{
  "dataset": "Cabal Desk incidents",
  "description": "One row per incident record: the headline, the \"What to do\" action and its source, the number of receipts, and the sources. Each record page carries a receipt for every claim.",
  "citation": "Cite Cabal Desk and link the record.",
  "source": "Cabal Desk",
  "homepage": "https://cabaldesk.com/data/",
  "license": "https://cabaldesk.com/license/",
  "generated_at": "2026-10-21T05:45:07.707Z",
  "count": 68,
  "incidents": [
    {
      "id": "61m-of-drift-money-went-to-the-mixer-the-other-194m-stayed-home-325",
      "published_at": "2026-10-21T05:45:07.707Z",
      "desk": "Wallets",
      "headline": "$61M of Drift Money Went to the Mixer; the Other $194M Stayed Home",
      "what_to_do": "nothing to revoke. The ETH in the transfer is the attacker's; no holder approval appears in the path",
      "what_to_do_source": "https://www.chaincatcher.com/en/article/2297608",
      "receipts": 5,
      "sources": [
        "https://www.chaincatcher.com/en/article/2297608",
        "https://www.cryptometer.io/news/drift-hacker-launders-61-million-in-eth-through-tornado-cash-holds-194-million/"
      ],
      "url": "https://cabaldesk.com/articles/61m-of-drift-money-went-to-the-mixer-the-other-194m-stayed-home-325/"
    },
    {
      "id": "drift-exploiter-5-mixes-54-8m-on-ethereum-before-breakfast-keeps-200m-321",
      "published_at": "2026-10-20T17:44:44.486Z",
      "desk": "Wallets",
      "headline": "Drift Exploiter 5 Mixes $54.8M on Ethereum Before Breakfast, Keeps $200M",
      "what_to_do": "nothing to revoke — the 23,000 ETH left as deposits to the mixer, and 84,164 ETH still sits in the same five labelled wallets",
      "what_to_do_source": "https://primexbt.one/news/drift-linked-wallet-sends-54-8-million-in-eth-to-tornado-cash/",
      "receipts": 4,
      "sources": [
        "https://primexbt.one/news/drift-linked-wallet-sends-54-8-million-in-eth-to-tornado-cash/"
      ],
      "url": "https://cabaldesk.com/articles/drift-exploiter-5-mixes-54-8m-on-ethereum-before-breakfast-keeps-200m-321/"
    },
    {
      "id": "qubic-rolled-dice-for-1-400-wallet-seeds-the-dice-took-1-4-million-320",
      "published_at": "2026-10-20T14:44:53.188Z",
      "desk": "Incidents",
      "headline": "Qubic Rolled Dice for 1,400 Wallet Seeds. The Dice Took $1.4 Million.",
      "what_to_do": "don't move QUBIC through an exchange — Qubic notified exchanges, which suspended deposits and withdrawals, MEXC at the project's request",
      "what_to_do_source": "https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/",
      "receipts": 5,
      "sources": [
        "https://cointelegraph.com/news/qubic-freezes-chain-after-attacker-drains-14k-wallets-with-weak-seeds",
        "https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/"
      ],
      "url": "https://cabaldesk.com/articles/qubic-rolled-dice-for-1-400-wallet-seeds-the-dice-took-1-4-million-320/"
    },
    {
      "id": "the-app-recovered-the-wallets-did-not-315",
      "published_at": "2026-10-19T23:42:55.327Z",
      "desk": "Wallets",
      "headline": "The App Recovered. The Wallets Did Not",
      "what_to_do": "no action needed — what is known does not show SecuX's app or systems were hacked",
      "what_to_do_source": "https://u.today/ripple-cto-emeritus-exposes-suspected-wallet-scam-targeting-recovery-phrases",
      "receipts": 3,
      "sources": [
        "https://www.tokenpost.com/news/technology/34105",
        "https://u.today/ripple-cto-emeritus-exposes-suspected-wallet-scam-targeting-recovery-phrases"
      ],
      "url": "https://cabaldesk.com/articles/the-app-recovered-the-wallets-did-not-315/"
    },
    {
      "id": "qubic-halted-the-chain-with-87-of-the-stolen-1-3m-still-on-it-314",
      "published_at": "2026-10-19T08:45:16.295Z",
      "desk": "Incidents",
      "headline": "Qubic Halted the Chain With 87% of the Stolen $1.3M Still On It",
      "what_to_do": "version 4.26.4 fixes the seed maker, the team says",
      "what_to_do_source": "https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/",
      "receipts": 9,
      "sources": [
        "https://forklog.com/en/qubic-halts-blockchain-after-hack-of-1404-wallets/",
        "https://techreport.com/news/software/qubic-halts-mainnet-after-seed-exploit-drains-1404-wallets/"
      ],
      "url": "https://cabaldesk.com/articles/qubic-halted-the-chain-with-87-of-the-stolen-1-3m-still-on-it-314/"
    },
    {
      "id": "qubic-loses-1-3-million-and-halts-the-chain-to-keep-the-rest-311",
      "published_at": "2026-10-18T23:42:23.207Z",
      "desk": "Wallets",
      "headline": "Qubic Loses $1.3 Million and Halts the Chain to Keep the Rest",
      "what_to_do": "update to client 4.26.4, which Qubic says fixes how seeds are made",
      "what_to_do_source": "https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/",
      "receipts": 6,
      "sources": [
        "https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/",
        "https://primexbt.one/news/qubic-halts-network-after-attacker-drains-1404-wallets-of-about-1-3-million/"
      ],
      "url": "https://cabaldesk.com/articles/qubic-loses-1-3-million-and-halts-the-chain-to-keep-the-rest-311/"
    },
    {
      "id": "qubic-stops-at-tick-85-371-949-with-the-wallets-already-empty-310",
      "published_at": "2026-10-18T20:42:45.721Z",
      "desk": "Incidents",
      "headline": "Qubic Stops at Tick 85,371,949 With the Wallets Already Empty",
      "what_to_do": "if your seed came from an iPhone or iPad browser, Mac Safari, or the iOS app before July 2025, it is on Qubic's affected list, and client 4.26.4 carries the fix",
      "what_to_do_source": "https://www.chaincatcher.com/en/article/2297169",
      "receipts": 6,
      "sources": [
        "https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/",
        "https://www.chaincatcher.com/en/article/2297169"
      ],
      "url": "https://cabaldesk.com/articles/qubic-stops-at-tick-85-371-949-with-the-wallets-already-empty-310/"
    },
    {
      "id": "seventeen-team-wallets-moved-1-35-billion-bill-to-bybit-the-token-is-down-97-per-307",
      "published_at": "2026-10-18T11:43:18.654Z",
      "desk": "Wallets",
      "headline": "Seventeen Team Wallets Moved 1.35 Billion BILL to Bybit. The Token Is Down 97 Percent",
      "what_to_do": "treat the deposits as unverified until the team or the exchange answers, because Odaily says the wallet flows and the allegations still require further verification",
      "what_to_do_source": "https://www.odaily.news/en/newsflash/525430",
