Audit log

Every state-changing event for Q3 2026 Supply Chain Exploit Wave: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-16 12:18:04Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 457,634,769

   sig

   5KPEMhgzZHt4…qZiqcnW6copyexplorer ↗

   hash

   nUTxv4T9hhuw…UP7Qh4xfcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (38956 B) ▸

   {"actor":"system:backfill","investigation_id":"8765d52f-4dad-4586-ba2d-e81a6beff194","kind":"publish","page_slug":"q3-2026-supply-chain-exploit-wave","published_at":"2026-10-16T12:18:04.820Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Q3 2026 Supply Chain Exploit Wave","sections":[{"content":"Cryptocurrency hacks totaled $1.18 billion across 107 recorded incidents in Q3 2026 (July 1 – September 30), a 55% increase over Q2 2026 and the worst quarterly total since Q1 2025, when the Bybit breach pushed losses to $1.6 billion. Security firm Hacken, whose methodology measures the gross value of assets involved at the time of incidents, attributed approximately 77% of losses — roughly $906 million — to what it categorized as broad infrastructure weaknesses: compromised suppliers or developer tools, publicly disclosed fixes that had not yet been deployed, and components outside security review scope. Of the $1.18 billion gross total, approximately $387 million was returned or reversed (a 33% gross recovery rate), operators covered an additional $410 million from user-protection funds, and approximately $384 million remained unrecovered as permanent loss. The four largest incidents — Bitget ($387.5M), Liquid Network ($320M), Tectonic ($120M), and Coldcard ($115M) — accounted for roughly 80% of quarterly losses. The remaining 103 incidents averaged below $10 million each, with a median loss of $670,000. Smart contract exploits were the most frequent attack category, accounting for $228 million across 71 incidents, though per-incident losses from infrastructure and supply chain compromises were significantly larger.","heading":"Overview and Aggregate Impact","severity":"critical","sources":[{"credibility":2,"name":"Crypto Hacks Hit $1.18B in Q3 2026 as Supply Chain Exploits Drive 77% of Losses","type":"news_article","url":"https://gokhshtein.com/news/2026-10-15-crypto-hacks-hit-118b-in-q3-2026-as-supply-chain-exploits"},{"credibility":2,"name":"Bitget, Liquid Exploits Push Crypto Hacks near $1.2B in Q3 — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3"},{"credibility":2,"name":"Broad Security Weaknesses Accounted for 77% of Q3 2026 Crypto Hack Losses — TokenPost","type":"news_article","url":"https://www.tokenpost.com/news/technology/32453"},{"credibility":2,"name":"Q3 2026 Crypto Hacks Report — ChangeNow","type":"research","url":"https://changenow.io/blog/q3-2026-crypto-hacks-report"}]},{"content":"On September 24, 2026, the cryptocurrency exchange Bitget disclosed that threat actors had stolen an estimated $387.5 million — revised upward from an initial figure of $351.6 million after additional unauthorized transfers were identified. The theft represents the single largest cryptocurrency incident of 2026 to date. Independent investigations by Mandiant and SlowMist found that the attackers exploited a zero-day vulnerability in a third-party security product that Bitget relied upon for wallet authorization. The attackers compromised backend wallet infrastructure, spoofed transaction data, and caused the exchange's own authorization system to approve fraudulent withdrawals that were disguised as routine administrative operations. Private keys and cold wallets were not reported to be compromised. Approximately $387 million left the exchange across 23 individual transfers within roughly three hours. Stolen funds moved across Ethereum (49.7%), XRP (40.8%), Zcash (7.6%), and Tron (1.8%), with cross-chain liquidity protocols used to convert XRP to Bitcoin. Bitget CEO Gracy Chen stated publicly during a livestream on X that the company suspected a North Korean hacking group was responsible. Blockchain analytics firms Elliptic and TRM Labs identified wallet overlaps with infrastructure used in prior hacks attributed to North Korean actors. Chainalysis noted that the Bitget theft alone pushed North Korea's confirmed 2026 crypto haul past $1 billion. As of the time of this report, no government agency has formally attributed the attack, and no charges have been filed. The North Korean attribution remains an allegation, not an adjudicated