This is our weekly review of wallet security: the incidents and disclosures that defined the past seven days, what actually happened in each case, and the one operational habit that would have helped. Every item is based on a disclosed source — security-firm reporting, official statements or on-chain investigators — and we label anything not yet confirmed.
This edition covers October 5–11, 2026.
1. The Week at a Glance
$72M–$94.5M
Estimated losses from Ledger devices sold by one reseller
Ledger confirmed a hardware implant in one affected device on Oct 10; it has confirmed no loss figure
200 ETH
Largest protocol-layer loss: a legacy MakerDAO keeper
~$542,982 drained from a 2020 auction contract on Oct 6 (CertiK)
~$4M
A trader's wallets swept during TOKEN2049 Singapore
nine tokens taken on Oct 7 and swapped for ETH, BNB and SOL
>$1B
Bitcoin moved by U.S. government wallets
Bitfinex-case restitution and forfeited-asset custody, not sales
This was the week the attack surface moved into the box. After a September defined by authorization-layer failures inside live systems, October's second week put the question at the physical supply chain: Ledger confirmed on October 10 that a device bought through a Southeast Asian reseller contained an unauthorized hardware implant, turning a wave of unverified drain reports from customers in Indonesia, Malaysia and the Philippines into a confirmed tampering case. On-chain analysts put the suspected losses between roughly $72M and $94.5M, Ledger has confirmed none of those numbers, and the case remains open. Around it the ledger ran the usual mix — a five-year-old MakerDAO auction keeper drained of 200 ETH, a trader's $4M swept at a conference, the U.S. government moving over $1B of forfeited bitcoin — while regulators kept the week busy with a stablecoin deadline, a commodities proposal and a retreat on mixer reporting.
Key takeaways
Buying from an authorized reseller is a channel, not a guarantee: Ledger's own Genuine Check does not detect physical tampering so long as the original secure element is intact, which is why the defense is a freshly generated seed on a device you initialized yourself — never a pre-set one.
Age is not safety in contracts either: the MakerDAO keeper that lost 200 ETH had been dormant since 2020, and dormant code with an unauthenticated function is an unpatched function.
The largest dollar figures this week were unconfirmed analyst estimates, not issuer disclosures — the discipline that matters is keeping the two apart, because the confirmed loss and the suspected loss differ by more than an order of magnitude.
A hardware wallet protects keys only if the device that arrives is the device the factory built; the whole category rests on a supply chain most buyers never inspect.
2. Story Review
#1Oct 9–10Hardware WalletsImpact High
Ledger confirms a hardware implant in a reseller-sold device as suspected drains are estimated at $72M–$94.5M
Summary. On October 9, Ledger's support account said it was investigating reports of lost funds from users in Southeast Asia who had bought Ledger devices through CryptoBilis, a reseller based in Kuala Lumpur that is listed as an authorized distributor for Indonesia, Malaysia and the Philippines, and asked the reseller to pause all sales and shipments while the investigation ran. The company told anyone who had bought from CryptoBilis within the previous 90 days not to initialize their device if they had not already done so, and advised those who had to consider moving their assets to a new Ledger signer initialized with a newly generated recovery phrase. A day later, on October 10, Ledger confirmed that one of the affected users' devices contained an unauthorized hardware implant, moving the case from unverified loss reports to a confirmed physical-tampering method. Ledger said it had no indication that its own security infrastructure, systems or services were compromised, engaged the SEAL 911 incident-response group and opened a bounty channel, and CryptoBilis suspended sales of its entire hardware-wallet inventory. The loss figures are all analyst estimates, none confirmed by Ledger: researcher Specter traced inflows from hundreds of victim wallets across Ethereum, TRON and Bitcoin and put the total above $86M; tanuki42 listed eight addresses and put the figure above $72M; analytics firm Bitquery estimated about $92.9M across 311 wallets. TRON carried most of the value — much of it USDT, with a TRON wallet identified as TY24Ya holding about 7M USDT swept in the first wave — and Tether froze roughly $10M in USDT linked to the activity. Ledger has sold more than 7 million devices worldwide.
Commentary. The confirmation is smaller than the claims around it and more important than either. What Ledger has established is physical: at least one device that reached a customer through one reseller contained unauthorized circuitry. What it has not established is how much was lost, how many devices were affected, or even that the implant caused the drains. That gap is the story. A hardware wallet's entire promise is that the key never leaves the device — so an implant that reads the recovery phrase off the display during setup, or a unit shipped with a phrase the seller already knows, defeats the model without touching the secure element. The practical rule this case reinforces is the one Ledger itself repeated: initialize your own device and generate your own phrase, and if a phrase might ever have been exposed, move the assets to a new device with a new phrase — not the same phrase onto new hardware.
