How to Use This Page
This page lists threats that are active now and explains, for each one, who is being targeted and what you should do. It is shorter than our full guides on purpose: read the three priorities, scan the rest, and follow the links if something applies to you.
How we compile it: we only include threats documented by regulators, named security firms or the affected companies, and we cite the source and date for each entry. We don’t make our own accusations against named companies. When a threat stops being active, it moves to the archive at the bottom.
This Week’s Three Priorities
1. Tampered hardware wallets with hidden implants — buy direct, and don’t set up a suspect device
What happened: On 13 October 2026, Ledger confirmed that devices sold by the Southeast Asian reseller CryptoBilis contained hidden LTE implants. The implants captured the 24-word recovery phrase while it was shown during setup and sent it out over the mobile network. They didn’t modify the secure element or the operating system, and tampered units passed Ledger’s Genuine Check. On-chain researchers estimated suspected losses at between about $72 million and more than $90 million; Ledger says it hasn’t verified those figures. The same day, MediaMarktSaturn suspended Ledger sales in its stores and online after a customer in Germany reported an implant; Ledger said no funds were lost in that case.
Who’s at risk: Anyone who bought a hardware wallet from CryptoBilis or another reseller they can’t vouch for — and anyone who might fall for the fake “replacement” offers that follow news like this.
What to do:
- Bought from CryptoBilis in the last 90 days and haven’t set it up? Don’t. Contact the manufacturer’s support through its official website.
- Already using a device from a seller you don’t trust? Buy a new one directly from the manufacturer, create a new recovery phrase on it, and move your funds.
- Ignore unsolicited “replacement”, “recall” or “compensation” offers.
Related: Is Your Hardware Wallet Genuine? What the October 2026 Implant Case Changed
Sources: Ledger statements, 11–13 October 2026; The Block, BleepingComputer, Decrypt and Cointelegraph, 9–13 October 2026.
2. Aftermath of the Bitget breach — watch for “compensation” phishing
What happened: On 24 September 2026, Bitget detected unauthorised transfers from its hot wallets; the breach reached its warm wallet layer. Losses were first put at $351.6 million and later at $387.5 million after further tracing. Bitget’s 30 September update, citing Mandiant and SlowMist, attributed the breach to compromised third-party security products. Bitget says its protection fund covers the full loss, and withdrawals were restored in phases into early October.
Who’s at risk: Bitget users and anyone who might believe a message about it. Large exchange breaches are reliably followed by phishing that offers “compensation”, “refund claims” or “account verification”.
What to do:
- Follow updates only inside the official Bitget app or site, reached by typing the address.
- Treat every email, SMS, DM or call about compensation as hostile.
- No legitimate claims process asks for your recovery phrase, your password, or for you to send funds to “verify” your account.
Sources: Bitget statements via CoinGabbar and Cointelegraph, September–October 2026.
3. Malicious browser extensions are still installed on users’ machines
What happened: In late August 2026, Socket disclosed 19 malicious Chrome and Edge extensions (the “Superior” campaign). Five had been bought from their legitimate developers and turned malicious through automatic updates. One had around 70,000 users. Their modules drained EVM, Solana and Tron wallets, replaced the Ledger and Trezor websites with fake recovery pages, stole exchange sessions, and showed fake browser-update prompts.
Why it’s still a priority: the extensions were removed from the stores, but removal from the store does not uninstall them, and users received no notification.
What to do: open your extensions page today and remove anything you don’t actively use. Never type a recovery phrase into a browser tab. Related: The Extension You’ve Trusted for Years Can Be Sold to a Thief
Sources: Socket Threat Research via BleepingComputer and CyberInsider, August–September 2026.
Active Threats
Platform hacks at a 2026 high
- Status: September 2026 was the worst month of the year for crypto hacks. PeckShield counted $766.5 million stolen across 55 major incidents; CertiK counted $768.4 million across 97, and puts the 2026 total so far at $2.68 billion across 656 incidents. The second-largest incident, on Liquid Network (6 September, about $320 million), came from a flaw that let an attacker create unbacked L-BTC; most of it was returned the next day.