finding.","heading":"Bitget Exchange Breach ($387.5 Million) — Alleged North Korean Attribution","severity":"critical","sources":[{"credibility":2,"name":"Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html"},{"credibility":1,"name":"North Korea accused of plundering Bitget for $387 million in year's biggest crypto attack — Fortune","type":"news_article","url":"https://fortune.com/2026/09/25/north-korea-bitget-387-million-crypto-attack/"},{"credibility":2,"name":"Bitget blames North Korea for $387.5M crypto wallet raid — The Register","type":"news_article","url":"https://www.theregister.com/cyber-crime/2026/09/25/bitget-blames-north-korea-for-3875m-crypto-wallet-raid/5299218"},{"credibility":2,"name":"Bitget Suffers Year's Largest Crypto Hack as Losses Top $387 Million — PYMNTS","type":"news_article","url":"https://www.pymnts.com/cryptocurrency/2026/bitget-suffers-years-largest-crypto-hack-as-losses-top-387-million/"},{"credibility":2,"name":"Bitget $388M Theft: Third-Party Security Flaw Exploited in 2026 Supply Chain Attack — Aviatrix","type":"research","url":"https://aviatrix.ai/threat-research-center/bitget-third-party-security-flaw-388m-theft-2026/"}]},{"content":"On September 6, 2026, an unknown actor exploited a range-proof verification cache bug in Elements, the open-source Bitcoin sidechain software developed by Blockstream that underlies the Liquid Network. The flaw involved a cache-key collision: a maliciously constructed proof could collide on the same cache key as a previously validated proof, causing the node to return the cached 'valid' result without re-verifying the new proof. The attacker used this vulnerability to mint approximately 3,998 unbacked L-BTC — representing claims on Bitcoin with no corresponding locked BTC — and pegged them out for real Bitcoin, draining approximately 95% of Liquid's reserves in 23 minutes. The gross value of assets involved was approximately $320 million at prevailing prices. Critically, Blockstream had already merged a patch for this bug in the Elements source code on September 1, five days before the attack, but no release containing the fix had been deployed to production bridge nodes at the time of exploitation. This gap between fix availability and deployment was noted by security researchers as a defining feature of the incident. The attacker communicated via Bitcoin OP_RETURN messages, claiming white-hat status and stating: 'Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.' Following Blockstream's patch deployment, the attacker returned 3,400 BTC. The attacker retained 598.5 BTC (approximately $47 million) as a self-declared bounty. Blockstream CEO Adam Back publicly rejected the ransom demand on September 11, pledged to cover the 1:1 L-BTC peg from company reserves, and referred the matter to law enforcement. Whether the actor was acting in good faith as a white hat or simply extracting maximum value under cover of a white-hat claim remains contested; no criminal charges have been filed.","heading":"Liquid Network Cache-Collision Exploit ($320 Million)","severity":"critical","sources":[{"credibility":2,"name":"Explained: The Liquid Network Hack (September 2026) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-liquid-network-hack-september-2026"},{"credibility":2,"name":"Liquid Network drained of $320M in cache bug exploit — crypto.news","type":"news_article","url":"https://crypto.news/liquid-network-320-million-drain-cache-bug-unbacked-bitcoin/"},{"credibility":2,"name":"Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/09/liquid-hackers-return-3400-bitcoin.html"},{"credibility":2,"name":"How The $320M Exploit of Liquid Network Went Down — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/320m-exploit-liquid-network/"}]},{"content":"Beginning July 30, 2026, attackers exploited a firmware flaw in Coinkite's Coldcard hardware Bitcoin wallet that had been dormant since a March 2021 build configuration error. The root cause was a single commit in firmware version 4.0.1 that changed seed generation to route through a software-based pseudo-random number generator (ngu.random.bytes) rather than the device's STM32 hardware entropy source (ckcc.rng_bytes). This reduced effective seed entropy from the designed 128 bits to as low as 40 bits on Mk3 devices and approximately 72 bits on Mk4, Mk5, and Q models. The reduced entropy allowed attackers to regenerate candidate seeds offline through brute-force computation — without physical access to