Daily Brief

Web3 Daily Exploits — 10 Oct 2026: Ledger Reseller Drains and Bridge EIP-7702 Claim

Ledger investigates reports of fund losses among Southeast Asia buyers of devices from reseller CryptoBilis. Researchers estimate about $93 million drained across Bitcoin, Ethereum, Tron, BNB Chain and Polygon. Phalcon flags $3.55 million in unclaimed bridge funds claimed via EIP-7702 by a Tornado-funded address; ownership intent is open.

Jacobo Avariento

Jacobo Avariento

— 12 min read
Web3 Daily Exploits — 10 Oct 2026: Ledger Reseller Drains and Bridge EIP-7702 Claim

The 10 Oct America/Panama window is a hardware-wallet supply-chain day, plus an open question on unclaimed bridge funds. Ledger Support posted on 9 Oct that it is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis, asked the reseller to pause all sales and shipments, and advised recent buyers not to set up the device or to move assets to a new signer with a new seed if already set up. On-chain researchers, including Specter and Bitquery, have published estimates of the associated drains. Bitquery’s reconstruction lists about $92.9 million taken from 311 wallets across Tron, Bitcoin, Ethereum, BNB Chain and Polygon. That researcher figure is the card’s live-loss line. Ledger has not published a confirmed total. The second item is Phalcon’s 10 Oct post on about $3.55 million in unclaimed bridge funds claimed and transferred out roughly six hours earlier, executed through EIP-7702 delegations by an address funded via Tornado Cash. Phalcon states that the authorizations were valid on-chain but does not establish whether the owner signed intentionally, was tricked, or had the key compromised. That event is noted but not scored as a confirmed loss.

SlowMist’s last two alerts in the window read here are the 9 Oct BitBay and EtherVista drains already in the prior brief. CertiKAlert’s recent posts are on the HOT Omni Bridge return and the 79Vault BNB return. DefimonAlerts posted on-chain messages, including one on MakerDAO Flipper deal() calls and earlier settlement texts. Phalcon had the bridge note. GoPlusSecurity quoted the Ledger Support post and listed attacker addresses. Lookonchain posted individual CryptoBilis-related drains and unrelated flow notes. BlockSecTeam, ZachXBT, CyversAlerts, Immunefi, and rekt.news did not post a separate first-report protocol drain used as a new figure in this cutoff.

Ledger devices sold by CryptoBilis — multi-chain — about $93 million estimated — supply-chain / key compromise

What happened: Ledger Support posted on 9 Oct that the company is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, Ledger asked CryptoBilis to pause all sales and shipments of Ledger devices and recommended that users who purchased from this reseller in the last 90 days not initiate setup if not already done. Users who have set up the device were advised to consider moving assets to a new Ledger signer with a new seed. The post is the official starting point. On-chain researchers have linked drains from wallets that received funds after setup of devices bought through the reseller.

Specter and other researchers published collector addresses and traced inflows. Bitquery published a detailed reconstruction dated 9 Oct that counts $92.9 million taken from 311 wallets on five chains: Tron (roughly $70.5 million, mainly USDT), Bitcoin (about 203.8 BTC, $16.8 million), Ethereum (about $3.7 million), BNB Chain (about $1.45 million), and Polygon (about $0.58 million). The same note observes coordinated timing, including 25 Tron wallets signing the same approval within three seconds and Bitcoin sweeps concentrated in single blocks, which is consistent with possession of the private keys. Lookonchain posted examples on 9 and 10 Oct, including one wallet drained of 59 ETH after a CryptoBilis Ledger and another of 80 BTC. GoPlusSecurity quoted the Ledger post, stated a loss of about $90 million, and listed main attacker addresses on Bitcoin, Tron, and EVMs drawn from Specter and tanuki42. This brief uses the Bitquery $92.9 million figure as the card line and does not invent a single confirmed total. Ledger has not published its own dollar total or a final cause determination in the posts read here.

Protocol / chain / asset: Not a protocol. Hardware wallets sold through reseller CryptoBilis. Chains named in the researcher traces: Bitcoin, Ethereum, Tron, BNB Chain, Polygon. Assets include BTC, ETH, USDT, USDC and other tokens. The compromise is at the device or seed level for the affected units, not a remote exploit of Ledger’s core firmware in the public statements.

Loss: About $92.9 million per Bitquery reconstruction of 311 wallets. Other researcher prints in the same window range from roughly $72 million to $90 million. Ledger has not confirmed a figure. No freeze total is in the posts read here. Counted on the card at about $93 million. Individual user losses continue to appear in Lookonchain posts.

Attack type: Supply-chain compromise of hardware devices sold by an authorized reseller, resulting in possession of private keys or seeds. The mechanism that allowed the keys to be obtained is under investigation by Ledger. Not a smart-contract vulnerability. Not an oracle bug.

