A Pre-TGE Prime Sale runs on Binance Wallet on October 29, 08:00–10:00 UTC. Polymarket gives 54% odds of a day-one FDV above $1.5B, which would put the airdrop at about $105M.

Predict.fun unveiled PREDICT: a fixed 1B supply on BNB Chain, 16% unlocked at TGE. Ecosystem and community get 51.95%, early backers 26.05%.

Core contributors hold 10%, treasury 8%, liquidity 4%. Backers and the team stay fully locked at TGE, then face a 24-month cliff and 36 months of monthly vesting.

The Season 1 airdrop is 70M PREDICT, or 7%. Users take 35% instantly or 100% after a 12-month vest, and tokens not claimed within a month are forfeited.

Between January 1 and October 28 we counted 30 hardware wallet incidents across 11 vendors. Known losses add up to about $530M. Not one dollar of it left through a cracked secure chip. The money went out through buggy code, tampered retail units, leaked customer lists and owners who were talked out of their seed.

Where the $530M went

- People tricked: ~$295M (56%)

- Code bugs: ~$117M (22%)

- Tampered retail units: ~$102M (19%)

- A vendor's software wallet: ~$16M (3%)

- Cracked secure chips: $0

Several of these are third-party estimates. Ledger has not confirmed a total for its implant case, and D'CENT has published no figure at all.

1. Code bugs: weak seeds shipped years ago

The biggest technical failure of the year was Coldcard. A firmware build setting introduced in March 2021 made the device skip its hardware random number generator. Seeds came from a software generator fed by the chip ID and timers, which left roughly 40 bits of entropy on Mk2/Mk3 and about 72 on Mk4/Q/Mk5. That is guessable. From July 30 attackers brute-forced seeds remotely, without ever touching a device, and swept 1,789 BTC from 8,865 addresses: $114.7M at time-of-theft prices, per Galaxy. Coinkite patched the firmware but offers no compensation, and its postmortem is still unpublished. Coinkite's own take: "we have to assume that someone used AI to review previous versions of our firmware."

A firmware update does not fix a seed that was already weak. Affected users have to create a new seed and move their funds.

Ledger's Zilliqa app had a similar flaw since 2019. The top 64 bits of every signing nonce were fixed at zero, so a private key could be recovered from 4 or more signatures. Between March and July, 683M ZIL (about $1.9M) was taken from 51 accounts, and 6,772 accounts were exposed. Ledger merged a patch on July 27, which does not protect keys that already signed.

Other bugs were found and fixed before anyone lost money:

- Ledger Monero app (fixed March 20): a compromised computer could pull Monero secret keys without on-screen confirmation.

- BitBox02 (July 8 and August 17 updates): an out-of-bounds write, display spoofing, memory corruption that allowed code from a malicious host on unset Multi-edition devices, and a Silent Payments bug that could lock funds to the wrong address.

- Ledger Ethereum app (August): a race condition let a malicious host swap a transaction during signing. Ledger found it internally and fixed it before TestMachine went public on August 22. Safe version: 1.22.3.

D'CENT is a separate case. On September 15 and 16 funds were drained from its App Wallet, the software mode, for addresses that had signed with app versions below 8.1.0. On-chain trackers count about 12.4M XRP from 7,000+ wallets, roughly $16M. D'CENT has disclosed neither a cause nor a figure. Its hardware wallets are not affected unless the seed was typed into the app.

2. The retail chain: implants, swapped chips and a stolen factory key

On October 9 wallets tied to Ledgers sold by Southeast Asian reseller CryptoBilis were emptied on 6 chains in 47 minutes. The devices were genuine but had been opened and fitted with an LTE implant (microcontroller, modem, eSIM, antenna) that read the recovery phrase off the screen and sent it out. The secure element was untouched, so Ledger's Genuine Check passed. Bitquery estimates ~$102M from 335 wallets, and Tether froze $10M in USDT. Ledger calls the number of affected devices "limited", has not confirmed a total and offers no recall or reimbursement. It halted sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, and at MediaMarkt Saturn. OneKey cut ties with CryptoBilis and offers free replacements to its buyers.

On October 13 hardware hacker Joe Grand showed a Trezor One bought on TikTok Shop and a Model T from Facebook Marketplace whose microcontroller had been replaced to generate pre-set seeds. No losses were reported. Trezor will end all reseller authorizations on January 1, 2027.

Then came Keystone. Between October 20 and 26 an attacker got into its website through a third-party monitoring tool and took buyer data plus the WebAuth key: the key written into devices at the factory to prove they are genuine. With it, counterfeits could pass Keystone's authentication check. Keystone will destroy 18,835 unsold units, has stopped shipping web orders and moved to preorders with a new key. No funds have been lost. Devices delivered before October 20 are fine. If you received one after that date, contact Keystone support before using it, even if it passes the check.

The lesson from all three: a genuine check proves the chip, not the whole box.