      "receipts": 7,
      "sources": [
        "https://www.chaincatcher.com/en/article/2297131",
        "https://en.theblockbeats.news/flash/372418",
        "https://www.odaily.news/en/newsflash/525430",
        "https://lookonchain.com/feeds/77459"
      ],
      "url": "https://cabaldesk.com/articles/seventeen-team-wallets-moved-1-35-billion-bill-to-bybit-the-token-is-down-97-per-307/"
    },
    {
      "id": "the-vesting-bug-cost-86-000-the-copycats-made-it-1-49-million-305",
      "published_at": "2026-10-17T23:42:48.713Z",
      "desk": "Wallets",
      "headline": "The Vesting Bug Cost $86,000. The Copycats Made It $1.49 Million.",
      "what_to_do": "check UNCX's event report; the project says it is coordinating with SEAL 911 and law enforcement",
      "what_to_do_source": "https://www.chaincatcher.com/en/article/2297031",
      "receipts": 7,
      "sources": [
        "https://www.cryptotimes.io/2026/10/15/uncx-exploit-escalates-vesting-v2-bug-drains-1-5m-across-4-chains-as-copycats-join-in/",
        "https://www.bitcoininsider.org/article/uncx-vesting-v2-exploit-response",
        "https://www.chaincatcher.com/en/article/2297031"
      ],
      "url": "https://cabaldesk.com/articles/the-vesting-bug-cost-86-000-the-copycats-made-it-1-49-million-305/"
    },
    {
      "id": "the-share-counter-stopped-adding-up-and-1-49-million-left-uncx-304",
      "published_at": "2026-10-17T20:45:22.354Z",
      "desk": "Incidents",
      "headline": "The Share Counter Stopped Adding Up and $1.49 Million Left UNCX",
      "what_to_do": "no action needed — UNCX says its older lockers and old vesting contracts were not touched",
      "what_to_do_source": "https://blockchainreporter.net/uncx-vesting-v2-exploit-four-chains",
      "receipts": 5,
      "sources": [
        "https://www.chaincatcher.com/en/article/2297031",
        "https://crypto.news/uncx-exploit-exposes-share-accounting-flaw-behind-loss/",
        "https://blockchainreporter.net/uncx-vesting-v2-exploit-four-chains"
      ],
      "url": "https://cabaldesk.com/articles/the-share-counter-stopped-adding-up-and-1-49-million-left-uncx-304/"
    },
    {
      "id": "four-chains-eleven-drain-transactions-1-49m-no-refunds-300",
      "published_at": "2026-10-17T11:43:12.296Z",
      "desk": "Wallets",
      "headline": "Four Chains, Eleven Drain Transactions, $1.49M, No Refunds",
      "what_to_do": "stay out of those pools until token teams give guidance",
      "what_to_do_source": "https://x.com/UNCX_token/status/2110506196339941423",
      "receipts": 9,
      "sources": [
        "https://x.com/blockaid_/status/2110616419939566029",
        "https://www.tokenpost.com/news/technology/33803",
        "https://x.com/UNCX_token/status/2110506196339941423"
      ],
      "url": "https://cabaldesk.com/articles/four-chains-eleven-drain-transactions-1-49m-no-refunds-300/"
    },
    {
      "id": "wallet-watch-2-990-eth-hits-tornado-cash-as-ledger-tells-cryptobilis-buyers-to-m-292",
      "published_at": "2026-10-12T11:43:20.474Z",
      "desk": "Wallets",
      "headline": "Wallet Watch: 2,990 ETH Hits Tornado Cash as Ledger Tells CryptoBilis Buyers to Move Seeds",
      "what_to_do": "do not set up an unused CryptoBilis device. If already set up, move to a new seed on a Ledger device",
      "what_to_do_source": "https://x.com/Ledger/status/2109331538072494364",
      "receipts": 7,
      "sources": [
        "https://en.theblockbeats.news/flash/371227",
        "https://www.odaily.news/en/newsflash/523832",
        "https://x.com/Ledger/status/2109331538072494364"
      ],
      "url": "https://cabaldesk.com/articles/wallet-watch-2-990-eth-hits-tornado-cash-as-ledger-tells-cryptobilis-buyers-to-m-292/"
    },
    {
      "id": "ledger-attacker-sent-7-45-million-to-tornado-cash-and-kept-going-289",
      "published_at": "2026-10-12T05:43:43.558Z",
      "desk": "Wallets",
      "headline": "Ledger Attacker Sent $7.45 Million to Tornado Cash and Kept Going",
      "what_to_do": "stay alert to device security risks, per Ledger's warning",
      "what_to_do_source": "https://www.tokenpost.com/news/technology/29776",
      "receipts": 6,
      "sources": [
        "https://www.tokenpost.com/news/technology/29776"
      ],
      "url": "https://cabaldesk.com/articles/ledger-attacker-sent-7-45-million-to-tornado-cash-and-kept-going-289/"
    },
    {
      "id": "79thvault-gets-11-million-back-with-two-rates-for-how-much-is-back-287",
      "published_at": "2026-10-11T23:43:34.715Z",
      "desk": "Wallets",
      "headline": "79thVault Gets $11 Million Back, With Two Rates for How Much Is Back",
      "what_to_do": "no action needed — Coldcard says no money lost has been tied to the October 11 phishing try",
      "what_to_do_source": "https://news.bitcoin.com/security/coldcard-x-account-hit-by-phishing-scam-after-100m-fiasco/",
      "receipts": 6,
      "sources": [
        "https://www.tokenpost.com/news/technology/29201",
        "https://news.bitcoin.com/security/coldcard-x-account-hit-by-phishing-scam-after-100m-fiasco/"
      ],
      "url": "https://cabaldesk.com/articles/79thvault-gets-11-million-back-with-two-rates-for-how-much-is-back-287/"
    },
    {
      "id": "ledger-found-one-hidden-chip-bitquery-counts-92-9m-gone-from-311-wallets-286",
      "published_at": "2026-10-11T20:43:16.643Z",
      "desk": "Incidents",
      "headline": "Ledger Found One Hidden Chip; Bitquery Counts $92.9M Gone From 311 Wallets",
      "what_to_do": "if a CryptoBilis device is still in the box, do not set it up. If you have used the device, Ledger says to think about moving your coins to a new hardware wallet set up with a brand-new recovery phrase",
      "what_to_do_source": "https://crypto.news/ledger-confirms-hidden-chip-in-crypto-wallet-amid-92m/",
      "receipts": 8,
      "sources": [
        "https://crypto.news/ledger-confirms-hidden-chip-in-crypto-wallet-amid-92m/"
      ],
      "url": "https://cabaldesk.com/articles/ledger-found-one-hidden-chip-bitquery-counts-92-9m-gone-from-311-wallets-286/"
    },
    {
      "id": "the-approval-was-genuine-the-29m-was-gone-in-six-seconds-282",
      "published_at": "2026-10-11T08:44:06.390Z",
      "desk": "Incidents",
      "headline": "The Approval Was Genuine. The $29M Was Gone in Six Seconds",
      "what_to_do": "revoke any approval to an address the holder does not know — 25 TRON wallets signed one approval for one address",
      "what_to_do_source": "https://bitquery.io/investigations/ledger-cryptobilis-hack",
      "receipts": 9,
      "sources": [
        "https://bitquery.io/investigations/ledger-cryptobilis-hack"
