Q3 2026 Supply Chain Exploit Wave

27 July 2026

Adform detects and removes malicious clipboard-hijacking code appended to its JavaScript tracking script (trackpoint-async.js), which had been serving cryptocurrency address-replacement payloads across approximately 14,000 customer sites.

30 July 2026

Coinkite discloses a firmware entropy vulnerability in Coldcard hardware wallets dating to a March 2021 build configuration error; attackers begin exploiting weakly generated seed phrases to drain funds from over 5,200 addresses without physical device access.

4 August 2026

ChainDrop npm worm begins propagating through the keyv and cacheable package ecosystems after a maintainer's GitHub account is compromised; the worm spreads to over 452 packages (2,251 versions, ~2 billion monthly downloads) in under four hours by stealing and reusing developer tokens.

30 August 2026

Attacker manipulates TONIC oracle price 100x on Cronos to borrow $120.4 million from Tectonic lending protocol; Cronos validators halt and roll back 114 minutes of chain history, reversing $111.2 million; $8.3 million that had already bridged to Ethereum is not recovered.

1 September 2026

Blockstream merges a patch for the Elements range-proof verification cache bug into the open-source repository; the fix is not yet deployed to production Liquid Network bridge nodes.

6 September 2026

Unknown actor exploits the undeployed Elements cache-collision patch to mint ~3,998 unbacked L-BTC and peg them out for real Bitcoin, draining 95% of Liquid Network's reserves (~$320 million) in 23 minutes; attacker communicates via Bitcoin OP_RETURN claiming white-hat status.

11 September 2026

Blockstream CEO Adam Back publicly rejects the attacker's $47 million ransom/bounty demand and refers the matter to law enforcement; attacker had returned 3,400 BTC following patch deployment.

24 September 2026

Bitget discloses unauthorized withdrawals from its hot and warm wallet infrastructure; $387.5 million exits across 23 transfers in roughly three hours via a zero-day vulnerability in a third-party security product; Bitget CEO Gracy Chen alleges North Korean threat actors are responsible.

9 October 2026

Reports emerge of widespread fund drains from Ledger hardware wallets purchased through Southeast Asian reseller CryptoBilis; losses estimated at $92.9–$103.4 million across ~300–530 wallets.

12 October 2026

Ledger confirms an unauthorized hardware implant (embedded eSIM) in at least one CryptoBilis-sold device that captured 24-word recovery phrases at setup and transmitted them over mobile networks; Ledger states internal systems and direct sales channels are unaffected.

15 October 2026

Hacken publishes Q3 2026 crypto security report documenting $1.18 billion in gross losses across 107 incidents, attributing approximately 77% to supply chain and infrastructure weaknesses.