- What it means for you: platform risk is elevated. Exchanges and protocols are not where long-term holdings belong.
- What to do: keep only what you’re actively trading on exchanges, and hold the rest in self-custody. Related: The Best Hardware Wallet for Beginners in 2026
- Sources: PeckShield and CertiK via Cointelegraph; Blockstream incident assessment via CoinGabbar.
Leaked hardware-wallet customer data
- First documented: Trezor disclosed a breach at its shipping provider ShipMonk on 13 August 2026; by 4 September the count had grown to about 81,000 customers. Ledger customers were hit by a similar leak at its partner Global-e in January 2026.
- What it is: Names, home addresses, emails and phone numbers of people who bought hardware wallets — raw material for phishing emails, calls, letters and possible physical targeting. No recovery phrases or funds were exposed.
- Who’s targeted: Anyone who has bought a hardware wallet online.
- What to do: Treat every unsolicited message about your device as hostile, whatever the sender address. Your recovery phrase never goes anywhere except the device and your offline backup. Related: Fake Ledger and Trezor Support: How Hardware Wallet Owners Get Targeted in 2026
- Sources: BleepingComputer (7 September 2026); The Register (6 January 2026).
Fake hardware wallets sold through marketplaces
- First documented: April 2026
- What it is: A counterfeit Ledger Nano S Plus, sold on an online marketplace at the official price, contained a Wi-Fi/Bluetooth antenna and directed users via a QR code to a malicious Ledger Live app with a fake Genuine Check.
- Who’s targeted: Anyone buying a hardware wallet outside the manufacturer’s store. Expect more around Black Friday.
- What to do: Buy directly from the manufacturer’s own store, and download software only from the manufacturer’s website. Related: Black Friday Hardware Wallet Deals 2026: How to Buy Safely | TrueToCrypto
- Source: Cointelegraph, 17 April 2026.
Fake wallet apps in official app stores
- First documented: April 2026
- What it is: A fake Ledger Live app on Apple’s App Store was linked by investigator ZachXBT to about $9.5 million stolen from more than 50 victims before Apple removed it.
- Who’s targeted: Anyone who finds wallet software by searching an app store.
- What to do: Start from the manufacturer’s website and follow its link to the app. An official store listing is not proof.
- Source: The Block and BleepingComputer, April 2026.
Phishing letters in the post
- First documented: Ledger-themed letters since October 2025; Trezor-branded letters flagged 12 February 2026.
- What it is: Branded letters with holograms and QR codes announcing a “mandatory” new check with a deadline. The QR codes lead to sites that collect recovery phrases.
- Who’s targeted: Customers whose details leaked in past manufacturer and partner breaches.
- What to do: Throw them away. No manufacturer asks you to scan a QR code from a letter or to enter your recovery phrase anywhere.
- Source: Decrypt and BleepingComputer, February 2026.
Fake regulators and fake “licensed” exchanges after MiCA
- First documented: Warnings issued in August 2026 by the AFM (Netherlands), the AMF (France) and ESMA.
- What it is: Fraudsters impersonate regulators and licensed exchanges, sending fake migration notices and forged documents to users of platforms that lost EU access.
- Who’s targeted: EU users moving off unlicensed platforms.
- What to do: Verify any provider in the official ESMA register yourself. ESMA’s official emails end in @esma.europa.eu, and no regulator asks you to send crypto. Related: MiCA Created a Scam Wave: How Fake “Licensed” Exchanges Are Targeting EU Users
- Sources: Financial Times reporting via The Block and Cointelegraph, 6 August 2026.
Fake wallet extensions for Firefox
- First documented: Active since at least March 2026.
- What it is: Socket linked 77 Firefox add-ons and confirmed 40 as malicious, stealing recovery phrases and passwords. One, “0KX WEB3”, imitated OKX using a zero instead of the letter O.
- Who’s targeted: Firefox users installing wallet or exchange extensions.
