Crypto Hacks and Security
This page collects every CryptoTicker.io report on attacks and fraud in the crypto market: hacked exchanges, exploits in DeFi protocols and bridges, stolen NFTs, wallet drainers, phishing, abused token approvals and rug pulls. The newest cases are at the top.
A hack is rarely over after one day. Funds get moved, exchanges freeze accounts, projects announce reimbursements. We therefore keep ongoing cases up to date with dated updates, the latest one always at the top of the article.
How to protect yourself
- Revoke approvals. Most wallet drainers and many protocol exploits reach your funds through approvals you once granted to a contract. Check them regularly, for example with revoke.cash or in the approvals section of your block explorer, and revoke what you no longer need.
- A hardware wallet protects your key, not your approvals. It stops anyone from stealing your private key. It does not stop an approval you signed yourself if the contract behind it is exploited later. Only sign what you can read and understand on the device.
- Check your exchange balance. After an exchange hack, what matters is whether the exchange covers customer losses and whether withdrawals work. Keep only what you need for trading on an exchange and look for a MiCA licence.
- Never enter your seed phrase. No support agent, airdrop page or wallet update will ask for it. Links from direct messages and sponsored search results are a common way onto phishing sites.
All reports
Ongoing cases are kept up to date with dated updates.
Ledger sells the Atom at $849 through its own shop only: “For years, our customers have been asking us for a Ledger phone”
Ledger presented the Android device Atom on October 15 and sells it exclusively through its own shop. After tampered devices were found in the intermediate trade, the distribution route itself becomes a security question.
yesterday
Fake Ledger firmware updates: SlowMist reports phishing pages with a replica Genuine Check
A phishing campaign reproduces the sequence of an official Ledger update and asks, at the end, for the 24 recovery words. SlowMist reported it on October 16; Ledger had set out its reading of the underlying implant case a day earlier.
yesterday
241 scam sites taken offline, the recovery scam lives on: what to check now
The Brooklyn District Attorney and the FBI shut down a fraud network of 241 websites and 112 servers on 14 October 2026; the second stage of the scheme was a purported recovery service. Five days earlier, German regulator BaFin had warned about exactly this pattern at a purported bank.
yesterday
Papertrade loses $1.28 million on launch day: the reference price came from Hyperliquid
The perpetuals venue Papertrade launched on October 10 with leverage of up to 1,000 and drew its execution prices from the Hyperliquid order book. One trader moved the Ether price there by around three dollars and took between $1.28 million and $1.54 million out of the liquidity pool, according to several trade publications.
4 days ago
Ledger Confirms Implant in a Hardware Wallet as Reports Reach Europe: What Is Behind It
Ledger confirms an unauthorised additional circuit board in a tampered device and traces the confirmed cases to a reseller in South-East Asia. One report from European retail is still open, which makes the purchase route of your own device the criterion.
4 days ago
14.7 million swapped into USDD, 20 addresses frozen: what to check with your stablecoin
After the thefts among Ledger buyers, Tether has frozen more than 20 addresses and locked up around $10 million. Because part of the loot was swapped into USDD, the case shows exactly how far a stablecoin's freeze function reaches.
5 days ago
Bitget Wallet is not the exchange: one of two required key shares sits on Bitget's server
The attack on the Bitget exchange of September 24, 2026 hit the venue's hot and warm wallets, not the keys in users' wallets. What matters all the same is which variant you run: in the keyless wallet every signature needs a key share from the provider's server.
5 days ago
Fake Ledger Site Tops Google Search: “Once the recovery phrase has been handed over, the wallet must be regarded as compromised”
A security researcher reports a rebuilt Ledger site high up in Google's results that asks for the 24-word phrase. Running alongside it are emails with an invented deadline of October 15.
7 days ago
Revolut data breach: the bank pays for new ID documents for 680 customers, and what you can do now
Revolut will cover the fees for new identity documents where customers hit by the data theft need them. 680 accounts are affected, and for crypto holders a leaked KYC record weighs more heavily than a blocked card number.
7 days ago
XRP Ledger Closes a 2015 Flaw That Could Create XRP Out of Nothing: What It Means for Your Coins
The XRP Ledger has disclosed an overflow in its payment engine that sat in the code since 2015 and could have created spendable XRP far beyond the total supply. The flaw is closed with xrpld 3.4.1, with no indication of exploitation.
7 days ago