any victim device. Coinkite disclosed the flaw on July 30. Attacks occurred across four waves. TRM Labs documented approximately 1,816 BTC drained from over 5,200 addresses, with total losses estimated at approximately $116 million; some trackers place the figure above $130 million due to ongoing drains. Loss estimates cited in various reports range between $115 million and $130 million, reflecting different measurement windows. On-chain analysis showed minimal laundering activity in the initial days, with one 64.9 BTC Wasabi deposit and 200 ETH moved to Tornado Cash observed as of early August. A critical aspect of this incident is that updating device firmware does not remediate wallets already generated on affected firmware — users must generate entirely new seeds on patched hardware and manually migrate funds. This left a large population of affected users facing permanent exposure.","heading":"Coldcard Firmware Entropy Vulnerability ($115–130 Million)","severity":"critical","sources":[{"credibility":2,"name":"The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":1,"name":"Coldcard urges users to move bitcoin as active wallet exploit continues — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/04/coldcard-urges-users-to-move-bitcoin-as-active-wallet-exploit-continues"},{"credibility":2,"name":"Coldcard Hardware Wallet Hacked via Firmware Bug That Bypassed RNG for Five Years — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/322392/20260731/coldcard-hardware-wallet-hacked-via-firmware-bug-that-bypassed-rng-five-years.htm"},{"credibility":2,"name":"Coldcard hack: how a build flag drained $116M in bitcoin — crypto.news","type":"news_article","url":"https://crypto.news/coldcard-hack-bitcoin-self-custody-entropy/"},{"credibility":2,"name":"Hardware Wallet Attacks Drain $200M in 2026, Coldcard Bug Responsible for Half — Gokhshtein Media","type":"news_article","url":"https://gokhshtein.com/news/2026-10-10-hardware-wallet-attacks-drain-200m-in-2026-coldcard-bug"}]},{"content":"On August 30, 2026, an attacker drained approximately $120.4 million from Tectonic, the largest lending protocol on the Cronos blockchain, through a Mango Markets-style oracle-manipulation exploit. The attack relied on TONIC, Tectonic's native governance token, which had extremely thin trading liquidity of roughly $1.34 million and minimal daily volume of approximately $11,000. The attacker manipulated TONIC's price upward by approximately 100x within 20 minutes, then deposited the inflated tokens as collateral to borrow $120.4 million in dollar stablecoins, bitcoin, and XRP against Tectonic's published 20% collateral factor. In a significant and contested intervention, Cronos validators froze the entire blockchain mid-attack and then rolled back 114 minutes of settled transaction history, reversing approximately $111.2 million of the affected borrowing. Approximately $8.3 million that had already bridged to Ethereum in the 83 seconds before the halt could not be reversed and was not recovered. Blockchain rollbacks of this nature are rare and their use is a subject of ongoing debate regarding the tradeoffs between fund recovery and the integrity of transaction finality guarantees. The initial loss figure widely reported by The Block and others was $75 million; later analyses including CoinTelegraph's Q3 summary placed the gross figure at $120.4 million. The discrepancy reflects different measurement points and the partial rollback. No threat actor has been publicly identified or charged in connection with this incident.","heading":"Tectonic / Cronos Oracle-Manipulation Exploit ($120 Million; $111 Million Reversed)","severity":"high","sources":[{"credibility":2,"name":"The $120 Million Tectonic Hack That Shut Down Cronos — Bitquery","type":"research","url":"https://bitquery.io/investigations/tectonic-exploit-120-million"},{"credibility":1,"name":"Crypto.com-linked Cronos network halts after Tectonic exploit estimated at $75 million — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-30-crypto-com-linked-cronos-network-halts-after-tectonic-exploit-estimated-at-75-million-413069"},{"credibility":2,"name":"Cronos Halts Its Blockchain After $75M Tectonic Exploit. The Attack Started With a 100x TONIC Pump — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/31/cronos-halts-entire-blockchain-after-75m-tectonic-exploit-only-6m-escapes/"}]},{"content":"On August 4, 2026, a sophisticated self-propagating software supply