and devices were not compromised and warned of follow-on phishing. | bleepingcomputer.com |
| 2026-07-30 | Coldcard (Coinkite) | vulnerability | ~$116M | A build configuration error dating to Coldcard firmware 4.0.1 (March 2021) made seeds on affected Mk2/Mk3, and to a lesser degree Mk4, Mk5 and Q firmware, come from a weak software RNG instead of the hardware entropy source, so they could be brute-forced; thefts started 30 Jul 2026. Coinkite shipped fixed firmware on 31 Jul (Mk3 4.2.0, Mk4/Mk5 5.6.0, Q 1.5.0Q) and told owners of exposed seeds to create a new seed and move funds; the update protects new seeds only. | trmlabs.com |
| 2026-07-24 | Sparrow Wallet (impersonated) | fake app | ~$1.8M | Three users sued Apple in federal court in California, alleging a fake 'Sparrow Wallet' iOS app (the real Sparrow has no iOS version) stole their seed phrases and bitcoin in mid-2025. Apple declined to comment on the suit but said there were currently no Sparrow Wallet copycats on the App Store. | decrypt.co |
| 2026-06-03 | Trezor (Safe 7, TROPIC01 chip) | vulnerability | — | Ledger's Donjon found a laser fault-injection flaw in the TROPIC01 secure chip used in the Trezor Safe 7; it needs physical possession, decapsulation and lab equipment, and cannot be fixed by firmware on existing chips. Trezor said wallet keys and the backup are not stored on that chip, so funds, the PIN and the backup cannot be revealed, and that users need take no action. | trezor.io |
| 2026-04-20 | Multiple (MetaMask, Ledger, Trust Wallet, Coinbase and others impersonated) | fake app | — | Kaspersky reported 26 fake wallet apps on Apple's App Store, part of a campaign active since at least autumn 2025. They pushed users to install trojanized wallet builds via a developer profile, or asked for the recovery phrase on fake screens. | kaspersky.com |
| 2026-04-07 | Ledger (impersonated) | fake app | ~$9.5M | A fake Ledger Live app on Apple's Mac App Store collected recovery phrases; ZachXBT tied about $9.5M in thefts between 7 and 13 Apr 2026 to it, with three victims losing over $1M each. Apple removed the listing without explaining how it passed review. | theblock.co |
| 2026-02-14 | Trezor, Ledger | phishing | — | Physical letters on fake Trezor and Ledger letterhead said a mandatory 'Authentication Check' or 'Transaction Check' was required and used QR codes to send recipients to phishing sites that collected recovery phrases. Both vendors say they never ask for a recovery phrase. | bleepingcomputer.com |
| 2026-01-05 | Ledger | data leak | — | Global-e, the payment processor for some Ledger.com orders, was breached and customer names and contact details were exposed. Ledger said its own hardware, software and platform were not breached and that no funds were at risk. | bravenewcoin.com |
| 2025-12-24 | Trust Wallet (browser extension) | supply chain | ~$8.5M | A malicious Chrome extension v2.68, published outside Trust Wallet's own release process, exfiltrated recovery phrases from users who logged in between 24 and 26 Dec. Trust Wallet says it has high confidence the attack stemmed from the Nov 2025 Sha1-Hulud npm worm, which exposed developer GitHub secrets and a Chrome Web Store API key. It shipped v2.69, revoked its release APIs, took down the exfiltration domain and opened a claims process to reimburse affected users. | trustwallet.com |
| 2025-12-20 | General (address poisoning) | phishing | ~$50M | A trader copied a lookalike address planted in their transaction history by an address-poisoning script and sent nearly $50M USDT to it after a small test transfer. The attacker laundered the funds via DAI, ETH and Tornado Cash; the victim offered a $1M bounty. | theblock.co |
| 2025-12-16 | Exodus | policy | — | The US Treasury's OFAC announced a $3,103,360 settlement with Exodus Movement over 254 apparent violations of Iran sanctions (12 deemed egregious). Between Oct 2017 and Jan 2019 Exodus support staff helped users in Iran, in some cases helping them reach partner exchanges and on 12 occasions suggesting VPNs. Not a hack; no user funds were affected. | ofac.treasury.gov |
| 2025-09-08 | General (npm supply chain) | supply chain | ~$600 | After phishing a maintainer, attackers published malicious versions of chalk, debug and about 18 other npm packages. The code hooked window.ethereum and network calls in browsers to swap crypto recipient addresses. The malicious versions were caught quickly and earned the attackers very little. | thehackernews.com |