- What to do: Install wallet extensions only via the link on the wallet’s official website, and check the publisher name.
- Source: Socket via Cybernews, 2026.
Fake CAPTCHA pages that install malware (“ClickFix”)
- Status: Ongoing and growing. A Mac variant was documented by Huntress in June 2026.
- What it is: A “verify you are human” page tells you to open a terminal or the Run box and paste a command. The command installs malware that steals passwords, sessions and wallet files.
- Who’s targeted: Everyone, on Windows and Mac.
- What to do: Never paste a command into a terminal because a website told you to. A real CAPTCHA never asks for that.
- Sources: Huntress (2026); ESET telemetry via Hard2bit.
Fake “revoke your approvals” sites after major hacks
- First documented: April 2026; five separate campaigns were tracked that month.
- What it is: Within hours of a big protocol hack, drainers register fake revoke sites and post them in replies under genuine security warnings.
- Who’s targeted: Users rushing to protect themselves after a hack.
- What to do: Reach revoke tools only by typing the address yourself, never from a link — even one posted under an official alert. Related: Revoke Day: The 10-Minute Quarterly Crypto Security Audit
- Source: Blockaid, April 2026.
Physical attacks on crypto holders
- Status: Rising. CertiK verified 52 attacks in the first half of 2026, 39 of them in Europe. Home invasions rose from one reported incident to 20 year on year.
- Who’s targeted: Holders whose identity and address can be linked to crypto, and their relatives.
- What to do: Don’t discuss holdings, protect your address, and set up custody so that no single person under pressure can release everything. Related: Crypto Has Gone Physical: Wrench Attacks, Home Invasions, and What European Holders Should Do
- Source: CertiK Intel3D H1 2026 report, July 2026.
Fake recruiters and “technical tests”
- Status: Behind two of the four largest hacks of early 2026.
- What it is: Attackers approach people working in crypto on LinkedIn with job offers or test tasks, then compromise the keys those people control.
- Who’s targeted: Developers, signers and anyone with access to company wallets — and increasingly their personal wallets too.
- What to do: Never run code or install software from a recruitment process on a machine that holds keys.
- Source: Blockaid H1 2026 report via The Block.
AI agents with wallet access
- Status: Emerging. The first exploit of its kind cost about $216,000, and Blockaid expects more in late 2026, led by prompt injection.
- What it is: Attackers manipulate AI agents that have permission to sign transactions.
- What to do: If you give an AI agent wallet access, cap the balance it can reach, and never give it access to your main holdings.
- Source: Blockaid H1 2026 report via The Block.
New Defences Worth Knowing
MetaMask Added Protection (17 September 2026). MetaMask now binds the transaction preview you approve to what actually executes. If the result differs from the preview, the transaction reverts. It costs nothing to use. Related: MetaMask and Phantom Security Settings You’re Probably Not Using
Where to Check for Yourself
- ESMA’s register of MiCA-authorised providers, and its warnings — the authoritative check for any EU crypto platform
- The AFM’s warnings at afm.nl — Dutch warnings about unauthorised firms
- Your own national regulator’s warning list if you live elsewhere
Reach all of them by typing the address yourself.
Get This by Email
Each week we send the three things that matter, with a two-minute fix for each. Sign up here.
If you’ve already lost funds: we can’t recover them, and anyone who offers to is running a scam. Here is what to do now: Related: Your Crypto Was Just Stolen: What to Do in the First 24 Hours
Archive
No archived entries yet. Threats that are no longer active move here, with the date they were removed.
Change Log
- 21 October 2026 — Added the hardware-implant case (CryptoBilis; MediaMarktSaturn suspension) as the top priority, and the Trezor shipping-partner data breach. Moved September’s hack figures to Active Threats.
- 20 October 2026 — First edition.
Compiled by N. Singh, TrueToCrypto.com. This page summarises public reporting and is not a complete list of every threat. It is educational, not security consulting advice. Report errors to info@truetocrypto.com.