      ],
      "url": "https://cabaldesk.com/articles/the-approval-was-genuine-the-29m-was-gone-in-six-seconds-282/"
    },
    {
      "id": "1-07m-of-the-ledger-haul-goes-through-tornado-cash-70-6m-stays-put-280",
      "published_at": "2026-10-11T02:43:27.700Z",
      "desk": "Incidents",
      "headline": "$1.07M of the Ledger Haul Goes Through Tornado Cash; $70.6M Stays Put",
      "what_to_do": "skip the reseller's devices — Ledger asked CryptoBilis to stop all sales and shipments while it looks into the reports",
      "what_to_do_source": "https://finance.yahoo.com/markets/crypto/articles/ledger-asks-users-urgent-action-181633937.html?fr=sycsrp_catchall",
      "receipts": 7,
      "sources": [
        "https://www.tokenpost.com/news/technology/29135",
        "https://finance.yahoo.com/markets/crypto/articles/ledger-asks-users-urgent-action-181633937.html?fr=sycsrp_catchall"
      ],
      "url": "https://cabaldesk.com/articles/1-07m-of-the-ledger-haul-goes-through-tornado-cash-70-6m-stays-put-280/"
    },
    {
      "id": "ledger-to-southeast-asia-buyers-do-not-set-up-the-device-move-the-assets-274",
      "published_at": "2026-10-10T14:43:22.317Z",
      "desk": "Incidents",
      "headline": "Ledger to Southeast Asia Buyers: Do Not Set Up the Device, Move the Assets",
      "what_to_do": "wait on setup if you bought from that reseller in the last 90 days. If the device is already running, move your assets to a new signer with a new seed",
      "what_to_do_source": "https://x.com/ledger_support/status/2108551100613714002",
      "receipts": 2,
      "sources": [
        "https://x.com/ledger_support/status/2108551100613714002",
        "https://www.financemagnates.com/cryptocurrency/ledger-probes-reseller-supply-chain-as-analysts-track-80m-in-suspected-drains/"
      ],
      "url": "https://cabaldesk.com/articles/ledger-to-southeast-asia-buyers-do-not-set-up-the-device-move-the-assets-274/"
    },
    {
      "id": "hacker-deposits-12-4m-into-tornado-cash-like-it-s-a-crypto-laundromat-273",
      "published_at": "2026-10-10T11:42:45.536Z",
      "desk": "Wallets",
      "headline": "Hacker Deposits $12.4M Into Tornado Cash Like It's a Crypto Laundromat",
      "what_to_do": "what the chain shows is 4,970 ETH inside Tornado Cash, in 56 deposits",
      "what_to_do_source": "https://crypto.news/triple-a-attacker-moves-12-4m-in-eth-to-tornado-cash/",
      "receipts": 6,
      "sources": [
        "https://crypto.news/triple-a-attacker-moves-12-4m-in-eth-to-tornado-cash/"
      ],
      "url": "https://cabaldesk.com/articles/hacker-deposits-12-4m-into-tornado-cash-like-it-s-a-crypto-laundromat-273/"
    },
    {
      "id": "one-approval-25-wallets-three-seconds-29-million-271",
      "published_at": "2026-10-10T05:43:53.301Z",
      "desk": "Wallets",
      "headline": "One Approval, 25 Wallets, Three Seconds, $29 Million",
      "what_to_do": "do not start setup on a CryptoBilis device bought in the last 90 days. Move assets to a new signer with a new seed",
      "what_to_do_source": "https://news.bitcoin.com/security/ledger-investigating-86m-drained-crypto-hardware-wallets/",
      "receipts": 7,
      "sources": [
        "https://bitquery.io/investigations/ledger-cryptobilis-hack",
        "https://news.bitcoin.com/security/ledger-investigating-86m-drained-crypto-hardware-wallets/"
      ],
      "url": "https://cabaldesk.com/articles/one-approval-25-wallets-three-seconds-29-million-271/"
    },
    {
      "id": "tether-freezes-10m-of-a-92-9m-drain-that-hit-311-wallets-270",
      "published_at": "2026-10-10T02:43:19.683Z",
      "desk": "Incidents",
      "headline": "Tether Freezes $10M of a $92.9M Drain That Hit 311 Wallets",
      "what_to_do": "do not set up unused devices bought from CryptoBilis in the last 90 days, and move assets off activated ones to a new signer with a new seed",
      "what_to_do_source": "https://www.tokenpost.com/news/technology/29321",
      "receipts": 11,
      "sources": [
        "https://bitquery.io/investigations/ledger-cryptobilis-hack",
        "https://www.tokenpost.com/news/technology/29321"
      ],
      "url": "https://cabaldesk.com/articles/tether-freezes-10m-of-a-92-9m-drain-that-hit-311-wallets-270/"
    },
    {
      "id": "ledger-s-recall-reaches-the-warehouse-not-the-seed-phrase-268",
      "published_at": "2026-10-09T20:43:45.108Z",
      "desk": "Incidents",
      "headline": "Ledger's Recall Reaches the Warehouse, Not the Seed Phrase",
      "what_to_do": "if the device came from CryptoBilis in the past 90 days, do not set it up, and if it is already in use, move funds to a new device with a new seed phrase",
      "what_to_do_source": "https://finance.yahoo.com/markets/crypto/articles/ledger-pauses-reseller-sales-86-135100065.html",
      "receipts": 2,
      "sources": [
        "https://finance.yahoo.com/markets/crypto/articles/ledger-pauses-reseller-sales-86-135100065.html"
      ],
      "url": "https://cabaldesk.com/articles/ledger-s-recall-reaches-the-warehouse-not-the-seed-phrase-268/"
    },
    {
      "id": "ledger-says-don-t-turn-on-the-box-it-sold-86m-gone-on-bitcoin-ethereum-and-tron-266",
      "published_at": "2026-10-09T14:42:37.652Z",
      "desk": "Incidents",
      "headline": "Ledger Says Don't Turn On the Box It Sold, $86M Gone on Bitcoin, Ethereum and Tron",
      "what_to_do": "do not initialize a device bought from CryptoBilis in the past 90 days. If setup is already finished, create a new signing device with a new mnemonic phrase and move the assets",
      "what_to_do_source": "https://www.odaily.news/en/newsflash/523562",
      "receipts": 7,
      "sources": [
        "https://www.odaily.news/en/newsflash/523562",
        "https://www.tokenpost.com/news/technology/28965",
        "https://www.tokenpost.com/news/technology/29023"
      ],
      "url": "https://cabaldesk.com/articles/ledger-says-don-t-turn-on-the-box-it-sold-86m-gone-on-bitcoin-ethereum-and-tron-266/"
    },
    {
      "id": "ten-usdt-in-3-87m-out-signatures-valid-the-whole-way-264",
      "published_at": "2026-10-09T08:46:20.039Z",
      "desk": "Incidents",
      "headline": "Ten USDT In, $3.87M Out, Signatures Valid the Whole Way",
      "what_to_do": "no action needed — the team said it got the money back in full and closed the case",
      "what_to_do_source": "https://rekt.news/?tag=Scams",
      "receipts": 2,
      "sources": [
        "https://rekt.news/?tag=Scams"
      ],
      "url": "https://cabaldesk.com/articles/ten-usdt-in-3-87m-out-signatures-valid-the-whole-way-264/"
    },
    {