chain attack dubbed ChainDrop entered the npm ecosystem via a compromised GitHub account belonging to the maintainer of the widely used keyv and cacheable packages. Keyv had approximately 127 million weekly npm downloads. The attacker published the first malicious release (keyv@6.0.0) at approximately 09:00 UTC. Each poisoned package contained a 'preinstall' hook in package.json that caused a hidden script (setup.mjs) to execute automatically before any npm install completed. The dropper installed a Bun runtime and ran an obfuscated payload (Math_Symbol.js) that stole npm tokens, GitHub tokens, AWS credentials, Kubernetes service account tokens, and HashiCorp Vault tokens. Stolen credentials were RSA-encrypted and exfiltrated to attacker-created public GitHub repositories. A fallback command-and-control address was dynamically resolved via an Ethereum smart contract using the EtherHiding technique, allowing C2 rotation without modifying the payload. The worm self-propagated by using harvested npm and GitHub tokens to publish further infected package versions, spreading to over 2,251 versions of 452 unique packages with approximately 2 billion combined monthly downloads within hours. A critical bypass was that malicious releases carried valid SLSA Build Level 3 provenance, because the attacker had control of the source repository and triggered the legitimate GitHub Actions workflows. This rendered standard SLSA-based integrity verification ineffective. Microsoft, Elastic Security Labs, Palo Alto Unit 42, and others published analyses. The ChainDrop worm is described as a variant of the Mini Shai-Hulud family. Attribution to a group identified as TeamPCP has been alleged by Picus Security based on code and infrastructure similarities to earlier campaigns; however, attribution remains unconfirmed. In May 2026, actors claiming association with TeamPCP publicly released earlier Shai-Hulud worm source code, which may have enabled independent derivative campaigns. No government body has publicly charged any individual in connection with ChainDrop as of October 2026. The direct financial loss attributable to ChainDrop in the crypto ecosystem specifically has not been separately quantified in public reporting.","heading":"ChainDrop npm Worm (Shai-Hulud Family) — Keyv/Cacheable Ecosystem Compromise","severity":"critical","sources":[{"credibility":1,"name":"ChainDrop supply chain compromise: Anatomy of a self-propagating worm — Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/"},{"credibility":2,"name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages — Elastic Security Labs","type":"research","url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain"},{"credibility":2,"name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 — StepSecurity","type":"research","url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"},{"credibility":2,"name":"ChainDrop: Inside a Self-Propagating npm Worm — Palo Alto Unit 42","type":"research","url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/"},{"credibility":2,"name":"ChainDrop npm worm hits 400+ packages: supply-chain attack explained — SupplierShield","type":"news_article","url":"https://www.suppliershield.com/post/chaindrop-npm-supply-chain-worm"},{"credibility":2,"name":"CanisterWorm: How TeamPCP Turned the npm Ecosystem Into a Weapon — Picus Security","type":"research","url":"https://www.picussecurity.com/resource/blog/canisterworm-how-teampcp-turned-the-npm-ecosystem-into-a-weapon"},{"credibility":1,"name":"Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages — CSA Singapore","type":"regulatory","url":"https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/"}]},{"content":"On July 27, 2026, Adform, a European online advertising firm whose JavaScript tracking script (trackpoint-async.js) was loaded by approximately 14,000 business websites, detected and removed malicious code that had been appended to its library. The attacker added an obfuscated, self-executing payload to the legitimate script. The code polled users' clipboards every three seconds and replaced any Bitcoin, Ethereum, or TRON wallet address patterns it detected with attacker-controlled addresses. It also rewrote wallet addresses displayed directly on web pages. Because the payload arrived via a trusted third-party JavaScript resource loaded during ordinary browsing, it required no executable download or malicious browser extension on the victim's device. Security