| 2025-06-23 | Trezor | phishing | — | Attackers submitted Trezor support-form requests in victims' names so that Trezor's own auto-reply emails carried phishing content. Trezor said its systems and data were not accessed, had the phishing site taken down and said it was working to prevent further abuse. | theblock.co |
| 2025-05-07 | General (Inferno Drainer) | drainer | >$9M | Check Point reported that Inferno Drainer was back in use, lured victims through fake Collab.Land Discord verification pages and had added single-use contracts and encrypted on-chain configuration to avoid detection. | decrypt.co |
| 2025-04 | Ledger | phishing | — | Ledger users received physical letters demanding a 'mandatory wallet validation' via QR code and recovery-phrase entry. Ledger confirmed the letters were a scam and said it never asks for the 24 words. | theblock.co |
| 2025-03-05 | Trezor | vulnerability | — | Ledger's Donjon showed that voltage glitching a desoldered microcontroller could bypass some supply-chain protections on the older Trezor Safe 3. Trezor disclosed the issue, called it hard to exploit, pointed to passphrases and firmware checks, and noted that the Safe 5 uses a glitch-resistant chip. | theblock.co |
| 2025-02-21 | Safe{Wallet} (Bybit) | supply chain | ~$1.5B | Attackers attributed to Lazarus compromised a Safe{Wallet} developer's machine and changed front-end JavaScript in Safe's AWS S3 bucket, which made Bybit's signers approve a disguised malicious transaction on its cold wallet. Safe rebuilt its infrastructure, rotated all credentials and restored service, and said its smart contracts were not vulnerable. | slowmist.medium.com |
| 2025-02-06 | General (SparkCat) | fake app | — | Kaspersky found the SparkCat SDK in App Store and Google Play apps; it used on-device OCR to find screenshots of recovery phrases in photo galleries and upload them. Both stores removed the apps. | thehackernews.com |
| 2025-01-21 | Ledger | other | — | Balland and his partner were kidnapped in France for a crypto ransom and freed by police within days, after Balland's finger was injured; ten suspects were arrested. It is a prominent case in the rise of physical 'wrench attacks' against crypto holders. | thelocal.fr |
| 2025-01 | General (address poisoning) | phishing | >$83.8M | A USENIX Security 2025 study measured about 270 million address-poisoning attempts on Ethereum and BSC over roughly two years, with at least $83.8M lost. | arxiv.org |
| 2024-12-30 | Tangem | vulnerability | — | A mobile-app logging bug wrote private keys into logs when a user created a seed-phrase wallet, and those logs could reach Tangem support. Tangem fixed it on 30 Dec 2024, deleted the support logs, contacted affected users and said no funds were lost, but was criticised for saying little publicly. | cointelegraph.com |
| 2024-09 | WalletConnect (impersonated) | fake app | ~$70,000 | Check Point found a fake 'WalletConnect' app on Google Play that drained wallets for about five months, the first mobile-only crypto drainer it had seen. The app was removed. | thehackernews.com |
| 2024-05-17 | General (Pink Drainer) | drainer | ~$85M | Pink Drainer, a drainer-as-a-service operation known for hijacking Discord and X accounts, announced it was shutting down after about $85M in thefts (ScamSniffer). | theblock.co |
| 2024-05-03 | General (address poisoning) | phishing | ~$68M | A whale sent $68M in WBTC to a poisoned lookalike address. After on-chain negotiations, the attacker returned almost all of the funds within about a week. | unchainedcrypto.com |
| 2024-02-12 | Safe (abused by Angel Drainer) | drainer | ~$403,000 | Angel Drainer deployed a malicious Safe vault contract and got victims to sign Permit2 approvals, with Etherscan's 'verified' badge giving false reassurance. Blockaid said Safe itself was not attacked. | cointelegraph.com |
| 2024-02-06 | Exodus (impersonated) | fake app | ~$490K | A fake 'Exodus' wallet snap on Ubuntu's Snap Store stole recovery phrases; Canonical quarantined it after a 12 Feb report. A fake Ledger Live snap in Sept 2023 had cost one user about $10K. | blog.popey.com |