A dormant five-year-old MakerDAO keeper contract is drained of 200 ETH (~$542,982)
Summary. At 06:13 UTC on October 6, an attacker drained 200 ETH — about $542,982 at the time — of ETH-A collateral from a legacy MakerDAO auction-keeper contract on Ethereum mainnet, according to CertiK's incident analysis. The ETH came from four 50 ETH lots that the keeper had won with zero bids during MakerDAO's 'Black Thursday' liquidations in March 2020 and never settled. The flaw was a single unauthenticated function on the keeper that let the attacker grant a contract they controlled full delegation over the keeper's MakerDAO Vat account; in one transaction the attacker settled auctions 1457–1460 and withdrew the collateral. The attacker funded the operation with a 0.1 ETH withdrawal from Tornado Cash and, roughly six minutes after the exploit, began depositing the proceeds back into a Tornado Cash router in nine 10 ETH tranches.
Commentary. The size is modest; the pattern is not. This was not a new protocol, not a clever oracle manipulation and not a user error — it was old code, live on-chain, holding value nobody remembered it could move, reachable through a function that should never have been callable without authorization. The keeper was doing exactly what it was built to do in 2020, and the flaw sat in that continuity. The lesson generalizes past MakerDAO: contracts do not retire when their narrative does, and an unauthenticated function is a standing invitation regardless of how long the balance has been quiet. Every protocol with legacy contracts in its history should be asking which of them still hold value — the answer this week cost 200 ETH.
A crypto trader's wallets are swept for about $4M while he attends TOKEN2049 Singapore
Summary. On October 7, on-chain investigator EmberCN flagged that the wallets of a crypto trader known as Frogman had been drained of roughly $4M while he was attending the TOKEN2049 conference in Singapore. The stolen assets spanned nine tokens, led by 1.43M BP (about $1.77M), 13.96M MarsCoin (about $1.55M) and 3.7M Cash Cat (about $510K). Attackers swapped the holdings for ETH, BNB and SOL, then moved the proceeds through privacy tools including Privacy Cash and Chainflip. The affected addresses were flagged, and Frogman has not publicly identified the cause of the breach.
Commentary. A conference is a risk environment, and the timing is the warning. High-profile events concentrate the people, devices and networks worth attacking, and the classic vectors — a compromised hotel or venue Wi-Fi, a device left unattended, a phishing message timed to a crowd — all get cheaper to run when the targets are gathered in one place. There is no confirmed cause here, and that is exactly why the item earns its slot: the outcome was $4M across nine tokens from wallets whose owner was, by every appearance, distracted. The habit that defends it is unglamorous — a travel device holding only what you can afford to lose, keys that stay at home, and the assumption that any network at a venue is hostile.
U.S. government wallets move more than $1B of forfeited bitcoin — custody, not sales
Summary. Federal wallets tied to the 2016 Bitfinex breach moved 264.863 BTC — roughly $22.87M — to Coinbase on October 6, executing a court-ordered restitution that requires seized bitcoin to be returned to the exchange directly rather than sold into cash first. A day later, on October 7, government-linked addresses transferred another 834 BTC (about $71.6M) to Coinbase Prime and 40,285 BNB (about $31.63M) to a separate address, the first activity from those wallets since August 26, with blockchain analysts Lookonchain and Wu Blockchain flagging the moves and analyst Sani (timechainindex.com) identifying an initial 0.001155 BTC test transaction. A larger transfer of roughly 12,267 BTC, valued above $1B and tied to recovered Bitfinex-case assets, followed on October 8, with the receiving address unidentified. The government characterised the movements as custodial procedures rather than liquidations, and its holdings remain large — about 323,693 BTC, worth near $27.7B by the week's prices.
Commentary. There is no victim here and no exploit, but the item belongs in a wallet-safety ledger for two reasons. First, it is a live demonstration of restitution mechanics at scale: seized coins can move back to victims long after the crime, which is the rare happy ending this record otherwise lacks. Second, it is a reminder of how much the market watches the largest single holder it cannot predict — a government wallet moving $1B is a supply-side event whether or not a single coin is sold. For practitioners the takeaway is procedural: on-chain movement is not a sale, and reading custody transfers as market signals is the same category error as reading a wallet's balance as its intent.