researcher Kevin Beaumont identified the attack; the malicious code evaded all VirusTotal antivirus engines at the time of discovery. Adform detected the incident, removed the code, notified affected clients, and reported the matter to authorities. The total financial loss from this attack has not been separately quantified in public reporting; the incident is classified as a supply chain compromise affecting the ad-tech delivery layer rather than crypto infrastructure directly.","heading":"Adform Ad-Tech Script Compromise — Clipboard Hijacking on Crypto Sites","severity":"high","sources":[{"credibility":2,"name":"Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html"},{"credibility":2,"name":"Adform 2026 Supply-Chain Attack Leads to Cryptocurrency Theft — Aviatrix","type":"research","url":"https://aviatrix.ai/threat-research-center/adform-2026-supply-chain-attack-cryptocurrency-theft/"},{"credibility":2,"name":"Online ad firm Adform's script compromised to steal cryptocurrency — Mediastreet","type":"news_article","url":"https://mediastreet.ie/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/"}]},{"content":"Although falling just outside Q3 2026, a related hardware supply chain incident emerged in early October 2026 and is included here for context. On October 12, 2026, Ledger disclosed that an unauthorized hardware implant had been found in at least one device sold by CryptoBilis, an authorized Southeast Asian reseller operating in Indonesia, Malaysia, and the Philippines. The implant was described as a covert cellular component — an embedded eSIM — that captured the user's 24-word recovery phrase from the screen during initial device setup and transmitted it over a mobile network. On-chain trackers placed estimated losses at between $92.9 million and $103.4 million across approximately 300–530 wallets across seven blockchain networks. Ledger stated that all confirmed cases traced to CryptoBilis-sold devices, and that its own internal systems and direct sales channels were unaffected. The incident is classified as a physical supply chain attack, not a software or server-side breach. No criminal charges have been filed as of October 16, 2026. CryptoBilis was reported to have been sold to new ownership under a non-disclosure agreement prior to the discovery, according to early reports; this claim has not been independently verified by a Tier 1 source and should be treated as low confidence.","heading":"Ledger / CryptoBilis Hardware Implant (Post-Period, October 2026)","severity":"critical","sources":[{"credibility":1,"name":"Ledger says unauthorized implant found in at least one device sold by CryptoBilis — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis"},{"credibility":2,"name":"Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html"},{"credibility":2,"name":"Ledger confirms spy chip implant behind wallet crypto thefts — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/"},{"credibility":2,"name":"Hackers reportedly drain up to $93 million through compromised Ledger reseller — CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/ledger-reseller-supply-chain-hack-implants/"}]},{"content":"ChainDrop was the most prominent but not the only software supply chain threat active in this period. The Shai-Hulud family of npm worms predates ChainDrop; an earlier variant's source code was allegedly released publicly by actors claiming association with TeamPCP in May 2026, lowering the barrier for derivative campaigns. Earlier in 2026, the Mastra AI npm scope was compromised (June 17, 2026), resulting in more than 140 packages being republished with malicious dependencies targeting 166 cryptocurrency wallet browser-extension IDs including MetaMask, Phantom, Coinbase Wallet, and Binance Wallet. In March 2026, the widely used Axios HTTP client (100 million+ weekly downloads) was compromised via stolen npm credentials, with malicious versions deploying a fake dependency (plain-crypto-js) with automatic post-install execution. CISA issued an advisory on the Axios compromise in April 2026. North Korea's Lazarus Group and affiliated operations (including the Contagious Interview campaign) continued publishing malicious npm packages impersonating common libraries throughout 2026, targeting Web3 developers. Chainalysis attributed North Korea's confirmed 2026 crypto theft total to over $1 billion following the Bitget breach.","heading":"Broader npm and Developer Tooling Threat