| 2024-01-17 | Trezor | data leak | — | An attacker accessed a third-party support-ticketing portal and exposed names and emails of people who had contacted Trezor support since Dec 2021; at least 41 received seed-phrase phishing. Trezor emailed affected users and said no assets were compromised. | forklog.com |
| 2023-12-14 | Ledger (Connect Kit) | supply chain | ~$600,000 | A phished former employee's npm account was used to publish a malicious Ledger Connect Kit that injected a drainer into dApps using the library. Ledger pushed a fix, pledged to compensate victims fully and announced it would phase out blind signing in favour of Clear Signing. | cointelegraph.com |
| 2023-12-12 | OKX Wallet / OKX DEX | hack | ~$2.7M | A suspected leak of a proxy-admin key let attackers upgrade a deprecated OKX DEX contract and drain tokens users had approved. OKX revoked the permissions and pledged to reimburse affected users. | theblock.co |
| 2023-11-14 | General (BitcoinJS 'Randstorm') | vulnerability | — | Unciphered disclosed 'Randstorm', weak randomness in BitcoinJS-based browser wallets generated in 2011–2015 (from JSBN SecureRandom and browser Math.random) that may let keys be brute-forced. Owners were told to move funds. | forklog.com |
| 2023-11 | General (Inferno Drainer) | drainer | >$80M | Inferno Drainer, active from Nov 2022 and spoofing more than 100 crypto brands across over 16,000 phishing domains, announced its shutdown in Nov 2023 (Group-IB). | group-ib.com |
| 2023-10-19 | Ledger Live (impersonated) | fake app | ~$768,000 | A fake Ledger Live app on the Microsoft Store from 19 Oct 2023 stole recovery phrases, as flagged by ZachXBT. Microsoft removed it. | bitdefender.com |
| 2023-09-05 | General (LastPass breach) | data leak | >$35M | Researchers linked a series of crypto thefts to seed phrases kept in LastPass vaults stolen in the 2022 breach and cracked offline. They said the link was likely but not conclusive. | krebsonsecurity.com |
| 2023-08-08 | Libbitcoin Explorer (bx) — 'Milk Sad' | vulnerability | >$900,000 | The `bx seed` command used a time-seeded PRNG with only 32 bits of entropy (CVE-2023-39910), so seeds could be brute-forced. Libbitcoin disputed that it was a bug, citing its documentation warnings. | unchainedcrypto.com |
| 2023-06-03 | Atomic Wallet | hack | >$100M | Funds were drained from thousands of Atomic Wallet users in an attack Elliptic attributed to North Korea's Lazarus Group. Atomic never confirmed a root cause, listing four possible vectors; it worked with exchanges, Chainalysis and Crystal to freeze funds and did not announce reimbursement. | decrypt.co |
| 2023-05 | Ledger (Recover) | policy | — | Ledger announced Ledger Recover (16 May 2023), an optional paid service that encrypts and splits the seed phrase across three custodians. Users objected that firmware could extract keys, and CEO Pascal Gauthier apologised for the communication, promised faster open-sourcing and delayed the launch. | forklog.com |
| 2023-04-22 | Trust Wallet (browser extension) | vulnerability | ~$170,000 | A WebAssembly entropy flaw in Trust Wallet Core made some extension-generated wallets guessable, and two exploits followed. Trust Wallet fixed the issue, secured most at-risk funds and set up reimbursements. | theblock.co |
| 2023-02 | OneKey | vulnerability | — | Unciphered published a video of extracting secrets from a OneKey Mini through a firmware flaw in about one second. OneKey said it had fixed the flaw. | unciphered.com |
| 2022-12 | BitKeep (now Bitget Wallet) | fake app | ~$8M | Trojanized BitKeep Android APKs spread through phishing sites stole private keys; the Google Play version was not affected. | halborn.com |
| 2022-10-18 | BitKeep Swap (now Bitget Wallet) | hack | ~$1M | BitKeep's Swap feature was exploited on BNB Chain and Polygon. BitKeep suspended Swap and promised 100% compensation through a claims portal. | web3.bitget.com |
| 2022-10-11 | Rabby Wallet | hack | — | Less than a month after launch, an exploit in the Rabby Swap router contract drained tokens users had approved. Rabby told Swap users to revoke all approvals. | theblock.co |
| 2022-09-20 | Profanity vanity addresses (Wintermute) | vulnerability | ~$160M | Market maker Wintermute lost $160M, widely attributed to its admin hot wallet being a Profanity-generated vanity address whose key could be brute-forced. 1inch had disclosed the Profanity flaw a week earlier. | theblock.co |