Summary. On October 6, Lido reported that the precautionary exit of MetaMask Staking's Ethereum validators — begun after an infrastructure-intrusion disclosure at the end of September — was nearing completion, with the last batch of exits expected to finish by the end of that day and no new anomalies observed during the process. The affected ETH is expected to return to the protocol over the coming weeks as the validators complete their exit, withdraw and re-enter cycles, a path Lido has estimated at up to about 45 days. Lido restated that the staking operation is non-custodial — MetaMask does not manage customer withdrawal keys — so users' principal was never in the operator's hands, and no action is required from stETH holders. The protocol put its current stETH annualised yield at 2.23%.
Commentary. This is the quiet close of the month's most overstated incident. The set-up was alarming — an intruder inside a major staking operator's infrastructure, thousands of validators pulled offline — and the realised loss was about 0.36 ETH of diverted rewards, because the architecture kept the withdrawal keys where the attacker could not reach. The exit was the defense, not the disaster: an operator that can pull $1.4B of validators on a precaution and complete it inside a week is demonstrating exactly the property that makes non-custodial staking survivable. The number to watch now is the re-entry clock, because the cost landed on stETH yield and on time, not on principal.
Hong Kong police log more than 40 investment-fraud cases in a week, including a HK$21M crypto loss
Summary. Police in Hong Kong said they received more than 40 reports of investment fraud over the past week, with losses exceeding HK$36M, according to a Hong Kong Police statement carried by Sing Tao. The largest single case involved a woman in her sixties who posted on an online forum, was approached by a fraudster who moved the conversation to WhatsApp, and was persuaded to invest in cryptocurrency. Following instructions, she downloaded a wallet application from an app store, was given a link to a fake investment website, and was told to authorise her wallet app to connect to that site in order to transfer funds. She was initially shown a HK$920,000 'profit' credited to the wallet, made more than twenty transfers totalling about HK$19M over six months to the fake site — which displayed a paper balance above HK$42M — and was then told her account was frozen and required a further HK$7M to unfreeze; she sent about HK$1.2M more before reporting the matter to police.
Commentary. The mechanics are worth reading in full because they are not exotic. There was no drainer, no contract approval and no stolen key — just a fake site, an authorised wallet connection and a victim who was shown a number going up. Every stage of the classic investment-confidence pattern is present: the forum approach, the migration to a private messaging app, the initial real withdrawal that builds trust, the escalating transfers, and the invented 'unfreeze fee' that extracts one more payment from someone already committed. Hong Kong Police's advice is the same as ours: treat any unsolicited investment channel as hostile, never connect a wallet to a site you reached through a message, and understand that a balance a website displays is a number the website controls.
ESMA orders EU crypto firms to drop non-compliant stablecoin services within 90 days
Summary. On October 8, the European Securities and Markets Authority issued an opinion requiring crypto-asset service providers authorised under MiCA to stop offering services to EU clients related to asset-referenced and e-money tokens that do not comply with MiCA. The scope covers trading, exchange, order execution, transfer, custody and investment advice. For existing exposures, national competent authorities are to require firms to remediate as soon as possible and no later than three months after the opinion — by early January 2027 — with any continuing service during the remediation window limited to necessary activities such as orderly liquidation, exchange, withdrawal, transfer or safekeeping, under time-limited, risk-based supervision. The direction landed the same week German platform Bitcoin.de announced an operational overhaul after its regulator rejected its licence application.
Commentary. For a wallet holder the relevance is custody and withdrawal corridors, not politics. When a jurisdiction tells providers to unwind access to a token within a fixed window, the practical effects show up as delisted pairs, disabled transfers and forced conversions on deadlines — the same access-risk category this record keeps flagging about exchanges, now applied to a whole class of assets across a regulatory bloc. The mitigating detail is that the deadline is three months out and the permitted activities during it include withdrawal and transfer: the window exists precisely so that holders can move, which makes it a calendar item rather than a panic item.
The CFTC advances federal crypto-market rules and names XRP, Stellar among digital commodities
Summary. The Commodity Futures Trading Commission opened an advance notice of proposed rulemaking for two new regulations — Regulation CTX and Regulation CAM — that would for the first time bring retail crypto trading involving margin, leverage or financing under a federal framework. Speaking at the Fordham Law Blockchain Regulatory Symposium on October 5, Chairman Michael Selig cited Bitcoin, Ether, Solana, Stellar (XLM), Tezos and XRP as examples of digital commodities. That status is not new: all six were named in the joint SEC-CFTC taxonomy of 16 digital commodities issued on March 17, 2026, so the October action adds trading rules rather than re-deciding classification. Covered retail transactions would run through futures commission merchants, with customer-asset segregation, capital standards, anti-money-laundering controls and proof-of-reserves requirements; ordinary spot trading would stay outside the federal framework and could keep state money-transmitter licences. The proposals are drafts subject to public comment.
