Daily Brief

Web3 Daily Exploits — 12 Oct 2026: Quiet Window, Ledger Update, COLDCARD X Phish

Quiet day for new protocol drains. Monitored accounts posted no first-report smart-contract exploits with fresh loss figures in the last 24 hours. Ledger issued a follow-up limiting confirmed CryptoBilis implant cases to the Southeast Asian reseller. COLDCARD reported a phishing post on its official X account with no confirmed user losses. Card live loss is ~$0.

Jacobo Avariento

Jacobo Avariento

— 9 min read
Web3 Daily Exploits — 12 Oct 2026: Quiet Window, Ledger Update, COLDCARD X Phish

The 12 Oct America/Panama window is a quiet day for new protocol drains. As of the latest cutoff, monitored accounts posted no first-report smart-contract exploits or user-wallet drains with fresh loss figures used for scoring. Combined live loss on this card is approximately $0. The dominant material updates concern the ongoing CryptoBilis Ledger hardware-wallet supply-chain incident that opened on 9 Oct and a phishing post that appeared on the official COLDCARD X account on 11 Oct. Ledger published a follow-up on 11 Oct stating that the volume of impacted devices appears limited and that all confirmed cases related to the disclosed draining incident of 9 Oct involve devices sold through the Southeast Asia reseller CryptoBilis. On-chain researchers continue to track fund movement from the earlier estimated losses, including additional Tornado Cash activity reported on prior days. COLDCARD stated that a post containing a phishing link was published from its account, has since been deleted, and that an internal review found no unauthorized logins. No verified user losses have been reported in connection with that post. A small self-reported Permit2 signature reuse on Base involving roughly 3.19 WETH is noted below but is not scored as a protocol incident.

UPDATE: CryptoBilis Ledger devices — multi-chain — about $93 million estimated (not re-scored) — supply-chain / hardware implant

What happened: On 11 Oct Ledger issued a follow-up update stating that the volume of impacted devices appears limited. The company said that to date all confirmed cases related to the disclosed draining incident of 9 Oct 2026 involve devices sold through the Southeast Asia reseller CryptoBilis, and that its internal systems and direct sales channels remain unaffected. This follows the 10 Oct confirmation that one of the impacted users’ devices contained an unauthorized hardware implant. CryptoBilis has suspended sales of all hardware-wallet inventory pending the investigation. Secondary reporting on 11–12 Oct noted community claims of a possible tampered device purchased from MediaMarkt in Europe; Ledger has not confirmed that claim as part of the same incident. On-chain researchers, including Specter, previously reported that addresses linked to the incident deposited 2,990.3 ETH valued at about $7.45 million into Tornado Cash between 9 and 10 Oct, with additional runs including roughly 596.5 ETH on 11 Oct. PublicAML and other trackers have continued to map remaining balances and further outflows. These movements are laundering steps drawn from the existing researcher loss estimate and are not scored as incremental on this card.

Protocol / chain / asset: Not a protocol. Hardware wallets sold through reseller CryptoBilis. Chains previously named in researcher traces remain Bitcoin, Ethereum, Tron, BNB Chain, and Polygon. Assets include BTC, ETH, USDT and other tokens. The confirmed implant is a physical hardware modification. Tornado Cash deposits occurred on Ethereum.

Loss: About $92.9–93 million per the Bitquery reconstruction of 311 wallets cited in prior briefs. Other prints have ranged from roughly $72 million to $93.4 million. Ledger has not published a confirmed dollar total. The Tornado Cash deposits and subsequent movement are subsets of the earlier estimate and are not additive. Not re-scored on this card. Counted previously at about $93 million.

Attack type: Supply-chain compromise of hardware devices sold by an authorized reseller, resulting in possession of private keys or seeds. Ledger has confirmed an unauthorized hardware implant in one impacted user device. The precise mechanism remains under investigation. Not a smart-contract vulnerability. Not an oracle bug. Not a remote exploit of Ledger’s core systems according to the company’s statements.

Explorer URLs: Researcher-published collector addresses remain in prior coverage and the 10–11 Oct briefs. Full transaction lists for additional Tornado Cash deposits are not expanded in the secondary coverage read for this cutoff. This brief does not invent hashes. Example prior links: https://arkm.com/explorer/address/0x6eb486CB5Afb1FBf2ccC84fAE649D55272FEEB62 and Bitcoin example https://arkm.com/explorer/address/bc1q9r0jxknrtlc96dankvgkwa0347569rc6dn53fs.

