| 2026-10-21 | The Drift Protocol exploiter transferred 25,710 ETH worth $61.24 million through Tornado Cash, and the address still holds 81,454 ETH worth $194 million, according to on-chain analyst Yu Jin. | verified | https://www.chaincatcher.com/en/article/2297608 |
| 2026-10-21 | The Drift Protocol attacker still controls approximately 81,454 ETH valued at $194 million after the October 20 Tornado Cash transfers. | verified | https://www.cryptometer.io/news/drift-hacker-launders-61-million-in-eth-through-tornado-cash-holds-194-million/ |
| 2026-10-21 | Blockchain monitoring identified roughly 25,700 ETH moving into Tornado Cash within two hours on Tuesday, involving wallets associated with the April attack on Drift Protocol. | verified | https://www.cryptometer.io/news/drift-hacker-launders-61-million-in-eth-through-tornado-cash-holds-194-million/ |
| 2026-10-21 | The Drift Protocol attacker had exchanged the stolen assets for 131,564 ETH at an average price of $2,154 in early April and transferred 24,400 ETH through Tornado in July before the October 20 movement. | verified | https://www.chaincatcher.com/en/article/2297608 |
| 2026-10-21 | A forensic investigation by cybersecurity firm Mandiant attributed the Drift Protocol attack to UNC6862, a North Korean threat group. | verified | https://www.cryptometer.io/news/drift-hacker-launders-61-million-in-eth-through-tornado-cash-holds-194-million/ |
| 2026-10-20 | A wallet that PeckShield identified as linked to the Drift exploit deposited 23,000 ETH into Tornado Cash on October 20, 2026, worth about $54.8 million. | verified | https://primexbt.one/news/drift-linked-wallet-sends-54-8-million-in-eth-to-tornado-cash/ |
| 2026-10-20 | The active address making the Tornado Cash deposits carries Etherscan's "Drift Exploiter 5" label. | verified | https://primexbt.one/news/drift-linked-wallet-sends-54-8-million-in-eth-to-tornado-cash/ |
| 2026-10-20 | The Drift Exploiter 5 address made 230 deposits of 100 ETH each between 3:08:35 a.m. and 4:58:11 a.m. ET on October 20, 2026. | verified | https://primexbt.one/news/drift-linked-wallet-sends-54-8-million-in-eth-to-tornado-cash/ |
| 2026-10-20 | About 84,164 ETH, worth roughly $200 million, remained in the five wallets Etherscan labels as Drift exploiters in a snapshot around 5 a.m. ET on October 20, 2026. | verified | https://primexbt.one/news/drift-linked-wallet-sends-54-8-million-in-eth-to-tornado-cash/ |
| 2026-10-20 | Qubic, a layer-1 blockchain, halted operations on Sunday after an attacker exploited weakly generated wallet seeds to drain approximately $1.4 million from more than 1,400 accounts. | verified | https://cointelegraph.com/news/qubic-freezes-chain-after-attacker-drains-14k-wallets-with-weak-seeds |
| 2026-10-20 | Qubic said the network was halted at tick 85,371,949, and that the vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a Mac until Oct. 18, 2026, or the Qubic iOS app before July 2025, leading to 2.94 trillion Qubit (QU) stolen. | verified | https://cointelegraph.com/news/qubic-freezes-chain-after-attacker-drains-14k-wallets-with-weak-seeds |
| 2026-10-20 | Qubic said 87.1% of the drained funds never left the Qubic network and remain frozen in place, while the remaining 12.9% was sent to MEXC, whose team froze the receiving account within about an hour. | verified | https://cointelegraph.com/news/qubic-freezes-chain-after-attacker-drains-14k-wallets-with-weak-seeds |
| 2026-10-20 | Qubic developers fixed the seed-generation mechanism in version 4.26.4, replacing JavaScript's Math.random() with the cryptographically secure crypto.getRandomValues() function, and noted that creating new weak seed phrases is no longer possible. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-20 | Qubic notified exchanges, which suspended QUBIC deposits and withdrawals, with MEXC explaining this was done at the project's request and Bitget citing technical maintenance of wallets. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-19 | SecuX users continued to report wallet access problems on October 17, one day after the hardware wallet maker said its app service had recovered following emergency maintenance. | verified | https://www.tokenpost.com/news/technology/34105 |
| 2026-10-19 | Multiple SecuX users still reported being unable to access their wallets on October 17, showing the announced restoration had not resolved every reported access problem. | verified | https://www.tokenpost.com/news/technology/34105 |
| 2026-10-19 | The origin of the notification — whether generated by the app itself, a third-party notification service, or another source — remained unknown, and available information did not independently establish that SecuX's app or infrastructure was compromised. | verified | https://u.today/ripple-cto-emeritus-exposes-suspected-wallet-scam-targeting-recovery-phrases |