      "id": "79thvault-lost-12-5-million-on-bnb-chain-the-contract-had-one-role-for-that-258",
      "published_at": "2026-10-08T14:43:15.540Z",
      "desk": "Incidents",
      "headline": "79thVault Lost $12.5 Million on BNB Chain. The Contract Had One Role for That.",
      "what_to_do": "no approval to revoke is named. The operator-only permission that could move the pool's tokens was later revoked",
      "what_to_do_source": "https://www.tokenpost.com/news/technology/27869",
      "receipts": 5,
      "sources": [
        "https://www.tokenpost.com/news/technology/27869"
      ],
      "url": "https://cabaldesk.com/articles/79thvault-lost-12-5-million-on-bnb-chain-the-contract-had-one-role-for-that-258/"
    },
    {
      "id": "solana-silver-token-shuts-down-refunding-holders-at-63-a-token-256",
      "published_at": "2026-10-08T08:43:14.726Z",
      "desk": "Incidents",
      "headline": "Solana Silver Token Shuts Down, Refunding Holders at $63 a Token",
      "what_to_do": "holders who owned the token before the attack can exit at $63 per token. The pool money for refunds is set aside for that",
      "what_to_do_source": "https://www.tokenpost.com/news/technology/27242",
      "receipts": 5,
      "sources": [
        "https://www.tokenpost.com/news/technology/27242",
        "https://panews.io/articles/01a114de-dac5-779b-bd79-9d18a1e973eb"
      ],
      "url": "https://cabaldesk.com/articles/solana-silver-token-shuts-down-refunding-holders-at-63-a-token-256/"
    },
    {
      "id": "five-chains-6-07-million-and-a-cause-nobody-will-disclose-250",
      "published_at": "2026-10-07T14:42:32.762Z",
      "desk": "Incidents",
      "headline": "Five Chains, $6.07 Million, and a Cause Nobody Will Disclose",
      "what_to_do": "no holder approval sits in this path, so there is nothing here to revoke; the venue reopened days later with the cause still undisclosed",
      "what_to_do_source": "https://rekt.news/",
      "receipts": 2,
      "sources": [
        "https://rekt.news/"
      ],
      "url": "https://cabaldesk.com/articles/five-chains-6-07-million-and-a-cause-nobody-will-disclose-250/"
    },
    {
      "id": "base-vault-loses-6m-the-owner-column-stays-blank-239",
      "published_at": "2026-10-06T17:43:11.751Z",
      "desk": "Wallets",
      "headline": "Base Vault Loses $6M; the Owner Column Stays Blank",
      "what_to_do": "no action needed — nothing is named to revoke",
      "what_to_do_source": "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/",
      "receipts": 3,
      "sources": [
        "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/"
      ],
      "url": "https://cabaldesk.com/articles/base-vault-loses-6m-the-owner-column-stays-blank-239/"
    },
    {
      "id": "a-three-of-seven-safe-signed-off-on-the-contract-that-emptied-a-base-vault-238",
      "published_at": "2026-10-06T14:44:53.423Z",
      "desk": "Incidents",
      "headline": "A Three-of-Seven Safe Signed Off on the Contract That Emptied a Base Vault",
      "what_to_do": "no action needed for Aave or Base users. GoPlus says the core contracts of Aave and Base were not affected",
      "what_to_do_source": "https://www.chaincatcher.com/en/article/2294102",
      "receipts": 9,
      "sources": [
        "https://primexbt.one/news/6-million-drained-from-base-crypto-vault-controlled-by-unknown-seven-signer-safe/",
        "https://www.chaincatcher.com/en/article/2294034",
        "https://www.chaincatcher.com/en/article/2294102"
      ],
      "url": "https://cabaldesk.com/articles/a-three-of-seven-safe-signed-off-on-the-contract-that-emptied-a-base-vault-238/"
    },
    {
      "id": "base-vault-loses-6m-to-a-whitelist-that-changed-its-mind-twice-in-a-minute-236",
      "published_at": "2026-10-06T08:42:56.688Z",
      "desk": "Incidents",
      "headline": "Base Vault Loses $6M to a Whitelist That Changed Its Mind Twice in a Minute",
      "what_to_do": "no action needed for Aave users — the report says the core contracts and Base were not compromised",
      "what_to_do_source": "https://cryptoticker.io/en/base-vault-whitelist-multisig-hack-october-2026/",
      "receipts": 7,
      "sources": [
        "https://cryptoticker.io/en/base-vault-whitelist-multisig-hack-october-2026/"
      ],
      "url": "https://cabaldesk.com/articles/base-vault-loses-6m-to-a-whitelist-that-changed-its-mind-twice-in-a-minute-236/"
    },
    {
      "id": "unclaimed-base-vault-keeps-its-3-of-7-safe-loses-6m-anyway-235",
      "published_at": "2026-10-06T05:44:06.626Z",
      "desk": "Wallets",
      "headline": "Unclaimed Base Vault Keeps Its 3-of-7 Safe, Loses $6M Anyway",
      "what_to_do": "no action needed — the failures were in multisig governance and access control, and Aave's core contracts and Base were not affected",
      "what_to_do_source": "https://www.chaincatcher.com/en/article/2294102",
      "receipts": 7,
      "sources": [
        "https://primexbt.one/news/6-million-drained-from-base-crypto-vault-controlled-by-unknown-seven-signer-safe/",
        "https://mpost.io/unidentified-base-vault-hit-by-6m-multisig-exploit-leaving-31-7m-at-risk/",
        "https://www.chaincatcher.com/en/article/2294102"
      ],
      "url": "https://cabaldesk.com/articles/unclaimed-base-vault-keeps-its-3-of-7-safe-loses-6m-anyway-235/"
    },
    {
      "id": "the-whitelist-was-right-at-08-52-and-wrong-again-at-08-53-234",
      "published_at": "2026-10-06T02:43:15.912Z",
      "desk": "Incidents",
      "headline": "The Whitelist Was Right at 08:52 and Wrong Again at 08:53",
      "what_to_do": "no action needed for Aave lenders. Crypto Times states no public evidence ties the drain to Aave's core contracts or Base itself",
      "what_to_do_source": "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/",
      "receipts": 7,
      "sources": [
        "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/"
      ],
      "url": "https://cabaldesk.com/articles/the-whitelist-was-right-at-08-52-and-wrong-again-at-08-53-234/"
    },
    {
      "id": "a-base-vault-lost-6-million-to-a-contract-that-was-on-the-guest-list-233",
      "published_at": "2026-10-05T23:43:29.298Z",
      "desk": "Wallets",
      "headline": "A Base Vault Lost $6 Million to a Contract That Was on the Guest List",
      "what_to_do": "users hold no approval to revoke. The added contract did the work",
      "what_to_do_source": "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/",
      "receipts": 6,
      "sources": [
        "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/"
      ],
