<h2 id="header-0">Key Facts</h2>
<ul>
 <li>CertiK counted about $1.27 billion lost to crypto hacks and scams in Q3 2026 across 249 incidents, bringing the year’s total to about $2.69 billion.</li>
 <li>Hardware wallet owners lost more than $200 million in two incidents: tampered Ledger devices from reseller CryptoBilis were drained of $102 million across 324 wallets, according to Bitquery, and a Coldcard seed-generation flaw led to about 1,816 BTC (roughly $116 million) being stolen, according to TRM Labs.</li>
 <li>Ledger has not confirmed a total for the CryptoBilis losses, and a Coldcard firmware update fixes the device but not seeds it already created, so affected owners must move their coins to new seeds.</li>
</ul>
Most crypto stolen from ordinary holders this year went out through a careless signature, a pasted address, or a tampered device. Fortunately, each attack route has a simple defense.
One of the most concerning cases came on Oct. 9, when numerous customers who had bought Ledger hardware wallets from the same reseller found them empty. A hidden chip had read their<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/seed"> seed phrase</a> off the screen during setup.
In this piece, we dig into the year’s biggest cases and equip you with the knowledge to keep your crypto safe in 2026 and beyond.
<h2 id="header-1">How Much Crypto Was Stolen in 2026?</h2>
CertiK counted about $1.27 billion lost to hacks and scams in Q3 across 249 incidents, taking 2026's total to about $2.69 billion. September's $772 million was the worst month since the Bybit hack in February 2025.
Most of that came out of platforms. Bitget lost $387.5 million from its<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/hot-wallet"> hot wallets</a> on Sept. 24 and said its user protection fund covered customer balances.
Individuals typically don’t benefit from such cover. The Ledger and Coldcard incidents, detailed below, together cost hardware wallet owners more than $200 million, and Chainalysis estimates criminals took over $30 million in the first half of the year through wrench attacks—robberies by violence or threat.<tweet-embed url="https://x.com/CertiKAlert/status/2105976028589859222"></tweet-embed>
<h2 id="header-2">What Went Wrong With Hardware Wallets in 2026?</h2>
Two major events with hardware wallets took place in 2026: resellers shipped Ledger devices with hidden spy chips, and a Coldcard firmware flaw generated guessable seeds.
With the first, Ledger found an implant inside devices sold by CryptoBilis, a Southeast Asian reseller. When a new owner set one up, the implant read the 24-word recovery phrase off the screen and sent it out over a mobile network.
Related Article: <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/ledger-confirms-hardware-implant-found-on-device-in-cryptobilis-probe">Ledger Confirms Hardware Implant Found on Device in CryptoBilis Probe</a>
It never touched Ledger's<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/secure-element"> secure element</a> or software, making it a form of<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/supply-chain-attack"> supply chain attack</a> that Ledger's Genuine Check can't detect.
Bitquery counts $102 million taken from 324 wallets across six chains, though Ledger hasn't confirmed a total.<tweet-embed url="https://x.com/Ledger/status/2109896739985453358"></tweet-embed>
The second was <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/coldcard-hack-tops-dollar100m-as-galaxy-flags-possible-4th-wave">Coldcard's seed generation flaw</a>. A 2021 firmware bug left some Coldcards creating guessable seeds. According to TRM Labs, attackers have drained about 1,816 BTC, worth roughly $116 million, from more than 5,200 addresses since July 2026.&nbsp;
Updating fixes the device but not the seeds it already made, so affected owners must move their coins.
<h2 id="header-3">How To Buy and Set Up a Hardware Wallet Safely</h2>
If you decide that a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/hardware-wallet"> hardware wallet</a> fits your needs, buy it from the manufacturer's own store. It will likely cost slightly more, but it minimizes the risk of a supply chain attack.
Create the seed phrase on the device and write it on paper or metal, never on a phone, computer, or cloud account. If you bought a Ledger from CryptoBilis, move your funds to a new device with a new phrase immediately.
For larger sums, a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/multi-signature-multi-sig"> multi-signature</a> setup across two brands can stop one compromised device from moving your funds. Ideally, use two distinct device types (e.g. a hardware wallet + GrapheneOS phone).
If your wallet supports it, adding a custom passphrase (25th seed word) will dramatically improve your security.
If your device arrives with a printed recovery phrase or has already been set up, it has been tampered with. Don’t risk it; return it.
<h2 id="header-4">How To Avoid Wallet Drainers</h2>
To avoid wallet drainers, never sign a transaction you can’t read, and keep a separate hot wallet for new sites. A wallet drainer is a malicious site that tricks you into signing away control of your tokens.
Drainers hide behind fake airdrops, hacked project accounts, and fake job interviews that install<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/malware"> malware</a> or ask you to sign away rights to drain your wallet. The request usually looks innocuous: it often comes in the form of an unlimited token approval, a prompt to "upgrade" your account, or an offer to “scan” your wallet for some free tokens.
Use a wallet that simulates each transaction and shows what will leave your wallet before you confirm, and reject anything you can't read. Keep a small hot wallet for new sites and a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/cold-wallet"> cold wallet</a> for savings that never connects to anything new. Ignore links sent by DM.
<h2 id="header-5">How To Revoke Token Approvals</h2>