Commentary. A classification item is not a wallet-safety event, but it is a wallet-safety input: the asset a user holds determines which guarantees apply to it, which venues may list it and what its issuer can be compelled to do. The point to keep straight is the status. The commodity designation dates to the joint March taxonomy, and what is genuinely new here is a draft trading framework — not a final rule, and not a re-opening of whether XRP is a security. A 2023 ruling still treats some direct institutional sales as investment contracts, so token-level legal status remains a variable rather than a fact until a rule is actually in force.
FinCEN drops its crypto-mixing reporting rule as the DOJ presses the Tornado Cash case
Summary. FinCEN abandoned a proposed rule that would have imposed privacy-related reporting requirements on crypto mixing, with existing anti-money-laundering obligations left in place, according to CryptoSlate's reporting. The retreat came days after the Department of Justice kept its Tornado Cash prosecution alive with a venue filing on October 5 that invoked a Bitcoin Fog appeal, showing that the collapse of the reporting proposal has not ended the criminal case against mixer developers and operators. The two moves point in the same direction from opposite angles: less prescriptive reporting for the general population of users, and no let-up in the pursuit of the people who build and run the tools.
Commentary. Mixers sit at the intersection of privacy and laundering, and this week's pair of decisions shows the two tracks moving independently. For ordinary wallet users the signal is narrow but real: the reporting rule that would have swept in broad categories of privacy-related activity is gone, while the enforcement priority against mixer operators continues. The safe reading is that the regulatory perimeter around privacy tooling is being drawn by prosecutors rather than by reporting mandates for now — which changes the compliance surface for institutions far more than it changes anything an individual self-custody holder should do this week.
The carried threads: Bitget's fund is whole, Blast's clock is running, Liquid is still silent
Summary. Several open files moved this week, mostly in the right direction. Bitget confirmed its Protection Fund had been replenished above $300M — the exchange's own incident page and its September 30 announcement put it at more than $300M ahead of schedule, with the CEO restating on October 6 that the fund was whole and that more than $1B of additional capital stands behind it, even as only about $1.07M, roughly 0.28% of the $387.5M taken, had been frozen by investigators. Blast's shutdown clock kept running toward the October 26 interface deadline, after which assets are recoverable only by interacting directly with the chain's L1 bridge contracts. Blockstream's Liquid incident status page still showed peg-outs suspended and about 598.5 BTC outstanding at this edition's cutoff. And the market's own thread: bitcoin gave back roughly 7% from its Monday high into an intraweek low near $80,400, then steadied near $82,900 by the weekend as a sharp mid-week drop liquidated more than $600M in leveraged positions and spot ETFs shed $729M over two days.
Commentary. Three of these threads are the same story at different speeds. Bitget is the recovery that worked but did not recover much — a fund soak, not a clawback, with less than a third of a percent of the haul frozen. Blast is the deadline that has not yet cost anyone anything and will still punish inaction. Liquid is the silence that keeps not resolving, and in this record silence has never once preceded a smaller number. The market item is the context that makes scams rise: a week that prints a 5% drawdown on macro fear is a week that manufactures fake-restoration notices, fake support accounts and urgency messages, and the phishing wave after any crisis is the part that reaches people who were never in the original incident.
Two weeks ago the question was whether defenders could outrun attackers inside live systems. This week pushed the question one layer out, into the box. Ledger's own systems were, on its account, untouched — and a device that reached a customer through one reseller still contained unauthorized circuitry, which means the integrity of self-custody now depends on a physical supply chain that no user can audit and that even the manufacturer's authenticity check does not fully cover. That is a harder problem than a zero-day, because there is no patch for a device someone else opened first. The rest of the week was continuous with the year's pattern: a dormant contract with an unauthenticated function lost 200 ETH, a distracted trader lost $4M, and the largest figures in circulation were analyst estimates that no issuer has confirmed. The through-line is unchanged — the losses concentrate wherever authorization, keys or provenance are assumed rather than verified.
As always: if an incident in this review is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.
Frequently Asked Questions
I own a Ledger. Am I affected by the CryptoBilis case?