Context","severity":"high","sources":[{"credibility":1,"name":"Supply Chain Compromise Impacts Axios Node Package Manager — CISA","type":"regulatory","url":"https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager"},{"credibility":3,"name":"npm Supply Chain Attack: North Korea Hits Mastra AI — Tech Insider","type":"news_article","url":"https://tech-insider.org/npm-supply-chain-attack-2026/"},{"credibility":2,"name":"Axios NPM Package Compromised: Supply Chain Attack — Trend Micro","type":"research","url":"https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html"},{"credibility":2,"name":"The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) — Palo Alto Unit 42","type":"research","url":"https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/"},{"credibility":2,"name":"Six Supply Chain Attack Groups to Watch Out for in 2026 — Group-IB","type":"research","url":"https://www.group-ib.com/blog/supply-chain-attack-groups-2026/"},{"credibility":3,"name":"North Korean Hackers Pushed 2026 Crypto Theft Past One Billion Dollars — Startup Fortune","type":"news_article","url":"https://startupfortune.com/north-korean-hackers-pushed-2026-crypto-theft-past-one-billion-dollars/"}]},{"content":"Security researchers identified several recurring patterns across Q3 2026 supply chain incidents. First, the deployment gap: in two of the four largest incidents (Liquid Network and Coldcard), a known vulnerability or available fix had existed before exploitation — the Liquid Network patch was merged five days before the attack, and the Coldcard firmware flaw had existed since 2021. Second, trusted-path abuse: ChainDrop and the Adform attack both propagated through trusted infrastructure (legitimate GitHub Actions workflows carrying valid SLSA provenance; a widely deployed ad-tech CDN script) rather than through obviously malicious delivery channels, reducing the effectiveness of standard integrity verification. Third, Ethereum-based C2: the ChainDrop worm used EtherHiding — encoding command-and-control server addresses in Ethereum smart contracts — to enable attacker-side C2 rotation without payload modification, bypassing domain-based blocklists. Fourth, thin-liquidity oracle manipulation remained viable on Cronos via Tectonic's TONIC token, consistent with attack patterns seen as far back as the 2022 Mango Markets incident. Fifth, hardware supply chains were targeted at both firmware (Coldcard) and physical device (Ledger/CryptoBilis) levels, with both attacks achieving scale without requiring direct access to victim devices.","heading":"Attack Vectors and Common Patterns","severity":"high","sources":[{"credibility":2,"name":"Crypto Hacks Hit $1.18B in Q3 2026 as Supply Chain Exploits Drive 77% of Losses — Gokhshtein Media","type":"news_article","url":"https://gokhshtein.com/news/2026-10-15-crypto-hacks-hit-118b-in-q3-2026-as-supply-chain-exploits"},{"credibility":2,"name":"Tracking Shai-Hulud: Inside the ChainDrop NPM Worm — Zscaler","type":"research","url":"https://www.zscaler.com/blogs/security-research/tracking-shai-hulud-inside-chaindrop-npm-worm"},{"credibility":2,"name":"Adform Supply Chain Attack: JavaScript Crypto Clipper Analysis — Hecavex","type":"research","url":"https://hecavex.en/research/adform-supply-chain-crypto-clipper/"}]}],"sources_used":[{"credibility":2,"name":"Crypto Hacks Hit $1.18B in Q3 2026 as Supply Chain Exploits Drive 77% of Losses — Gokhshtein Media","type":"news_article","url":"https://gokhshtein.com/news/2026-10-15-crypto-hacks-hit-118b-in-q3-2026-as-supply-chain-exploits"},{"credibility":2,"name":"Bitget, Liquid Exploits Push Crypto Hacks near $1.2B in Q3 — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3"},{"credibility":2,"name":"Broad Security Weaknesses Accounted for 77% of Q3 2026 Crypto Hack Losses — TokenPost","type":"news_article","url":"https://www.tokenpost.com/news/technology/32453"},{"credibility":2,"name":"Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html"},{"credibility":1,"name":"North Korea accused of plundering Bitget for $387 million in year's biggest crypto attack — Fortune","type":"news_article","url":"https://fortune.com/2026/09/25/north-korea-bitget-387-million-crypto-attack/"},{"credibility":2,"name":"Bitget blames North Korea for $387.5M crypto wallet raid — The Register","type":"news_article","url":"https://www.theregister.com/cyber-crime/2026/09/25/bitget-blames-north-korea-for-3875m-crypto-wallet-raid/5299218"},{"credibility":2,"name":"Explained: The Liquid Network Hack (September 2026) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-liquid-network-hack-september-2026"},{"credibility":2,"name":"Liquid Network drained of $320M in cache bug exploit — crypto.news","type":"news_article","url":"https://crypto.news/liquid-network-320-million-drain-cache-bug-unbacked-bitcoin/"},{"credibility":2,"name":"Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/09/liquid-hackers-return-3400-bitcoin.html"},{"credibility":2,"name":"How The $320M Exploit of Liquid Network Went Down — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/320m-exploit-liquid-network/"},{"credibility":2,"name":"The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":1,"name":"Coldcard urges users to move bitcoin as active wallet exploit continues — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/04/coldcard-urges-users-to-move-bitcoin-as-active-wallet-exploit-continues"},{"credibility":2,"name":"Coldcard hack: how a build flag drained $116M in bitcoin — crypto.news","type":"news_article","url":"https://crypto.news/coldcard-hack-bitcoin-self-custody-entropy/"},{"credibility":2,"name":"The $120 Million Tectonic Hack That Shut Down Cronos — Bitquery","type":"research","url":"https://bitquery.io/investigations/tectonic-exploit-120-million"},{"credibility":1,"name":"Crypto.com-linked Cronos network halts after Tectonic exploit estimated at $75 million — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-30-crypto-com-linked-cronos-network-halts-after-tectonic-exploit-estimated-at-75-million-413069"},{"credibility":1,"name":"ChainDrop supply chain compromise: Anatomy of a self-propagating worm — Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/"},{"credibility":2,"name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages — Elastic Security Labs","type":"research","url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain"},{"credibility":2,"name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 — StepSecurity","type":"research","url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"},{"credibility":2,"name":"ChainDrop: Inside a Self-Propagating npm Worm — Palo Alto Unit 42","type":"research","url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/"},{"credibility":1,"name":"Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages — CSA Singapore","type":"regulatory","url":"https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/"},{"credibility":2,"name":"Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html"},{"credibility":2,"name":"Adform 2026 Supply-Chain Attack Leads to Cryptocurrency Theft — Aviatrix","type":"research","url":"https://aviatrix.ai/threat-research-center/adform-2026-supply-chain-attack-cryptocurrency-theft/"},{"credibility":1,"name":"Ledger says unauthorized implant found in at least one device sold by CryptoBilis — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis"},{"credibility":2,"name":"Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html"},{"credibility":2,"name":"Ledger confirms spy chip implant behind wallet crypto thefts — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/"},{"credibility":1,"name":"Supply Chain Compromise Impacts Axios Node Package Manager — CISA","type":"regulatory","url":"https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager"},{"credibility":2,"name":"Q3 2026 Crypto Hacks Report — ChangeNow","type":"research","url":"https://changenow.io/blog/q3-2026-crypto-hacks-report"},{"credibility":2,"name":"Tracking Shai-Hulud: Inside the ChainDrop NPM Worm — Zscaler","type":"research","url":"https://www.zscaler.com/blogs/security-research/tracking-shai-hulud-inside-chaindrop-npm-worm"},{"credibility":2,"name":"CanisterWorm: How TeamPCP Turned the npm Ecosystem Into a Weapon — Picus Security","type":"research","url":"https://www.picussecurity.com/resource/blog/canisterworm-how-teampcp-turned-the-npm-ecosystem-into-a-weapon"}],"summary":"Between July and September 2026, the cryptocurrency ecosystem suffered $1.18 billion in losses across 107 recorded incidents, making Q3 2026 the most damaging quarter since Q1 2025. Security firm Hacken attributed approximately 77% of gross losses (roughly $906 million) to compromised suppliers, developer tools, or infrastructure components that fell outside standard security audits. The wave encompassed a firmware entropy flaw in Coinkite's Coldcard hardware wallet, a self-propagating npm worm (ChainDrop), a range-proof cache-collision bug in Blockstream's Liquid Network, an oracle-manipulation attack on the Tectonic lending protocol, a hardware implant discovered in wallets sold by Southeast Asian reseller CryptoBilis, and a zero-day exploit in third-party security tooling that enabled the $387.5 million theft from Bitget.","timeline":[{"date":"2026-07-27","event":"Adform detects and removes malicious clipboard-hijacking code appended to its JavaScript tracking script (trackpoint-async.js), which had been serving cryptocurrency address-replacement payloads across approximately 14,000 customer sites.