Revoking old token approvals stops a hacked app or drainer from spending tokens you approved months ago. Using a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/defi"> DeFi</a> app usually means approving its<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/smart-contract"> smart contract</a> to move a token from your wallet. Many apps ask for an<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/infinite-approval"> </a>unlimited or <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/infinite-approval">infinite approval</a>, which stays live until you cancel it, so a hacked app or drainer can use it months later.
<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/crypto-news-phishing-attack-victim-loses-dollar908k-after-15-month-dormant-scam">One victim lost $908,000 through an approval</a> signed 15 months earlier. Checking takes five minutes; set a reminder to check periodically.
<ol>
 <li>Open Revoke.cash or Etherscan's Token Approval Checker and enter your wallet address.</li>
 <li>Sort the list by value at risk.</li>
 <li>Revoke approvals for apps you no longer use, unlimited ones first. Each revoke costs a small<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/gas"> gas</a> fee.</li>
 <li>Repeat every few months.</li>
</ol>
<img src="https://academy-public.coinmarketcap.com/optimized-uploads/14cc20551bb14debbce7eb4f28d170c7.png">
Revoke.cash lists the approvals on vitalik.eth, Vitalik Buterin's public address, sorted by value at risk. Source: Revoke.cash
<h2 id="header-6">How To Stop Address Poisoning</h2>
<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/what-is-address-poisoning-attack-and-how-to-stay-safe">Address poisoning</a> exploits the habit of copying addresses from your transaction history. Attackers generate a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/vanity-address"> vanity address</a> that has identical first and last characters to the address you use, then send you a tiny or zero-value transfer from it.
If you copy this from your history by mistake, your funds go to them. Address poisoning attacks are rife on most chains.
In December 2025, <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/usdt-holder-loses-dollar50-million-in-one-hour-after-address-poisoning-scam">a trader lost almost $50 million in USDT</a> this way, 26 minutes after a successful test transfer to the right address.
<img src="https://academy-public.coinmarketcap.com/optimized-uploads/11dd196c3d634edc8399039898102078.png">
The genuine address and the attacker's lookalike from the December 2025 theft. Source: Etherscan
Save the addresses you use in your wallet's address book and your exchange's withdrawal<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/whitelist"> whitelist</a>. Never copy one from your history or a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/block-explorer"> block explorer</a>.
Trust Wallet and MetaMask now warn you before you send to a lookalike, but check the middle characters yourself.<tweet-embed url="https://x.com/MetaMask/status/2067299431146487885"></tweet-embed>
<h2 id="header-7">Assume Your Data Has Leaked</h2>
Ledger customer details were leaked through payment partner Global-e in January, and Trezor and SafePal disclosed third-party leaks in August.
No private keys were exposed, but names, emails, phone numbers, and home addresses were. Chainalysis says a breach of French tax records is the likeliest cause of France's 30 wrench attacks in the first half of the year.
If you've bought a hardware wallet or used an exchange, treat those details as public. No legitimate entity will ask for your seed phrase, so ignore "recall" letters with QR codes and calls about "suspicious activity"; both are classic<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/social-engineering"> social engineering</a> attempts.
Use an authenticator app instead of SMS codes, which a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/sim-swap"> SIM-swap</a> can intercept, and don't post your holdings.
Dummy wallets and panic pins can act as a further failsafe.
<h2 id="header-8">How To Protect Crypto From Quantum Computers</h2>
No quantum computer can break Bitcoin (<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/bitcoin/">BTC</a>) or Ethereum (<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/ethereum/">ETH</a>) signatures as of yet. The fear is that a future one could work out a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/private-key-secret-key"> private key</a> from a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/public-key"> public key</a> already visible on-chain, which becomes visible for most address types once they send funds.
A simple fix is to keep long-term savings in addresses that have never sent a transaction.
Trezor calls its Safe 7 hardware wallet "quantum-ready," but its post-quantum signatures protect the device's firmware rather than your coins.
Freedom Factory, maker of the dGEN1 crypto handheld, is taking orders for the $179 PQ1 hardware wallet. It uses post-quantum SPHINCS+ signatures to authorize Ethereum/EVM transactions through ERC-4337 smart accounts.<tweet-embed url="https://x.com/FreedomFactory/status/2082104260880134561"></tweet-embed>
Post-quantum signing is also possible entirely in software wallets, but consumer-ready Ethereum mainnet support remains limited. Keep an eye out for developments in this space.
Bitcoin's BIP-360 upgrade toward quantum resistance is still a draft.
<h2 id="header-9">Four Things You Can Do Today</h2>
<ol>
 <li>Check where your hardware wallet came from.</li>
 <li>Revoke approvals you no longer use.</li>
 <li>Save the addresses you send to in your address book.</li>
 <li>Swap SMS codes for an authenticator app.</li>
</ol>
<blockquote>
 Further reading:<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/what-is-address-poisoning-attack-and-how-to-stay-safe"> Address Poisoning Attacks: What They Are and How To Stay Safe</a>
</blockquote>

How To Secure Your Crypto in 2026: Wallets, Scams, and Cold Storage

Table of Contents

Other articles published on Oct 20, 2026

Join our free newsletter for daily crypto updates!