Status: Implant confirmed by Ledger on 10 Oct. Follow-up on 11 Oct limits confirmed cases to CryptoBilis-sold devices and notes the volume appears limited. Reseller sales paused. Investigation ongoing with law-enforcement coordination. Users advised to use a fresh seed if the device was purchased from the reseller and already set up. Attacker continues to move funds. European device claim remains unverified by Ledger. No recovery figure published by Ledger.

Sources: https://x.com/Ledger_Support/status/2108968264055345381, CoinDesk coverage of the 11 Oct follow-up https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis, prior Bitquery investigation https://bitquery.io/investigations/ledger-cryptobilis-hack, and the 9 Oct Ledger Support post https://x.com/Ledger_Support/status/2108551100613714002.

COLDCARD X account — phishing post — social engineering — no confirmed loss

What happened: On 11 Oct a post containing a phishing link appeared on the official @COLDCARDwallet X account. The message reportedly claimed a critical issue with seed generation in recent firmware and directed users toward a fake migration site (reported as migrate.coldcardwallet.io). COLDCARD deleted the post and stated that it is investigating how the post was published. The company said the account has used offline two-factor authentication and tightly restricted access since 2017, that an internal review found no unauthorized logins or access records, and that it has contacted X to investigate possible platform-level issues. COLDCARD advised users not to visit or interact with the link and reminded them that its only official website is https://coldcard.com. No verified user losses have been reported in connection with the post.

Protocol / chain / asset: Not a blockchain protocol or on-chain drain. Official social-media account of a Bitcoin hardware-wallet maker. The risk is users following a phishing link and entering seed phrases or connecting devices to an attacker-controlled site. No on-chain transaction list is applicable.

Loss: No confirmed dollar figure or user reports of completed thefts published by the company or monitored accounts. Not scored as a live-loss incident on this card.

Attack type: Social-engineering / phishing via a post from a trusted account. The method by which the post was published remains under investigation; the company has not confirmed credential compromise. Not a smart-contract vulnerability. Not a hardware implant in devices.

Explorer URLs: Not applicable (social-media phishing post, not an on-chain drain).

Status: Post deleted. Investigation ongoing. Users advised to avoid the link and rely only on coldcard.com. No confirmed losses.

Sources: COLDCARD statement as reported in CoinCentral, CryptoBriefing, TokenPost and The Blockopedia on 11–12 Oct. Example coverage: https://coincentral.com/coldcard-hacked-again-phishing-link-appears-on-bitcoin-wallet-makers-x-account/.

Also noted

  • Vestaa / Base Permit2 signature reuse (small, unconfirmed for scoring): DefimonAlerts posted an on-chain message on 11 Oct from an address identifying as Vestaa. The message states that transaction 0x59c5ca6f20745841818d15a1a9a3f6b9586f97a205aa20fa94ec0f8ea764e885 on Base took 3.1924 WETH after reusing a Permit2 signature that leaked from a prior failed transaction through a bug in their own swap contract. The team said they have shut the affected system down and requested a partial return. No monitored account posted this as a confirmed protocol drain with a loss figure used for scoring. Not scored.
  • P7 DarkSword iOS spyware (malware advisory, no confirmed crypto theft): Coverage on 11–12 Oct of an iVerify report on the P7 DarkSword variant, which can scan for wallet apps including imToken and process Keychain data on-device. The findings were published earlier in October; no confirmed cryptocurrency theft amount has been tied to this variant in the reports read here. Not scored as a protocol loss.
  • Prior protocol items (UPDATE, not re-scored): BitBay StableVault (~$14k), EtherVista (~$18.6k), 79Vault (~$12.5M), Base vault (~$6M), and earlier items remain as previously briefed. No material new figures in this window.
  • Lookonchain / ZachXBT: Trading notes, whale deposits, and commentary on white-hat bounties and XRP. No new drains.
  • Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, and rekt.news did not post a first-report protocol exploit with a fresh loss figure used for scoring in this cutoff.

Sources and references

Editor’s note: the scored live loss on this card is approximately $0. No new first-report protocol drains were posted by the monitored accounts in the last 24 hours. The Ledger / CryptoBilis item is carried as an UPDATE with a company follow-up limiting confirmed cases; the prior researcher estimate is not re-scored. The COLDCARD X post is a phishing incident with no confirmed losses. The Vestaa Permit2 note is a self-reported small bug and is not scored. Prior-day items remain on their original briefs. No how-to or exploit reproduction steps. Stay tuned or stay rekt.

Read more