| 2022-08-02 | Slope Wallet | vulnerability | ~$4M–$5M | Slope's mobile app sent seed phrases to a Sentry logging server where they were stored unencrypted (Otter Sec). Slope told users to move funds; Phantom said its systems were not compromised and affected Phantom users had imported Slope seeds. | theblock.co |
| 2022-06-16 | MetaMask, Phantom (and Brave) | vulnerability | — | Halborn's 'Demonic' disclosure showed browser 'restore session' files could store seed phrases unencrypted on disk. MetaMask and Phantom shipped fixes. | theblock.co |
| 2022-04-17 | MetaMask (iOS) | phishing | ~$650,000 | A phone scam took over a user's Apple ID and used the iCloud backup of his MetaMask vault to drain the wallet. MetaMask warned users and published steps to turn off iCloud backup for the app. | decrypt.co |
| 2022-04-03 | Trezor | phishing | — | An insider-assisted breach at Mailchimp led to Trezor customers receiving phishing emails that pushed a fake 'Trezor Suite' app designed to steal seed phrases. Trezor took the domain down and paused newsletters. | siliconrepublic.com |
| 2021-06-16 | Ledger | phishing | — | Using data from the 2020 leak, criminals mailed tampered fake Ledger Nano X 'replacement' devices that told victims to run software and enter their recovery phrase. Ledger reiterated that it never asks for the phrase. | bleepingcomputer.com |
| 2021-01-22 | Trezor (impersonated) | fake app | >$1M | A fake 'Trezor' app on Apple's App Store from 22 Jan to 3 Feb 2021 harvested seed phrases; a similar fake appeared on Google Play. | malwarebytes.com |
| 2020-12-20 | Ledger | data leak | — | The Ledger e-commerce database stolen in June 2020 was dumped publicly on RaidForums, fuelling years of phishing, extortion and fake-device campaigns. Ledger had disabled the abused API key and notified France's CNIL in July 2020. | decrypt.co |
| 2020-03-24 | General (unlimited token approvals) | vulnerability | — | ZenGo showed that most dApp wallets granted unlimited ERC-20 allowances that a rogue dApp could later drain. Trust Wallet said it would upgrade; MetaMask and Brave already offered advanced allowance controls. | cointelegraph.com |
| 2020-01-31 | Trezor | vulnerability | — | Kraken Security Labs extracted encrypted seeds from Trezor devices in under 15 minutes of physical access using voltage glitching; the microcontroller flaw cannot be patched. Trezor said a BIP39 passphrase defeats the attack. | theblock.co |
| 2019-04 | Electrum | other | — | A botnet spread via Smoke Loader/RIG DDoSed honest Electrum servers to push old clients onto malicious phishing servers. Electrum used a DoS flaw in pre-3.3 clients to force upgrades and published guidance for server operators. | malwarebytes.com |
| 2019-02-22 | Coinomi | vulnerability | — | A user showed that Coinomi's desktop wallet sent restore-field text, including seed phrases, to Google's spellcheck API. Coinomi blamed a misconfigured plug-in and patched it on 22 Feb 2019. | theblock.co |
| 2018-12-27 | Trezor, Ledger | vulnerability | — | The wallet.fail team showed attacks on the Trezor One (key extraction without a passphrase) and Ledger Nano S/Blue at 35C3. Trezor promised a firmware fix and criticised the lack of coordinated disclosure. | crowdfundinsider.com |
| 2018-12-21 | Electrum | phishing | >$4M | Malicious Electrum servers abused the client's ability to display rich-text error messages to show fake 'update' prompts linking to trojanized wallets that stole seeds or redirected payments. Electrum fixed the issue in 3.3.3/3.3.4 and later forced upgrades. | malwarebytes.com |
How to protect yourself
Download wallets only from the official site or store listing, typed in yourself; never type a seed phrase into a website or share it with "support"; read every transaction and approval before signing; check every character of an address you paste, not just the first and last few, because address poisoning copies those; and keep large amounts on a hardware wallet. See seed phrase safety and crypto wallet scams.
Methodology and citation
Entries come from vendor post-mortems, security researchers and reputable news coverage; each row names its source. Loss figures are as reported at the time. Journalists and researchers may cite this page; please link to it. The data is free to download on our press page. Corrections are welcome.