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html"},{"date":"2026-07-30","event":"Coinkite discloses a firmware entropy vulnerability in Coldcard hardware wallets dating to a March 2021 build configuration error; attackers begin exploiting weakly generated seed phrases to drain funds from over 5,200 addresses without physical device access.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/08/04/coldcard-urges-users-to-move-bitcoin-as-active-wallet-exploit-continues"},{"date":"2026-08-04","event":"ChainDrop npm worm begins propagating through the keyv and cacheable package ecosystems after a maintainer's GitHub account is compromised; the worm spreads to over 452 packages (2,251 versions, ~2 billion monthly downloads) in under four hours by stealing and reusing developer tokens.","source":"Microsoft Security Blog","source_url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/"},{"date":"2026-08-30","event":"Attacker manipulates TONIC oracle price 100x on Cronos to borrow $120.4 million from Tectonic lending protocol; Cronos validators halt and roll back 114 minutes of chain history, reversing $111.2 million; $8.3 million that had already bridged to Ethereum is not recovered.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-08-30-crypto-com-linked-cronos-network-halts-after-tectonic-exploit-estimated-at-75-million-413069"},{"date":"2026-09-01","event":"Blockstream merges a patch for the Elements range-proof verification cache bug into the open-source repository; the fix is not yet deployed to production Liquid Network bridge nodes.","source":"Halborn","source_url":"https://www.halborn.com/blog/post/explained-the-liquid-network-hack-september-2026"},{"date":"2026-09-06","event":"Unknown actor exploits the undeployed Elements cache-collision patch to mint ~3,998 unbacked L-BTC and peg them out for real Bitcoin, draining 95% of Liquid Network's reserves (~$320 million) in 23 minutes; attacker communicates via Bitcoin OP_RETURN claiming white-hat status.","source":"Halborn","source_url":"https://www.halborn.com/blog/post/explained-the-liquid-network-hack-september-2026"},{"date":"2026-09-11","event":"Blockstream CEO Adam Back publicly rejects the attacker's $47 million ransom/bounty demand and refers the matter to law enforcement; attacker had returned 3,400 BTC following patch deployment.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/09/liquid-hackers-return-3400-bitcoin.html"},{"date":"2026-09-24","event":"Bitget discloses unauthorized withdrawals from its hot and warm wallet infrastructure; $387.5 million exits across 23 transfers in roughly three hours via a zero-day vulnerability in a third-party security product; Bitget CEO Gracy Chen alleges North Korean threat actors are responsible.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html"},{"date":"2026-10-09","event":"Reports emerge of widespread fund drains from Ledger hardware wallets purchased through Southeast Asian reseller CryptoBilis; losses estimated at $92.9–$103.4 million across ~300–530 wallets.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis"},{"date":"2026-10-12","event":"Ledger confirms an unauthorized hardware implant (embedded eSIM) in at least one CryptoBilis-sold device that captured 24-word recovery phrases at setup and transmitted them over mobile networks; Ledger states internal systems and direct sales channels are unaffected.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis"},{"date":"2026-10-15","event":"Hacken publishes Q3 2026 crypto security report documenting $1.18 billion in gross losses across 107 incidents, attributing approximately 77% to supply chain and infrastructure weaknesses.","source":"Gokhshtein Media / Hacken","source_url":"https://gokhshtein.com/news/2026-10-15-crypto-hacks-hit-118b-in-q3-2026-as-supply-chain-exploits"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e701d8e1-5423-4d77-83e0-c96dbacd4702copy