3. Leaks and hijacked vendor channels

Vendors and their suppliers leaked buyer data six times this year, almost always through a third party:

- Ledger via payment partner Global-e (January 5): names, addresses, emails, phones and order details. Count not disclosed.

- Trezor via shipper ShipMonk (August 13, widened September 4): 80,689 customers, including ~67,000 US records from 2019 to 2021 that Trezor had been told were deleted.

- SafePal (August 16): a flaw in an order-tracking plugin exposed 39,798 customers.

- Trezor and BitBox via email provider Brevo (September 9 and 10): 347,149 Trezor contacts were exported and sent a fake "STM32 Entropy Vulnerability" alert. 2,500 people clicked in the ~20 minutes before takedown.

- Keystone (October): 25,964 buyer records plus 12,873 unpaid checkouts, part of it data that a broken erasure job should have deleted.

- Foundation (October 25 and 26): attackers with compromised Cloudflare API keys sent 23,000+ fake "recall" emails from official domains. ~5,600 mailing addresses and ~5,200 phone numbers were potentially exposed.

That is ~165K records with names and shipping details, not counting Ledger's. These lists feed the paper letters and calls described below.

Phishing also came from vendors' real channels:

- NGRAVE (October 17): attackers hijacked the push-notification provider of its LIQUID app and sent a fake "Pixel 9, Moscow" login alert linking to a seed-phishing page. At least $2.56M was stolen from ~70 addresses. The CEO: "we have absolutely and utterly failed."

- SecuX (October 16 to 19): the banner inside the SecuX App was modified to link to fake SecuX sites.

- Coldcard (October 11): its official X account published a phishing "migration" post.

"Check the sender" no longer protects you.

4. People and fake apps

The largest single theft of 2026 was not a device failure. On January 10 one hardware wallet owner lost $282M+ in LTC and BTC (2.05M LTC and 1,459 BTC) to social engineering, per ZachXBT. The funds were swapped to Monero and bridged via THORChain.

The rest of the list:

- February: paper letters to Trezor owners demanded a fake "Authentication Check" by QR code.

- April 7 to 13: a fake "Ledger Live" app in Apple's App Store asked for recovery phrases and took $9.5M from 50+ victims. Apple removed it.

- May: letters signed in the name of Ledger CTO Charles Guillemet about "Quantum Resistance", again with a QR code to a seed-phishing site.

- June: a group posing as wallet and exchange support drained $1.2M from a Trezor owner after a spoofed BitcoinIRA email (ZachXBT).

- July: Kaspersky found OkoBot malware ("SeedHunter") that overlays a fake recovery screen on Ledger Live and Trezor Suite. Hundreds of victims in 25+ countries.

- August: a phishing site on sites.google.com was the top sponsored Google result for "Trezor wallet". Rapid7's "Operation ASTERIX" paired phone scams with fake Trezor Suite, Ledger Live and Exodus apps.

- October 16: fake "Ledger firmware update" emails rode the CryptoBilis panic.

In none of these did the hardware fail. The user typed the seed into something else.

5. The chip held

Two lab attacks on secure chips worked this year, and both cost users $0. Ledger's Donjon team used laser fault injection to bypass the firmware-signature check of the TROPIC01 chip in the Trezor Safe 7, and to reset the password on Tangem cards. Both need physical access and a lab. The Tangem setup costs around $250,000. Neither can be patched with firmware, and neither has led to a reported theft.

In court

- Kim v. Ledger SAS (S.D.N.Y., August 27): a proposed class action over the 2023 Connect Kit incident and later impersonation scams, seeking at least $500M.

- Naderi v. Coinkite (Ontario, September 11): a proposed class action over the Coldcard seed bug, alleging more than $140M in losses.

What to do

- Buy only from the vendor, not from resellers or marketplaces.

- Generate the seed on the device. If your Coldcard seed was made on affected firmware, create a new one and move your funds.

- Never type a seed into a website, app, letter, QR page or support chat. No vendor will ever ask for it, and there are no "recalls".

- Treat any urgent security alert as phishing, even if it comes from an official email, app or X account.

- If you bought from Trezor, SafePal, Keystone, Ledger or Foundation, assume your name and address are already out there.

Sources: Coinkite, Galaxy, Zilliqa, Ledger, Bitquery, Keystone, Trezor, NGRAVE, D'CENT, Ledger Donjon, ZachXBT, Rapid7, Kaspersky, court filings, CryptoDiffer research.

Traditional credit agencies have started scoring stablecoins, and Ripple's RLUSD is the first to come out with an investment-grade mark: Moody's assigned A2 long-term and P-1 short-term deposit ratings to the dollar token.

The ratings cover RLUSD issued by Standard Custody & Trust Company on the XRP Ledger and Ethereum. The reserve sits mostly in U.S. Treasury bills, other short-dated government assets and cash, held with BNY as primary custodian, and the issuer is overseen by the New York Department of Financial Services.

RLUSD targets about 103% reserve coverage against roughly $2.5B in circulating supply.