      "url": "https://cabaldesk.com/articles/a-base-vault-lost-6-million-to-a-contract-that-was-on-the-guest-list-233/"
    },
    {
      "id": "base-vault-s-safe-deletes-the-attacker-undoes-it-in-a-minute-loses-6-million-232",
      "published_at": "2026-10-05T20:42:58.056Z",
      "desk": "Incidents",
      "headline": "Base Vault's Safe Deletes the Attacker, Undoes It in a Minute, Loses $6 Million",
      "what_to_do": "no action needed until the vault is named — no protocol has claimed it, issued a post-mortem, frozen funds or announced a recovery",
      "what_to_do_source": "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/",
      "receipts": 8,
      "sources": [
        "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/"
      ],
      "url": "https://cabaldesk.com/articles/base-vault-s-safe-deletes-the-attacker-undoes-it-in-a-minute-loses-6-million-232/"
    },
    {
      "id": "the-whole-revenue-drain-fits-in-one-transaction-so-there-is-nothing-to-revoke-230",
      "published_at": "2026-10-05T14:44:03.262Z",
      "desk": "Incidents",
      "headline": "The Whole Revenue Drain Fits in One Transaction, So There Is Nothing to Revoke",
      "what_to_do": "no revoke step helps here — the approval and the transfer ran in the same transaction, and Salus gave users no action to take",
      "what_to_do_source": "https://crypto.news/revenue-users-hit-by-malicious-usdg-approvals-in-wallet-draining-scheme/",
      "receipts": 6,
      "sources": [
        "https://crypto.news/revenue-users-hit-by-malicious-usdg-approvals-in-wallet-draining-scheme/"
      ],
      "url": "https://cabaldesk.com/articles/the-whole-revenue-drain-fits-in-one-transaction-so-there-is-nothing-to-revoke-230/"
    },
    {
      "id": "base-vault-loses-6-million-after-its-own-safe-re-enabled-the-attacker-228",
      "published_at": "2026-10-05T08:42:27.701Z",
      "desk": "Incidents",
      "headline": "Base Vault Loses $6 Million After Its Own Safe Re-Enabled the Attacker",
      "what_to_do": "nothing to revoke. The attacker gained access through the vault's own whitelist, not a holder's approval; the Safe had run no transaction for 25 days before the attack",
      "what_to_do_source": "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/",
      "receipts": 8,
      "sources": [
        "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/",
        "https://www.tokenpost.com/news/technology/26706"
      ],
      "url": "https://cabaldesk.com/articles/base-vault-loses-6-million-after-its-own-safe-re-enabled-the-attacker-228/"
    },
    {
      "id": "base-vault-whitelists-a-newly-deployed-contract-and-loses-6-million-226",
      "published_at": "2026-10-05T02:43:16.854Z",
      "desk": "Incidents",
      "headline": "Base Vault Whitelists a Newly Deployed Contract and Loses $6 Million",
      "what_to_do": "stay away from the contract ExVul named, 0xcd..F569d, and the vault it got into, while the attack is still going",
      "what_to_do_source": "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/",
      "receipts": 5,
      "sources": [
        "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/"
      ],
      "url": "https://cabaldesk.com/articles/base-vault-whitelists-a-newly-deployed-contract-and-loses-6-million-226/"
    },
    {
      "id": "near-intents-exploiter-1-wires-the-3-8m-home-before-the-deadline-225",
      "published_at": "2026-10-04T23:42:17.635Z",
      "desk": "Wallets",
      "headline": "Near Intents Exploiter 1 Wires the $3.8M Home Before the Deadline",
      "what_to_do": "no action needed — NEAR Intents says the full $3.8 million taken in its breach is back",
      "what_to_do_source": "https://crypto-economy.com/near-intents-recovers-3-8m-in-exploit-funds-as-investigation-ends/",
      "receipts": 4,
      "sources": [
        "https://crypto-economy.com/near-intents-recovers-3-8m-in-exploit-funds-as-investigation-ends/"
      ],
      "url": "https://cabaldesk.com/articles/near-intents-exploiter-1-wires-the-3-8m-home-before-the-deadline-225/"
    },
    {
      "id": "base-vault-welcomes-fresh-contract-to-wallet-contract-leaves-with-wallet-224",
      "published_at": "2026-10-04T20:42:48.010Z",
      "desk": "Incidents",
      "headline": "Base Vault Welcomes Fresh Contract to Wallet; Contract Leaves With Wallet",
      "what_to_do": "check the whitelist on any vault, and pull any contract that does not belong there",
      "what_to_do_source": "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/",
      "receipts": 4,
      "sources": [
        "https://www.cryptotimes.io/2026/10/04/base-vault-hack-6m-in-wsteth-drained-after-attacker-gains-whitelist-access/",
        "https://www.tokenpost.com/news/technology/26676"
      ],
      "url": "https://cabaldesk.com/articles/base-vault-welcomes-fresh-contract-to-wallet-contract-leaves-with-wallet-224/"
    },
    {
      "id": "305-000-leaves-two-ethereum-safes-through-an-add-on-aave-never-shipped-220",
      "published_at": "2026-10-04T08:43:01.392Z",
      "desk": "Incidents",
      "headline": "$305,000 Leaves Two Ethereum Safes Through an Add-On Aave Never Shipped",
      "what_to_do": "no action needed on Aave v3 itself — Defimon Alerts said the custom contract built on top of Aave was the one affected, not Aave v3",
      "what_to_do_source": "https://x.com/DefimonAlerts/status/2105695635647144370",
      "receipts": 3,
      "sources": [
        "https://x.com/DefimonAlerts/status/2105695635647144370"
      ],
      "url": "https://cabaldesk.com/articles/305-000-leaves-two-ethereum-safes-through-an-add-on-aave-never-shipped-220/"
    },
    {
      "id": "exchange-celebrates-we-ve-fixed-97-of-your-money-the-3-was-bitcoin-219",
      "published_at": "2026-10-04T05:42:53.570Z",
      "desk": "Wallets",
      "headline": "Exchange Celebrates: We've Fixed 97% of Your Money (The 3% Was Bitcoin)",
      "what_to_do": "no action needed — Bitget's October 2 notice says the pause is over",
      "what_to_do_source": "https://www.bitget.com/support/articles/12560603896369",
      "receipts": 2,
      "sources": [
        "https://www.bitget.com/support/articles/12560603896369"
      ],
      "url": "https://cabaldesk.com/articles/exchange-celebrates-we-ve-fixed-97-of-your-money-the-3-was-bitcoin-219/"
    },
    {
      "id": "822-000-of-stolen-bnb-left-by-seven-doors-one-of-them-its-own-swap-desk-217",
      "published_at": "2026-10-03T23:43:07.043Z",
      "desk": "Wallets",
      "headline": "$822,000 of Stolen BNB Left by Seven Doors, One of Them Its Own Swap Desk",
      "what_to_do": "no action needed — Bitquery says the remaining 165.3 XMR1 still sits untouched on Hyperliquid",