Based on what Ledger has disclosed, the case is isolated to devices bought through one reseller, CryptoBilis, which operates in Indonesia, Malaysia and the Philippines — Ledger says it has received no reports involving devices purchased directly from the company. If you bought through that reseller in the last 90 days and have not set the device up, do not initialize it. If you already did, Ledger's guidance is to move your assets to a new device initialized with a newly generated recovery phrase. Note the precision of that advice: a new phrase, not the same phrase restored onto a new device, because the concern is that the original phrase may have been exposed at setup. Ledger has confirmed one device contained an unauthorized implant and has published no affected-customer count; treat updates as developing and rely only on Ledger's official channels, which will never ask for your 24 words.
How could a hardware wallet be compromised without breaking its chip?
By reading the screen, not the secure element. The security researchers examining devices from this case describe modified units where additional circuitry sits near the display, positioned to monitor the data the device sends to its screen through the display's Serial Peripheral Interface. When a wallet is initialized, it generates and shows the recovery phrase on that display; a component watching the screen connection can capture the words as they appear, and some of the examined implants included cellular hardware to transmit what they captured. None of that requires defeating the wallet's cryptography — it bypasses it, because a phrase the owner read off a compromised screen and wrote down is already known to whoever built the implant.
Does Ledger's Genuine Check catch a tampered device?
Not necessarily. Ledger's own documentation for Genuine Check describes an authenticity control that verifies the device's genuine chip and firmware — which makes it effective against counterfeits. It does not detect physical modification so long as the original chip remains intact, which is exactly the tampering described in this case. The practical implication is that authenticity checks and physical inspection are different assurances, and neither replaces the one habit that defeats a pre-compromised device: initializing it yourself, generating a phrase you have never seen before, and never accepting a device that arrives with a phrase already written down.
What does the MakerDAO keeper drain mean for someone with funds in DeFi?
It is a reminder about legacy exposure rather than a live risk in current protocols. The contract involved was a 2020-vintage auction keeper holding collateral from that year's 'Black Thursday' liquidations; the flaw was a single function that could be called without authentication, and no recent MakerDAO user interaction was required to lose the funds. If you hold positions in older protocols or have value sitting in contracts from a previous cycle, the relevant question is not whether the protocol is still maintained but whether it ever retired the code that still holds your funds. Dormant is not the same as safe.
Was the TOKEN2049 wallet drain connected to the event itself?
There is no confirmed link between the venue and the theft, and the trader has not published a cause. What is clear is the timing and the pattern — roughly $4M across nine tokens swept while the owner was at a major conference — and the fact that high-attendance events are known to concentrate opportunistic attacks on attendees' devices, networks and communications. Whether or not the conference was the vector, the response is the same: travel with a device that holds only what you can afford to lose, keep the rest of your keys off it, and treat every network and every inbound message at a venue as untrusted.
This article is based on public data and official disclosures. Figures were last reviewed on October 12, 2026. Values change with network conditions; always verify against the primary source before making decisions.
Ledger's own support statements on X (October 9–10, 2026): investigation into reported losses from Southeast Asian buyers of reseller CryptoBilis (based in Kuala Lumpur; authorized for Indonesia, Malaysia and the Philippines), request to pause sales and shipments, guidance for buyers within 90 days (do not initialize; if already set up, move assets to a new signer with a newly generated phrase), confirmation on October 10 that one affected user's device contained an unauthorized hardware implant, assertion that Ledger's own systems were not compromised, SEAL 911 assistance and the bounty@ledger.fr channel; CryptoBilis suspending all hardware-wallet inventory sales. Loss estimates posted on X by Specter and tanuki42 and carried by The Block and CoinDesk: Specter above $86M across Ethereum, TRON and Bitcoin; tanuki42 above $72M across eight addresses; Bitquery about $92.9M across 311 wallets; YFarmX about $94.5M; Arkham's 'ledger-drainer' label at roughly $71.6M; Tether freezing about $10M in USDT; individual cases including an 80 BTC address swept on October 9, the TRON wallet TY24Ya holding about 7M USDT, and a 59 ETH loss; Mark Karpelès's account of an implant hidden behind a Nano X display; Changpeng Zhao's October 9 comment describing a supply-chain attack involving a single seller. CryptoBilis's former executives Arravind Prabu and Vimalatheethan stating they completed a management handover in March 2026.