| 2026-10-19 | Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-19 | At the current rate, the damage is estimated at around $1.3 million, and the attack took the hacker approximately 104 minutes. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-19 | Some seed phrases were generated with insufficient randomness, making them weaker than they should be, which the attacker exploited to gain access to the wallets and transfer funds to controlled addresses. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-19 | The vulnerability affected seed phrases created on iPhone and iPad through any browser until October 18, 2026, on Mac through Safari until October 18, 2026, and in the Qubic mobile app for iOS until July 2025. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-19 | Developers fixed the generation mechanism in version 4.26.4, noting that creating new weak seed phrases is no longer possible. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-19 | Qubic network operators, known as Computors, agreed to an emergency blockchain halt at tick 85,371,949 after discovering the attack. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-19 | According to the team, 87.1% of the stolen funds—about 2.56 trillion QU—remain within the network, while the remaining 12.9%, or approximately 379 billion QU, were sent by the attacker to the crypto exchange MEXC. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-19 | The remaining 12.9%, or approximately 379 billion QU, were sent by the attacker to the crypto exchange MEXC, whose team froze the receiving account within about an hour. | verified | https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/ |
| 2026-10-19 | An attacker drained 1,404 Qubic user wallets of roughly 2.94 trillion QU tokens, worth about $1.3 million at the time, prompting the network to pause its mainnet on October 18, 2026. | verified | https://techreport.com/news/software/qubic-halts-mainnet-after-seed-exploit-drains-1404-wallets/ |
| 2026-10-18 | Qubic paused its mainnet on October 18, 2026, after an attacker drained 1,404 user wallets of approximately 2.94 trillion QU tokens, worth approximately $1.3 million at the time. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | The Qubic attack ran from 23:42 UTC on October 17 to 01:26 UTC on October 18, and validators then stopped the chain at tick 85,371,949. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | About 87.1% of the drained QU never left the Qubic network and is now immobilized on-chain, while the remaining 12.9% made it to MEXC, which froze the receiving account within 1 hour on suspicion that it was linked to the attack. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | Bitget suspended all QUBIC deposits and withdrawals as a separate precaution while the Qubic situation played out. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | Qubic attributed the theft to wallet seeds generated with insufficient randomness, and the project said "The issue was in seed generation, not in the Qubic protocol itself." | verified | https://primexbt.one/news/qubic-halts-network-after-attacker-drains-1404-wallets-of-about-1-3-million/ |
| 2026-10-18 | Qubic said it corrected the seed-generation weakness in client version 4.26.4, and that any resolution of compensation for affected holders rests with the Computor quorum. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | Qubic, a decentralized AI computing network, paused its mainnet on October 18, 2026, after an attacker drained 1,404 user wallets of approximately 2.94 trillion QU tokens worth approximately $1.3 million. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | The Qubic wallet drain ran from 23:42 UTC on October 17 to 01:26 UTC on October 18, a period of about 1 hour and 44 minutes. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | Qubic's validators stopped the chain at tick 85,371,949, locking the ledger in place after the drain. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | About 87.1% of the drained QU never left the Qubic network and is now immobilized on-chain, while the remaining 12.9% made it to MEXC, which froze the receiving account within 1 hour. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | Qubic said the exploit traced back to weak, predictable wallet seeds created on legacy Apple devices, Safari browsers, and early iOS applications, not a bug in the network's code. | verified | https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ |
| 2026-10-18 | Qubic pushed out client version 4.26.4 to fix the seed-generation weakness, and the affected seeds include those created in any iPhone or iPad browser before October 18, 2026, in Mac Safari on the same date, and via the Qubic iOS App before July 2025. | verified | https://www.chaincatcher.com/en/article/2297169 |
| 2026-10-18 | Over the past two months, 17 wallets associated with the team received tokens and deposited approximately 988 million BILL into centralized exchanges. | verified | https://www.chaincatcher.com/en/article/2297131 |
| 2026-10-18 | The BILL project team previously received approximately $30 million in financing from institutions including Coinbase Ventures and Polychain Capital. | verified | https://en.theblockbeats.news/flash/372418 |
| 2026-10-18 | The 17 team-associated wallets deposited approximately 988 million BILL into Bybit specifically, and the independent deposit address deposited 360 million BILL into Bybit this week. | verified | https://www.odaily.news/en/newsflash/525430 |