      "what_to_do_source": "https://bitquery.io/investigations/near-intents-hack",
      "receipts": 5,
      "sources": [
        "https://bitquery.io/investigations/near-intents-hack"
      ],
      "url": "https://cabaldesk.com/articles/822-000-of-stolen-bnb-left-by-seven-doors-one-of-them-its-own-swap-desk-217/"
    },
    {
      "id": "20-933-tradewiz-wallets-paid-459-000-for-a-leaked-key-216",
      "published_at": "2026-10-03T20:42:55.589Z",
      "desk": "Incidents",
      "headline": "20,933 TradeWiz Wallets Paid $459,000 for a Leaked Key",
      "what_to_do": "nothing to revoke — Bitquery reports the funds left through leaked private keys, not a signed approval",
      "what_to_do_source": "https://bitquery.io/investigations",
      "receipts": 2,
      "sources": [
        "https://bitquery.io/investigations"
      ],
      "url": "https://cabaldesk.com/articles/20-933-tradewiz-wallets-paid-459-000-for-a-leaked-key-216/"
    },
    {
      "id": "the-bnb-leg-ends-at-kucoin-five-wallets-613-000-four-hours-213",
      "published_at": "2026-10-03T11:44:11.552Z",
      "desk": "Wallets",
      "headline": "The BNB Leg Ends at KuCoin: Five Wallets, $613,000, Four Hours",
      "what_to_do": "no action needed — the funds sit in exchange deposit wallets and an untouched account, per the labels Bitquery publishes",
      "what_to_do_source": "https://bitquery.io/investigations/near-intents-hack",
      "receipts": 2,
      "sources": [
        "https://bitquery.io/investigations/near-intents-hack"
      ],
      "url": "https://cabaldesk.com/articles/the-bnb-leg-ends-at-kucoin-five-wallets-613-000-four-hours-213/"
    },
    {
      "id": "3-8m-left-near-intents-on-bnb-a-fifth-ran-through-its-own-swap-209",
      "published_at": "2026-10-02T23:43:49.626Z",
      "desk": "Wallets",
      "headline": "$3.8M Left NEAR Intents on BNB; a Fifth Ran Through Its Own Swap",
      "what_to_do": "no action needed — the project says it will pay affected users back in full",
      "what_to_do_source": "https://www.cryptotimes.io/2026/10/02/near-intents-gm-says-3-8m-exploiter-identified-sets-48-hour-return-deadline/",
      "receipts": 7,
      "sources": [
        "https://bitquery.io/investigations/near-intents-hack",
        "https://www.cryptotimes.io/2026/10/02/near-intents-gm-says-3-8m-exploiter-identified-sets-48-hour-return-deadline/"
      ],
      "url": "https://cabaldesk.com/articles/3-8m-left-near-intents-on-bnb-a-fifth-ran-through-its-own-swap-209/"
    },
    {
      "id": "twenty-thousand-solana-wallets-one-key-export-439-000-gone-208",
      "published_at": "2026-10-02T20:42:43.808Z",
      "desk": "Incidents",
      "headline": "Twenty Thousand Solana Wallets, One Key Export, $439,000 Gone",
      "what_to_do": "stop using the wallet addresses and move what is left to a fresh wallet, the post says",
      "what_to_do_source": "https://x.com/CryptoPatel/status/2105681648423465262",
      "receipts": 3,
      "sources": [
        "https://x.com/CryptoPatel/status/2105681648423465262"
      ],
      "url": "https://cabaldesk.com/articles/twenty-thousand-solana-wallets-one-key-export-439-000-gone-208/"
    },
    {
      "id": "tradewiz-lost-459-000-across-20-933-solana-wallets-the-taker-had-an-account-206",
      "published_at": "2026-10-02T14:43:13.444Z",
      "desk": "Incidents",
      "headline": "TradeWiz Lost $459,000 Across 20,933 Solana Wallets; the Taker Had an Account",
      "what_to_do": "move remaining funds out of any wallet whose key sat in TradeWiz. The leaked keys already emptied 20,933 of them",
      "what_to_do_source": "https://bitquery.io/investigations",
      "receipts": 2,
      "sources": [
        "https://bitquery.io/investigations"
      ],
      "url": "https://cabaldesk.com/articles/tradewiz-lost-459-000-across-20-933-solana-wallets-the-taker-had-an-account-206/"
    },
    {
      "id": "the-3-8m-left-a-bsc-hot-wallet-near-intents-shut-eleven-chains-to-find-the-leak-204",
      "published_at": "2026-10-02T08:43:02.909Z",
      "desk": "Incidents",
      "headline": "The $3.8M Left a BSC Hot Wallet; NEAR Intents Shut Eleven Chains to Find the Leak",
      "what_to_do": "hold and wait. NEAR Intents said holders of those assets in HOT Wallet or near.com can swap them once the service is back",
      "what_to_do_source": "https://x.com/near_intents/status/2105642219357241796",
      "receipts": 8,
      "sources": [
        "https://x.com/near_intents/status/2105642219357241796",
        "https://x.com/PeckShieldAlert/status/2105676117202067944"
      ],
      "url": "https://cabaldesk.com/articles/the-3-8m-left-a-bsc-hot-wallet-near-intents-shut-eleven-chains-to-find-the-leak-204/"
    },
    {
      "id": "the-same-wallets-were-refilled-and-emptied-again-in-four-seconds-203",
      "published_at": "2026-10-02T05:42:17.141Z",
      "desk": "Wallets",
      "headline": "The Same Wallets Were Refilled and Emptied Again in Four Seconds",
      "what_to_do": "do not send funds to a wallet the sweep already touched. The keys stayed in use, and the refill was gone in four seconds",
      "what_to_do_source": "https://bitquery.io/investigations/tradewiz-hack",
      "receipts": 5,
      "sources": [
        "https://bitquery.io/investigations/tradewiz-hack"
      ],
      "url": "https://cabaldesk.com/articles/the-same-wallets-were-refilled-and-emptied-again-in-four-seconds-203/"
    },
    {
      "id": "protocol-s-hot-wallet-spontaneously-develops-wanderlust-transfers-3-8m-to-kucoin-202",
      "published_at": "2026-10-02T02:43:11.050Z",
      "desk": "Incidents",
      "headline": "Protocol's Hot Wallet Spontaneously Develops Wanderlust, Transfers $3.8M to KuCoin",
      "what_to_do": "no approval is named for a holder to revoke; the money left Near Intents' own hot wallet on BNB Chain",
      "what_to_do_source": "https://x.com/PeckShieldAlert/status/2105676117202067944",
      "receipts": 2,
      "sources": [
        "https://x.com/PeckShieldAlert/status/2105676117202067944"
      ],
      "url": "https://cabaldesk.com/articles/protocol-s-hot-wallet-spontaneously-develops-wanderlust-transfers-3-8m-to-kucoin-202/"
    },
    {
      "id": "bitget-refills-the-300m-fund-that-was-never-your-balance-201",
      "published_at": "2026-10-01T23:42:37.687Z",
      "desk": "Wallets",
      "headline": "Bitget Refills the $300M Fund That Was Never Your Balance",
      "what_to_do": "no action needed on balances. The refilled fund is its own ledger, apart from the reserves behind them, and the trace is still open",