Explorer URLs: Researcher-published collector addresses appear in the GoPlusSecurity post and in Specter and Bitquery notes. Example Lookonchain-linked wallet: https://arkm.com/explorer/address/0x6eb486CB5Afb1FBf2ccC84fAE649D55272FEEB62. Bitcoin example from Lookonchain: https://arkm.com/explorer/address/bc1q9r0jxknrtlc96dankvgkwa0347569rc6dn53fs. Full lists are in the source posts; this brief does not reprint every collector.

Status: First official statement is the Ledger Support post on 9 Oct. Reseller asked to pause sales. Investigation ongoing. Researcher loss estimates published the same day and into 10 Oct. No recovery figure published by Ledger. Users advised to use a fresh seed if the device was purchased from the reseller and already set up.

Sources: https://x.com/Ledger_Support/status/2108551100613714002, https://x.com/GoPlusSecurity/status/2108763510041960525, https://bitquery.io/investigations/ledger-cryptobilis-hack, and Lookonchain posts on individual drains.

Unclaimed bridge funds — Ethereum — about $3.55 million — EIP-7702 claim (ownership open)

What happened: BlockSec Phalcon posted at 03:39 UTC on 10 Oct that about six hours earlier roughly $3.55 million in unclaimed bridge funds was claimed and transferred out. The claims were submitted by an address truncated as 0x24a9 that was funded via Tornado Cash and executed through EIP-7702 delegations on the EOA. Several days earlier the on-chain researcher stuckfunds.eth had sent multiple messages to the truncated address 0x4943 notifying the owner that the funds were still claimable. Phalcon states that on-chain data confirms the authorizations were valid but does not establish whether the owner signed them intentionally, was tricked into signing them, or had the private key compromised. Two transactions are cited: one for about $1.33 million and one for about $2.22 million. The post includes short links to the transactions. This brief does not invent the full hashes. Secondary coverage repeats the same figures and the same open question on intent.

The event is not a protocol drain of a bridge contract. The funds were already claimable by the owner of the EOA. The open question is who controlled the key at the moment of the EIP-7702 authorization and the subsequent claim. Because the ownership and intent are not resolved in the posts read here, the $3.55 million is not added to the live-loss card. It remains a monitored item.

Protocol / chain / asset: Unclaimed bridge withdrawals belonging to an EOA. Chain is Ethereum in the reporting. Assets not itemized beyond the dollar totals in the Phalcon post. EIP-7702 is the mechanism used for the delegations.

Loss: About $3.55 million moved, Phalcon. Not scored as a confirmed third-party loss. No recovery figure. No freeze posted.

Attack type: Open. Valid EIP-7702 authorizations were used. Possible explanations named by Phalcon are intentional owner action, social engineering that induced a signature, or private-key compromise. Not resolved.

Explorer URLs: Transaction links are in the Phalcon post: TX1 and TX2 short links. Owner address truncated as 0x4943 and submitter as 0x24a9 in the alert text. Full addresses are not expanded in the posts read here. This brief does not invent them.

Status: First report in this window is the Phalcon post at 03:39 UTC on 10 Oct. No project statement. Ownership intent unresolved. Not scored as a confirmed exploit loss.

Sources: https://x.com/Phalcon_xyz/status/2108764415692771530

Also noted

  • UPDATE, 79Vault 15,000 BNB return: Already in the 9 Oct brief. CertiKAlert noted the return. Not a new loss.
  • UPDATE, HOT Omni Bridge / NEAR Intents: CertiKAlert on 9 Oct pointed to its report on the 30 Sept HOT Omni Bridge incident on NEAR that resulted in about $3.86 million in BSC treasury payouts which were later returned. Not a new drain.
  • DefimonAlerts on-chain messages: One message on 10 Oct concerns MakerDAO Flipper deal() calls on expired ETH-A auctions and a request for a small bounty. Earlier messages in the window concern settlement proposals. Not scored as new losses.
  • Lookonchain flow notes: Posts on USDT supply, whale deposits, and unrelated trader activity. Not protocol drains.
  • SlowMist, CertiK, Defimon, Phalcon, GoPlus, PeckShield, BlockSec, ZachXBT, Cyvers, Immunefi, rekt.news: No additional first-report protocol exploits used as figures beyond the items above.

Sources and references

Editor’s note: the scored live loss is the researcher estimate on the CryptoBilis-linked Ledger device drains. Ledger has not published a confirmed total or a final root-cause statement. The EIP-7702 bridge claim is an open ownership question and is not added to the card. Transaction hashes for the bridge event sit behind short links in the Phalcon post and are not expanded here.

Read more