Wallet Safety Intelligence Briefing — Week of October 5–11, 2026

This is the weekly intelligence briefing: the same five questions every week, answered from disclosed sources, so that the answers can be compared across editions rather than read as one-off news.

This edition covers October 5–11, 2026.

1. How much was lost this week?

Confirmed direct losses came to about $4.58M across four quantified incidents. The largest was 200 ETH — roughly $542,982 — drained on October 6 from a legacy MakerDAO auction-keeper contract that had been holding unclaimed collateral since 2020. The second was about $4M taken from a crypto trader's wallets while he attended the TOKEN2049 conference in Singapore on October 7, across nine tokens swapped into ETH, BNB and SOL. The remainder was small: about $22K from a rounding-error exploit at Set Protocol and about $18K from an exploit at Locus Finance.

Beside that confirmed total sits the week's largest figure, and it is not confirmed. On-chain analysts estimate between $72M and $94.5M in suspected user losses linked to Ledger hardware wallets purchased through the Southeast Asian reseller CryptoBilis — Specter above $86M, tanuki42 above $72M, Bitquery about $92.9M across 311 wallets, YFarmX about $94.5M. Ledger has confirmed that one affected user's device contained an unauthorized hardware implant, and has confirmed no loss total, no affected-device count and no causal link between the implant and the drains. Tether froze roughly $10M in USDT linked to the activity — the firmest figure in a case whose headline numbers all come from public blockchain tracing rather than disclosures.

2. What is the pattern this week?

The attack surface moved into the box. September's failures lived inside live systems — signing keys, backend authorization, reward routing. October's second week put the failure one layer earlier, at the point where a device becomes a wallet: a hardware wallet that reaches a buyer already compromised defeats the entire category without touching its cryptography, because whoever built the implant can read the recovery phrase off the screen at setup. That is a threat model no amount of careful key handling on the owner's side fully answers, and it is why Ledger's guidance is to generate a new phrase rather than restore an old one.

The rest of the confirmed ledger is the year's quiet recurring theme, printing at pocket scale. The MakerDAO keeper had been dormant since 2020 and still held collateral that a single unauthenticated function could release; the two small DeFi exploits were arithmetic and logic errors. None of it was a drainer wave, a phishing campaign or a social-engineering wave — which is notable in a week when bitcoin gave up roughly 7% from its Monday high and a sharp mid-week drop liquidated more than $600M in leveraged positions. Big candles and small incident counts is the environment the intelligence brief flagged last edition as the one where scam volume rises on urgency; this week the narrative volume rose, but the quantified file did not.

3. What did enforcement do this week?

• ESMA set a stablecoin deadline. On October 8, the EU's securities authority issued an opinion requiring MiCA-authorised crypto firms to stop offering services to EU clients tied to non-compliant asset-referenced and e-money tokens across trading, transfer, custody and advice, with national regulators to require remediation within three months — by early January 2027 — and continuing activity limited to necessary withdrawal, transfer and safekeeping.
• The CFTC advanced market rules. The commodities regulator opened an advance notice of proposed rulemaking for Regulation CTX and Regulation CAM, which would bring retail crypto trading involving margin, leverage or financing under a federal framework, and Chairman Michael Selig cited XRP, Stellar and four other assets as examples of digital commodities already named in the joint SEC-CFTC taxonomy issued in March.
• FinCEN retreated as the DOJ pressed on. FinCEN abandoned its proposed crypto-mixing reporting requirements while leaving existing anti-money-laundering duties in place, days after the Department of Justice kept the Tornado Cash prosecution alive with a venue filing that invoked a Bitcoin Fog appeal — less prescriptive reporting for users, no let-up for the people building and running mixers.
• Local police logged a fraud wave. Hong Kong Police reported more than 40 investment-fraud cases in a week with losses above HK$36M, including a woman in her sixties defrauded of about HK$21M through a fake crypto investment site she reached after a WhatsApp approach and connected to with a wallet app — the full classic confidence pattern, from an initial real withdrawal to a fabricated 'unfreeze fee'.

4. What should a wallet user change this week?

One habit, and it is specific to the Ledger case: initialize your hardware wallet yourself and never accept a recovery phrase the device or the seller provides. The whole promise of a hardware wallet is that the seed is generated on the device and never leaves it; a unit shipped with a phrase already set up, or a rigged display that captures the words as they appear at setup, breaks that promise before you sign anything. Concretely, three moves cover the confirmed part of this week's risk:

• If you bought a hardware wallet from a reseller in the last 90 days — and especially from CryptoBilis — do not set it up if you have not already. If you have, generate a brand-new recovery phrase on a device you trust and move the on-chain balances; restoring the same phrase onto new hardware does not undo a possible exposure.
• Treat 'the device arrived with a seed card' as disqualifying. A genuine wallet generates the phrase on the device and shows it once, on its own screen, during a setup you started. A phrase that came in the box, in an email or on a sticker is a phrase the seller knows.
• Re-read what a vendor authenticity check does and does not cover. Ledger's own Genuine Check verifies the chip and firmware, which catches counterfeits — it does not detect physical modification while the original chip is intact, which is the tampering described this week. Buy from the vendor or a channel the vendor vouches for, and prefer buying directly where the option exists.

For everyone else, the week adds one small discipline from the MakerDAO item: contracts and addresses that have been quiet for years are not therefore inert. Before reusing an old wallet or a long-dormant contract, treat 'it worked in 2020' as a reason to check what it can do now, not a reason to trust it.

5. What is coming next?

The near calendar is mostly macro, with two Ledger-related watch items on the security side.

• Ledger's investigation. The company has confirmed one hardware implant, opened a bounty channel and is working with authorities and SEAL 911, and has published no affected-device count, no loss figure and no timeline. Watch official Ledger channels only — incidents of this profile reliably generate follow-on phishing impersonating the vendor.
• October 14 — U.S. CPI. The next inflation print lands after a week in which the 10-year Treasury yield pushed to multi-year highs and bitcoin sold off on rate expectations, with ETF flows already negative for the month.
• October 26 — Blast's interface deadline. After that date, assets on the winding-down L2 are recoverable only by interacting directly with its L1 bridge contracts, which is not a process to attempt for the first time under deadline pressure.
• October 28 — the next FOMC decision, following minutes that pointed to further tightening being judged appropriate by year-end.
• Unresolved older files: Liquid's peg-outs remain suspended with about 598.5 BTC outstanding and no announced date for resumption; the Coldcard firmware case (roughly 1,816 BTC, about $116M, July 2026) remains a parallel reminder that hardware-wallet risk is not only a reseller problem. Both are cases where silence, so far, has not preceded a smaller number.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.