CertiK's own incident analysis (October 6, 2026): 200 ETH (~$542,982) drained at 06:13:11 UTC from a legacy MakerDAO auction-keeper contract, four 50 ETH lots of the March 2020 'Black Thursday' liquidations settled in one transaction (auctions 1457–1460), an unauthenticated function granting Vat delegation, Tornado Cash funding of 0.1 ETH and nine 10 ETH deposits to the Tornado Cash router.
EmberCN's own alert on X (October 7, 2026): roughly $4M drained from two wallets during TOKEN2049 Singapore across nine tokens including 1.43M BP (~$1.77M), 13.96M MarsCoin (~$1.55M) and 3.7M Cash Cat (~$510K), swapped for ETH, BNB and SOL and routed through Privacy Cash and Chainflip.
On-chain posts by Lookonchain, Wu Blockchain and Sani/timechainindex (October 6–7, 2026): 264.863 BTC (~$22.87M) to Coinbase under the Bitfinex restitution order, 834 BTC (~$71.6M) to Coinbase Prime and 40,285 BNB (~$31.63M) to another address, a 0.001155 BTC test transaction, a further ~12,267 BTC (>$1B) transfer with an unidentified recipient, government holdings of about 323,693 BTC (~$27.7B), and the 2025 court order requiring return of the forfeited bitcoin to Bitfinex rather than liquidation.
Lido's own confirmation (October 6, 2026) via its governance forum (research.lido.fi) and public channels: MetaMask Staking's validator exits nearing completion with no new anomalies, ETH returning over the coming weeks within an up-to-~45-day exit-withdraw-re-entry cycle, non-custodial design with no customer withdrawal keys held, no action required from stETH holders, and stETH APR at 2.23%.
Hong Kong Police statement (October 9, 2026) carried by Sing Tao Daily: more than 40 investment-fraud reports in a week with losses above HK$36M, including a woman in her sixties defrauded of about HK$21M through a fake crypto investment site reached via an online forum and WhatsApp, with a wallet app downloaded from an app store, an authorisation to connect to the fake site, an initial HK$920,000 'profit', more than twenty transfers totalling about HK$19M, a displayed balance above HK$42M, a fabricated HK$7M 'unfreeze' fee and a further ~HK$1.2M paid before reporting.
The European Securities and Markets Authority's own opinion (October 8, 2026), analysed by CryptoSlate: CASPs authorised under MiCA to stop services to EU clients related to non-compliant asset-referenced and e-money tokens across trading, exchange, execution, transfer, custody and advice, national authorities to require remediation no later than three months after the opinion with continuing activity limited to necessary liquidation, exchange, withdrawal, transfer or safekeeping under risk-based supervision; the parallel MiCA licensing outcome at Bitcoin.de as reported the same week.
The CFTC's own advance notice of proposed rulemaking and Chairman Michael Selig's October 5, 2026 remarks at the Fordham Law Blockchain Regulatory Symposium, citing Bitcoin, Ether, Solana, Stellar (XLM), Tezos and XRP as examples of digital commodities drawn from the joint SEC-CFTC taxonomy of 16 digital commodities (March 17, 2026); proposed Regulation CTX and Regulation CAM to route covered retail leveraged crypto trading through futures commission merchants with customer-asset segregation, capital, AML and proof-of-reserves requirements.
CryptoSlate's regulation reporting (October 6, 2026): FinCEN abandoning the proposed crypto-mixing reporting requirements while existing anti-money-laundering obligations remain, and the DOJ's October 5 venue filing in the Tornado Cash case invoking a Bitcoin Fog appeal.
Bitget's own incident progress page (last updated October 4, 2026) and its September 30, 2026 announcement of the Protection Fund's replenishment above $300M, with the CEO's October 6 statements on the fund and additional capital and Certora's estimate of post-halt outflows; Blast's own shutdown notice and its October 26, 2026 interface deadline; Blockstream's own Liquid incident status page (latest update late September 2026) with about 598.5 BTC outstanding; Farside Investors and SoSoValue ETF flow data ($729M of two-day outflows, with a maximum daily outflow of $484.9M on October 7 and a $21.1M inflow on October 9, against the prior week's $241M inflow) and public market data for the week's bitcoin range (Monday high near $86,655, intraweek low near $80,400, weekend near $82,900).
OSW
The OpSecWallet Research Team
We are an independent research desk focused on wallet security and safe on-chain operation. Every report is written from public data and official security disclosures, cross-checked against primary sources, and reviewed for accuracy before publication. We never ask readers for keys, seeds or transfers.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.