UPDATE on the CryptoBilis Ledger supply-chain incident. Ledger confirms an unauthorized hardware implant in one affected user device. On-chain researchers report the attacker deposited 2,990 ETH worth about $7.45 million into Tornado Cash between 9 and 10 Oct, with further deposits continuing on 11 Oct. No new protocol drains in the window.
Ledger investigates reports of fund losses among Southeast Asia buyers of devices from reseller CryptoBilis. Researchers estimate about $93 million drained across Bitcoin, Ethereum, Tron, BNB Chain and Polygon. Phalcon flags $3.55 million in unclaimed bridge funds claimed via EIP-7702 by a Tornado-funded address; ownership intent is open.
SlowMist flags two small smart-contract drains on 9 Oct: BitBay’s Polygon DAI/USDC vault lost about 14,838 DAI after a zero-liquidity withdrawal, and EtherVista lost about $18,600 to a uint112 overflow in the pair K-check. CertiK says the 79Vault attacker returned 15,000 BNB.
CertiK, Defimon, GoPlus, and PeckShield flag a 79Vault drain on BNB Chain: 2.01 million 79AU moved by an operator key and sold for 16,249 BNB, about $12.5 million. SlowMist reports an X7Pioneer reward-counter bug for about 6.78 ETH. Duelbits posted fresh on-chain bounty messages on an older hot-wallet case.
Trader Frogman says two wallets were drained for more than $4 million while he was asleep in Singapore. Lookonchain breaks out BP, MarsCoin, and Cash Cat. Defimon reports a letsgethai governance proposal on Optimism that would point 328,143 KITE at the proposer. No funds had moved on that proposal.
Defimon reports a Tornado-funded caller pulled 200 WETH, about $538K, from a dormant 2020 MakerDAO ETH-A flip-keeper whose exit was not behind ds-auth. SlowMist reports Set Protocol lost about 5.08 ETH to an actualizeFee rounding step. Maker core is not scored as the bug.
GoPlus posts two Ethereum user drains first seen in this window: 12,041.3036 LINK, about $169.7K, pulled through a Permit2 path, and 305,560.46 DAI sent to a prefix-and-suffix lookalike. The Base vault gets a root-cause update and a $31.7M residual figure. That $6M is not re-scored.
PeckShield and CertiK flag 1,783 wstETH, about $6M, leaving an unnamed Base vault via a newly deployed proxy. GoldPesa GPXHooks lost about $114.9K to a Uniswap v4 delta mix-up. SlowMist scores MALT at about $72K. Root cause on the vault is unconfirmed.
Quiet first-report window. NEAR Intents GM Alex Shevchenko said the $3.8M Omni exploit funds were sent back in full and the investigation is stopping. A labeled exploiter sent a return message on BNB Chain; the published Bitcoin address holds 34.589 BTC. FlashLoop’s 114.09 ETH bounty is still open. Card new live loss is ~$0.
NEAR Intents halted swaps after a bug in Omni deposit and withdrawal infrastructure drained about $3.8M from a BNB Chain hot wallet. A separate Ethereum incident spoofed FlashLoopAdapter Safe checks and left an attacker with about 114.09 ETH. Card live-loss is ~$4.1M across two incidents.
MetaMask disclosed an infrastructure incident and began exiting affected non-custodial staking validators. Lido said the last exits are expected by 7 Oct, with re-entry up to about 45 days. Researcher Kaden scored diverted block rewards at about 0.36 ETH to a Tornado-funded fee recipient. No wallet-principal loss confirmed.
First-report this window: SlowMist flagged MCN Labs LPBonus for ~$92.6k via inconsistent MSN reserve accounting, and MUSystem for ~$36.9k via a first-deposit bonus double-count. Bitget published SlowMist and Mandiant progress reports naming a third-party zero-day foothold from 31 Aug. Limit Break victim mail continued.