Wallet Security Data Report — Week of October 5–11, 2026

This weekly data report tracks publicly confirmed wallet-security incidents and their direct losses for October 5–11, 2026. Figures come from protocol disclosures, security-firm analyses and on-chain investigators; where a number is an estimate or partly frozen, we say so. Indirect costs — token price effects, lost uptime, unrecovered amounts in ongoing investigations — are not included.

This edition covers October 5–11, 2026.

1. Headline Numbers

This week's ledger has two levels and they should not be blended. On the confirmed side — incidents with a disclosed target, method and figure — the week printed about $4.58M across four quantified items, including 200 ETH drained from a dormant 2020 MakerDAO auction-keeper contract. On the suspected side sits the largest number anyone attached to the week: $72M–$94.5M in possible user losses linked to Ledger hardware wallets bought through the reseller CryptoBilis, where Ledger has confirmed that one affected device contained an unauthorized hardware implant but has confirmed no loss total, no affected-customer count and no causal link between the implant and the drains. The two levels are why this report separates them: the confirmed loss and the suspected loss differ by a factor of roughly twenty, and a ledger that reports the second as if it were the first is not a ledger. Net of nothing recovered, the confirmed total stands at about $4.58M.

2. Incident Ledger

3. Attack-Type Distribution

Share of the week's ~$4.58M in confirmed direct losses:

Set the suspected hardware-wallet estimates beside that table and the shape of the week doubles. The confirmed distribution is the small-scale version of the year's recurring theme — a dormant contract with a callable-without-authorization function, a wallet whose owner cannot name the entry point, two arithmetic bugs — and the estimated distribution is almost entirely one row: a supply-chain problem at a single reseller, reported at between $72M and $94.5M. Neither is a drainer wave and neither is a phishing campaign, which is worth noting in a week when a 5% bitcoin drawdown was manufacturing exactly the urgency that phishing feeds on.

4. Five-Week Comparison

The confirmed sequence reads ~$1.9M net, ~$20.9M, ~$412.3M, ~$9.6M and now ~$4.58M — the third consecutive week of contraction on the confirmed ledger, and the first time this record has printed two consecutive weeks under $10M since August. Excluding each week's single largest confirmed incident, the baseline prints at roughly $0.6M, $13.1M, $24.8M, $4.2M and now $3.9M across the five most recent weeks, where the $3.9M is the remainder after the MakerDAO keeper is set aside. That is the second down-move in the baseline series, but the week's real headline is not in this column at all: it sits one layer out, in the $72M–$94.5M of suspected losses that no protocol disclosure backs and no issuer has confirmed — a reminder that this ledger measures what is disclosed, and disclosure is a choice.

5. Recovery Ledger

• Frozen inside the window: Tether froze roughly $10M in USDT linked to the suspected Ledger-reseller drains, the one hard number in that case that a regulated issuer has confirmed; investigators say some of the remaining funds have already moved through mixers.
• Fund restored, not recovered: Bitget's Protection Fund was replenished above $300M — the exchange's own page and its September 30 announcement put it there ahead of schedule, with the CEO restating on October 6 that the fund is whole against more than $1B of additional capital — while only about $1.07M, roughly 0.28% of the $387.5M taken, has actually been frozen by investigators.
• No recoveries reported: the MakerDAO keeper's 200 ETH was routed through Tornado Cash within minutes of the exploit; Frogman's ~$4M moved through Privacy Cash and Chainflip; Set Protocol's ~$22K and Locus Finance's ~$18K remain outstanding.
• Still outstanding from prior windows: roughly 598.5 BTC from the Liquid withdrawal — about $49.6M at this week's bitcoin price near $82,900, down from about $52M last edition at $86,500 as the price fell (the nominal BTC amount is unchanged; only the dollar conversion moves) — with peg-outs still suspended per Blockstream's status page; the rsETH position held by the front-running bot; the Balancer V1 proceeds (~$234K); and Zentra's ~$143K.

6. The Month: October Two Weeks In

Two weeks of October have printed roughly $14.2M in confirmed direct losses — about $9.6M in the first week and about $4.58M in the second — against September's roughly $759M on our gross ledger. The suspected hardware-wallet estimates sit outside that total, and the reasons are methodological rather than editorial: the figure is an analyst range rather than an issuer disclosure, the affected devices have not been counted, and the causal path from implant to drained wallet is not yet established for any individual case. What the confirmed half of October does show is a month that is, so far, cheap at the protocol layer and expensive in trust: the losses that reached the quantified file are small, and the story that dominated the week is a hardware-wallet vendor telling buyers to stop using a product they bought precisely to be safe.

7. What We Count, and What We Do Not

Counting scope is explicit: only publicly disclosed incidents with confirmed direct losses are included, and figures that are floors or estimates are labelled and held apart from the confirmed total. The Ledger-reseller estimates ($72M–$94.5M from Specter, tanuki42, Bitquery and YFarmX) are excluded from the ~$4.58M confirmed figure because no issuer has confirmed an amount, a device count or causation; Ledger's October 10 confirmation of a hardware implant is carried as a fact, and the implant is not itself counted as a loss. The MakerDAO keeper is counted at CertiK's figure of 200 ETH. Frogman is counted at EmberCN's token-by-token tally of about $4M. Set Protocol and Locus Finance are counted at their reported amounts. Recovered or frozen amounts are noted in the recovery ledger rather than netted against gross losses, so that gross and net can be read separately.

Not counted as losses: the U.S. government's movement of over $1B of forfeited bitcoin, which is custody and restitution rather than theft; ESMA's stablecoin deadline, the CFTC's commodity-classification proposal and FinCEN's withdrawn mixing rule, which are regulatory actions with no direct asset loss; and the Hong Kong Police investment-fraud statistic — more than 40 cases and losses above HK$36M in a week, including one HK$21M crypto case — which is aggregate consumer-fraud reporting rather than a single disclosed wallet-security incident. Prior-window events — Liquid, Balancer, Zentra, the rsETH front-run, the Bitget breach — are carried only for their recovery status. As always: if a figure in this report is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.