| 2026-10-18 | Approximately 1.35 billion BILL flowed into Bybit over the past two months, accounting for about 13.6% of the token's total supply, with an estimated value of approximately $15 million. | verified | https://www.odaily.news/en/newsflash/525430 |
| 2026-10-18 | Odaily reported that the wallet flows and allegations regarding the BILL project's nature still require further verification. | verified | https://www.odaily.news/en/newsflash/525430 |
| 2026-10-18 | Lookonchain reported that 17 addresses that received tokens from team-linked wallets deposited approximately 988 million BILL onto crypto exchanges over the past two months, with tokens sourced from the project team's multi-signature wallets. | verified | https://lookonchain.com/feeds/77459 |
| 2026-10-18 | Lookonchain reported the BILL token (full name Billion, ticker BILL) has plunged around 97% from its all-time high. | verified | https://lookonchain.com/feeds/77459 |
| 2026-10-17 | Blockaid said on October 15, 2026 that losses from the UNCX Network Vesting V2 exploit had grown to about $1.49 million across four blockchains, roughly 17 times the $86,000 it first flagged on Ethereum a day earlier. | verified | https://www.cryptotimes.io/2026/10/15/uncx-exploit-escalates-vesting-v2-bug-drains-1-5m-across-4-chains-as-copycats-join-in/ |
| 2026-10-17 | Blockaid's chain breakdown put about $969,000 of the UNCX Vesting V2 losses on BNB Smart Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base. | verified | https://www.bitcoininsider.org/article/uncx-vesting-v2-exploit-response |
| 2026-10-17 | Blockaid counted 11 drain transactions in the UNCX Vesting V2 exploit, including activity from copycat addresses and maximal extractable value (MEV) bots. | verified | https://www.cryptotimes.io/2026/10/15/uncx-exploit-escalates-vesting-v2-bug-drains-1-5m-across-4-chains-as-copycats-join-in/ |
| 2026-10-17 | As of Blockaid's October 15 update, no funds had been returned by the primary attacker or the copycat addresses in the UNCX Vesting V2 exploit. | verified | https://www.cryptotimes.io/2026/10/15/uncx-exploit-escalates-vesting-v2-bug-drains-1-5m-across-4-chains-as-copycats-join-in/ |
| 2026-10-17 | UNCX's official event report states the attack involved 10 tokens and 11 confirmed withdrawal transactions with a verified economic value of approximately $807,609, of which about $567,500 was from the BNB Chain. | verified | https://www.chaincatcher.com/en/article/2297031 |
| 2026-10-17 | After the UNCX Vesting V2 incident, white hats returned 82,143,476 X tokens and 23.8682 ETH, and no significant tokens remain pending disposal. | verified | https://www.chaincatcher.com/en/article/2297031 |
| 2026-10-17 | UNCX is coordinating with law enforcement and SEAL 911, the emergency incident response service run by the Security Alliance (SEAL), on the Vesting V2 exploit. | verified | https://www.cryptotimes.io/2026/10/15/uncx-exploit-escalates-vesting-v2-bug-drains-1-5m-across-4-chains-as-copycats-join-in/ |
| 2026-10-17 | After the UNCX incident, white hats returned 82,143,476 X tokens and 23.8682 ETH, and UNCX stated it is working with legal advisors to review technical evidence and subsequent handling. | verified | https://www.chaincatcher.com/en/article/2297031 |
| 2026-10-17 | Blockaid estimated gross losses from the UNCX Vesting V2 exploit at approximately $1.49 million across Ethereum, BNB Chain, Base and Robinhood Chain, attributing 11 drain transactions to the original attacker, copycat wallets, and MEV bots. | verified | https://crypto.news/uncx-exploit-exposes-share-accounting-flaw-behind-loss/ |
| 2026-10-17 | To contain the UNCX exploit, the team raised flat fees above 1,000 ETH per new lock, removed paths that bypassed fees, and lifted token fees to the 5% contract maximum, while about $3.25 million was still in the affected Ethereum contract when Blockaid identified the attack. | verified | https://blockchainreporter.net/uncx-vesting-v2-exploit-four-chains |
| 2026-10-17 | UNCX said its liquidity lockers and legacy vesting contracts remained unaffected by the Vesting V2 exploit, and no funds had been returned by the original attacker or copycats on any chain as of the update. | verified | https://blockchainreporter.net/uncx-vesting-v2-exploit-four-chains |
| 2026-10-17 | Immunefi's head of security Gonçalo Magalhães explained that the UNCX Vesting V2 contract failed to keep its share counters consistent when users withdrew vested tokens and canceled positions, and that the smart contract failed to ensure no functions could break the invariant around the shares' global counter. | verified | https://crypto.news/uncx-exploit-exposes-share-accounting-flaw-behind-loss/ |
| 2026-10-17 | The reported gross drain reached approximately $1.49 million across the four chains. | verified | https://x.com/blockaid_/status/2110616419939566029 |
| 2026-10-17 | Blockaid’s chain-by-chain estimates were approximately $969,000 on BNB Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base. | verified | https://www.tokenpost.com/news/technology/33803 |
| 2026-10-17 | The incident comprised 11 drain transactions, including activity by copycat wallets and MEV bots. | verified | https://x.com/blockaid_/status/2110616419939566029 |