      "what_to_do_source": "https://www.bitget.com/blog/articles/protection-fund-restored-above-300-million",
      "receipts": 3,
      "sources": [
        "https://www.bitget.com/blog/articles/protection-fund-restored-above-300-million"
      ],
      "url": "https://cabaldesk.com/articles/bitget-refills-the-300m-fund-that-was-never-your-balance-201/"
    },
    {
      "id": "skydao-discovers-expensive-difference-between-smart-chain-actual-smart-198",
      "published_at": "2026-10-01T14:42:21.501Z",
      "desk": "Incidents",
      "headline": "SKYDAO Discovers Expensive Difference Between 'Smart' Chain & Actual Smart",
      "what_to_do": "the record names no contract, no pool and no approval. Nothing can be revoked on its word alone",
      "what_to_do_source": "https://smartcontractshacking.com/hacks/skydao-hack-2026",
      "receipts": 6,
      "sources": [
        "https://smartcontractshacking.com/hacks/skydao-hack-2026"
      ],
      "url": "https://cabaldesk.com/articles/skydao-discovers-expensive-difference-between-smart-chain-actual-smart-198/"
    },
    {
      "id": "twelve-bitget-wallets-eleven-chains-388m-and-valid-credentials-195",
      "published_at": "2026-10-01T05:43:13.163Z",
      "desk": "Wallets",
      "headline": "Twelve Bitget Wallets, Eleven Chains, $388M, and Valid Credentials",
      "what_to_do": "no action needed — the exchange says user balances were untouched",
      "what_to_do_source": "https://www.bitget.com/academy/bitget-security-incident-what-happened-timeline-impact-response",
      "receipts": 4,
      "sources": [
        "https://www.bitget.com/academy/bitget-security-incident-what-happened-timeline-impact-response"
      ],
      "url": "https://cabaldesk.com/articles/twelve-bitget-wallets-eleven-chains-388m-and-valid-credentials-195/"
    },
    {
      "id": "amlbot-followed-four-btc-of-bitget-s-breach-into-a-wasabi-coinjoin-193",
      "published_at": "2026-09-30T23:43:16.084Z",
      "desk": "Wallets",
      "headline": "AMLBot Followed Four BTC of Bitget's Breach Into a Wasabi CoinJoin",
      "what_to_do": "no action needed — the exchange says customer account balances were unaffected",
      "what_to_do_source": "https://crypto.news/bitget-brings-back-usdt-withdrawals-after-387m-hack/",
      "receipts": 7,
      "sources": [
        "https://crypto.news/bitget-brings-back-usdt-withdrawals-after-387m-hack/"
      ],
      "url": "https://cabaldesk.com/articles/amlbot-followed-four-btc-of-bitget-s-breach-into-a-wasabi-coinjoin-193/"
    },
    {
      "id": "blockchain-vp-yes-we-plugged-the-hole-but-the-faucet-s-still-running-190",
      "published_at": "2026-09-30T14:43:19.594Z",
      "desk": "Incidents",
      "headline": "Blockchain VP: Yes We Plugged the Hole, But the Faucet's Still Running",
      "what_to_do": "revoke the PPV2 approvals now. Quit says assets moved into a wallet can still be taken while old approvals stay active",
      "what_to_do_source": "https://en.theblockbeats.news/flash/369658",
      "receipts": 7,
      "sources": [
        "https://en.theblockbeats.news/flash/369658",
        "https://www.tokenpost.com/news/technology/25569"
      ],
      "url": "https://cabaldesk.com/articles/blockchain-vp-yes-we-plugged-the-hole-but-the-faucet-s-still-running-190/"
    },
    {
      "id": "robinhood-chain-s-launch-factory-billed-18-43-million-187",
      "published_at": "2026-09-30T05:43:39.106Z",
      "desk": "Incidents",
      "headline": "Robinhood Chain's Launch Factory Billed $18.43 Million",
      "what_to_do": "the account's post lists the operation behind all 53 launches; read it before buying any Robinhood Chain launch",
      "what_to_do_source": "https://x.com/WazzCrypto/status/2104194307628621976",
      "receipts": 2,
      "sources": [
        "https://x.com/WazzCrypto/status/2104194307628621976"
      ],
      "url": "https://cabaldesk.com/articles/robinhood-chain-s-launch-factory-billed-18-43-million-187/"
    },
    {
      "id": "bitget-restarts-bitcoin-withdrawals-388-million-not-among-them-184",
      "published_at": "2026-09-29T20:42:00.291Z",
      "desk": "Incidents",
      "headline": "Bitget Restarts Bitcoin Withdrawals, $388 Million Not Among Them",
      "what_to_do": "no action needed — Bitcoin.com News says customer balances stayed whole",
      "what_to_do_source": "https://news.bitcoin.com/exchanges/bitget-restarts-bitcoin-withdrawals-388m-hack-investigation-widens/",
      "receipts": 2,
      "sources": [
        "https://www.bitget.com/campaigns/bitget-security-incident-2026",
        "https://news.bitcoin.com/exchanges/bitget-restarts-bitcoin-withdrawals-388m-hack-investigation-widens/"
      ],
      "url": "https://cabaldesk.com/articles/bitget-restarts-bitcoin-withdrawals-388-million-not-among-them-184/"
    },
    {
      "id": "hackers-discover-one-weird-trick-to-make-185m-disappear-auditors-hate-him-182",
      "published_at": "2026-09-29T14:43:56.619Z",
      "desk": "Wallets",
      "headline": "Hackers Discover One Weird Trick to Make $185M Disappear (Auditors HATE Him)",
      "what_to_do": "the same five chains open for ETH at 08:00 UTC on September 29, per Bitget's notice",
      "what_to_do_source": "https://www.bitget.com/support/articles/12560603896110",
      "receipts": 2,
      "sources": [
        "https://www.bitget.com/support/articles/12560603896110",
        "https://www.halborn.com/blog/post/explained-the-bitget-hack-september-2026"
      ],
      "url": "https://cabaldesk.com/articles/hackers-discover-one-weird-trick-to-make-185m-disappear-auditors-hate-him-182/"
    },
    {
      "id": "the-fund-covers-it-and-eth-returns-september-29-181",
      "published_at": "2026-09-29T11:44:22.930Z",
      "desk": "Incidents",
      "headline": "The Fund Covers It, and ETH Returns September 29",
      "what_to_do": "no action needed — Bitget said balances were not touched and users did not need to act before the rollout",
      "what_to_do_source": "https://www.bitget.com/support/articles/12560603896110",
      "receipts": 2,
      "sources": [
        "https://www.bitget.com/support/articles/12560603896110"
      ],
      "url": "https://cabaldesk.com/articles/the-fund-covers-it-and-eth-returns-september-29-181/"
    },
    {
      "id": "bitget-hacker-s-27-swaps-ended-at-one-address-then-bitcoin-179",
      "published_at": "2026-09-29T05:46:38.181Z",
      "desk": "Wallets",
      "headline": "Bitget Hacker's 27 Swaps Ended at One Address, Then Bitcoin",
      "what_to_do": "Bitget users can withdraw — BTC at 08:00 UTC on September 28, then ETH September 29 and USDT September 30",