The ratings were assigned under the stablecoin methodology Moody's published in March 2026. A rated deposit-style grade gives banks and institutional treasuries a familiar credit benchmark when deciding which stablecoins they can hold.

The prediction market platform, which combines betting positions with DeFi yield, has published the tokenomics of its native PREDICT token. Supply is fixed at 1B tokens.

Ecosystem and community receive 51.95%, early backers 26.05%, core contributors 10%, treasury 8% and liquidity 4%. Backer and contributor allocations are fully locked at TGE, followed by a 24-month cliff and 36 months of monthly vesting, so full supply unlocks over five years.

16% of supply unlocks at TGE, and 70M PREDICT (7%) goes to the Season 1 airdrop.

Airdrop recipients can take 35% of their allocation instantly or 100% over a 12-month vest, with one month to choose before unclaimed tokens are forfeited. The claim date will be announced with the final Season 1 Predict Points results within 24 hours.

Tokenization platform Securitize has added Stellar to its list of supported blockchains, joining networks such as Ethereum, Solana and Avalanche. The announcement came at Meridian 2026, the Stellar Development Foundation's annual conference in Lisbon.

Securitize converts real-world assets such as equity and debt into tradable tokens and issues and manages BlackRock's BUIDL tokenized money market fund. The firm pointed to Stellar's native asset controls, which can be configured for KYC, clawbacks and sanctions compliance.

Securitize CEO Carlos Domingo said Stellar has built the fourth-largest ecosystem for tokenized real-world assets.

Stellar already hosts Franklin Templeton's tokenized money market fund, and MoneyGram moves money across the network daily. The integration adds another regulated issuer to a chain positioning itself around compliance-heavy institutional assets.

Since June, Datavault AI can't withdraw its bitcoin from the Biconomy exchange. The 1,309 BTC it got for $150M of stock were an off-chain ledger entry, and 491 were sold back.

We read the custody filings of the 25 largest public BTC holders, about 1.19M BTC. Coinbase holds at least 381K and Anchorage Digital Bank 370K, 63% together. Fidelity's 168K is all Strategy's.

Eight companies with 180K BTC, including Metaplanet, MARA, SpaceX and Tesla, name no custodian. Only Twenty One, Metaplanet and OranjeBTC publish addresses anyone can check.

Reports of a Coinbase hack circulated before the exchange clarified the incident: the breach originated at Amplitude, a third-party analytics provider, and not on Coinbase infrastructure.

The exposed data covers contact information for a "small subset" of Coinbase customers, alongside data belonging to other Amplitude clients. Coinbase says its systems detected no unauthorized access and customer funds remain safe. Affected users are being notified by email, as required by law.

Coinbase has not disclosed how many customers were affected or which contact fields were involved.

The incident highlights supply-chain risk for exchanges. Even without passwords, keys or funds being compromised, leaked emails and phone numbers can be used for phishing and social-engineering attacks against crypto holders.

A security incident at one of Solflare's staking providers compromised the private keys behind its Solana validator, the wallet disclosed in its October 27 notice. The provider was not named, and the validator can no longer earn or distribute rewards to delegators.

Delegated SOL is not affected: stakes remain in users' own stake accounts, which the validator never controlled.

Solflare is preparing an app update that will guide users through migrating their stake to a new validator, and plans to compensate those who complete the move. No figure or formula for the compensation has been shared yet.

Principal is safe, but stakers lose yield for as long as their SOL sits on the non-earning validator. Rewards are expected to resume once a stake is pointed at the new validator.

South Korean crypto exchange Bithumb found that an unauthorized outside party had accessed its internal mobile groupware system and leaked personal information. The breach was identified on October 27 and reported the same day to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission.

The attack targeted an outsourced messenger used only by employees. Bithumb says the system is separated from the exchange's trading network and is still checking the exact timing of the attack and whether member data was included in the leak.

Bithumb was one of three South Korean financial firms to report data breaches on October 28.

The incident follows a disclosure by fellow Korean exchange Gopax in early October, which confirmed unauthorized access to some customer accounts since September, with nicknames and login history viewed but no asset losses found.

The US-Mexico remittance corridor moves tens of billions of dollars a year, and about 15% of it already runs through Bitso. Anchorage Digital now wants to sit under both sides of that flow, after expanding its custody and listing partnership with Bitso.

The federally chartered crypto bank now custodies MXNB, Bitso's Mexican peso stablecoin, across Arbitrum, Base, Ethereum, Polygon, Avalanche and Arc. In return, Bitso listed USDPT and USAT, the dollar stablecoins from Western Union and Tether that Anchorage issues and custodies. Financial terms were not disclosed.

Bitso clients can now move along the full dollar-peso corridor onchain, with a regulated US bank holding both legs.

The deal adds to a wider race to plug stablecoins into Latin American payments, following Circle's recent USDC settlement pilot in Colombia. Much of the corridor still relies on wires, correspondent banks and cash-pickup networks.