      "what_to_do_source": "https://primexbt.one/news/bitget-hacker-moves-6-3-million-into-bitcoin-after-thorchain-rejects-freeze-requ/",
      "receipts": 7,
      "sources": [
        "https://cryptobriefing.com/bitget-exploit-funds-laundered-discord-telegram/",
        "https://primexbt.one/news/bitget-hacker-moves-6-3-million-into-bitcoin-after-thorchain-rejects-freeze-requ/",
        "https://azat.tv/en/bitget-hacker-routes-funds-through-wasabi-coinjoin/"
      ],
      "url": "https://cabaldesk.com/articles/bitget-hacker-s-27-swaps-ended-at-one-address-then-bitcoin-179/"
    },
    {
      "id": "53-robinhood-chain-launches-were-exit-liquidity-one-group-took-18-43m-175",
      "published_at": "2026-09-28T17:45:11.035Z",
      "desk": "Incidents",
      "headline": "53 Robinhood Chain launches were exit liquidity; one group took $18.43M",
      "what_to_do": "check the wallets on the open. Bundles of 70 to 200 wallets took 70 percent or more of supply at nearly every launch",
      "what_to_do_source": "https://www.cryptotimes.io/2026/09/28/analyst-exposes-18-43m-robinhood-chain-memecoin-rug-pull-ring/",
      "receipts": 5,
      "sources": [
        "https://x.com/WazzCrypto/status/2104194307628621976",
        "https://www.cryptotimes.io/2026/09/28/analyst-exposes-18-43m-robinhood-chain-memecoin-rug-pull-ring/"
      ],
      "url": "https://cabaldesk.com/articles/53-robinhood-chain-launches-were-exit-liquidity-one-group-took-18-43m-175/"
    },
    {
      "id": "fifty-three-robinhood-chain-launches-one-group-18-43-million-taken-169",
      "published_at": "2026-09-27T23:42:49.859Z",
      "desk": "Incidents",
      "headline": "Fifty-Three Robinhood Chain Launches, One Group, $18.43 Million Taken",
      "what_to_do": "no action needed for wallets that never bought those 53 launches, per Wazz's account on X",
      "what_to_do_source": "https://x.com/WazzCrypto/status/2104194307628621976",
      "receipts": 1,
      "sources": [
        "https://x.com/WazzCrypto/status/2104194307628621976"
      ],
      "url": "https://cabaldesk.com/articles/fifty-three-robinhood-chain-launches-one-group-18-43-million-taken-169/"
    },
    {
      "id": "83-million-in-xrp-leaves-bitget-and-the-ledger-has-no-freeze-button-163",
      "published_at": "2026-09-27T05:44:02.956Z",
      "desk": "Incidents",
      "headline": "$83 Million in XRP Leaves Bitget and the Ledger Has No Freeze Button",
      "what_to_do": "no action needed — the exchange says customer balances were not touched and the fund covers the losses",
      "what_to_do_source": "https://lcx.com/en/cryptonews/bitget-hacker-moves-83-million-in-stolen-xrp-that-ripple-cannot-freeze",
      "receipts": 5,
      "sources": [
        "https://lcx.com/en/cryptonews/bitget-hacker-moves-83-million-in-stolen-xrp-that-ripple-cannot-freeze",
        "https://bitquery.io/investigations/bitget-hack"
      ],
      "url": "https://cabaldesk.com/articles/83-million-in-xrp-leaves-bitget-and-the-ledger-has-no-freeze-button-163/"
    },
    {
      "id": "five-chains-reopen-sept-29-the-387-5m-does-not-161",
      "published_at": "2026-09-26T23:43:28.609Z",
      "desk": "Wallets",
      "headline": "Five Chains Reopen Sept 29. The $387.5M Does Not",
      "what_to_do": "no action needed — the notice says user balances were not touched",
      "what_to_do_source": "https://www.bitget.com/support/articles/12560603896110",
      "receipts": 5,
      "sources": [
        "https://www.bitget.com/support/articles/12560603896108",
        "https://www.bitget.com/support/articles/12560603896110"
      ],
      "url": "https://cabaldesk.com/articles/five-chains-reopen-sept-29-the-387-5m-does-not-161/"
    },
    {
      "id": "bitget-finds-387-5m-gone-and-starts-the-review-it-already-passed-157",
      "published_at": "2026-09-26T11:43:07.014Z",
      "desk": "Incidents",
      "headline": "Bitget Finds $387.5M Gone and Starts the Review It Already Passed",
      "what_to_do": "withdrawals stay shut until the safety review is done, Bitget said. Deposits and trading stay open",
      "what_to_do_source": "https://www.cnbctv18.com/market/cryptocurrency/crypto-exchange-bitget-halts-withdrawals-after-usd-352-million-hack-19998203.htm",
      "receipts": 6,
      "sources": [
        "https://hacked.slowmist.io/",
        "https://www.cnbctv18.com/market/cryptocurrency/crypto-exchange-bitget-halts-withdrawals-after-usd-352-million-hack-19998203.htm"
      ],
      "url": "https://cabaldesk.com/articles/bitget-finds-387-5m-gone-and-starts-the-review-it-already-passed-157/"
    },
    {
      "id": "duelbits-hot-wallets-lost-7m-on-four-chains-the-fix-is-to-refill-them-148",
      "published_at": "2026-09-25T11:43:13.625Z",
      "desk": "Wallets",
      "headline": "Duelbits Hot Wallets Lost $7M on Four Chains; the Fix Is to Refill Them",
      "what_to_do": "no action needed — the co-founder's post says \"User funds are safe.\"",
      "what_to_do_source": "https://x.com/DuelbitsJoe/status/2103116878986010688",
      "receipts": 4,
      "sources": [
        "https://x.com/DuelbitsJoe/status/2103116878986010688",
        "https://hacked.slowmist.io/"
      ],
      "url": "https://cabaldesk.com/articles/duelbits-hot-wallets-lost-7m-on-four-chains-the-fix-is-to-refill-them-148/"
    },
    {
      "id": "bitget-s-hot-wallet-runs-a-351-6m-tab-146",
      "published_at": "2026-09-25T07:28:02.348Z",
      "desk": "Incidents",
      "headline": "Bitget's Hot Wallet Runs a $351.6M Tab",
      "what_to_do": "no action needed. Bitget said its User Protection Fund holds over $464 million and covers the whole loss. Each account balance is right, and payouts come back when the review ends",
      "what_to_do_source": "https://www.bitget.com/support/articles/12560603896024",
      "receipts": 11,
      "sources": [
        "https://www.bitget.com/support/articles/12560603896024"
      ],
      "url": "https://cabaldesk.com/articles/bitget-s-hot-wallet-runs-a-351-6m-tab-146/"
    },
    {
      "id": "nine-figures-left-bitget-s-hot-wallets-and-the-exit-closed-behind-it-143",
      "published_at": "2026-09-25T02:44:02.838Z",
      "desk": "Wallets",
      "headline": "Nine Figures Left Bitget's Hot Wallets and the Exit Closed Behind It",
      "what_to_do": "no action needed — the notice says user funds are safe and the full loss falls within that fund",
      "what_to_do_source": "https://www.bitget.com/support/articles/12560603896024",
      "receipts": 6,
      "sources": [
        "https://www.bitget.com/support/articles/12560603896024"
      ],
      "url": "https://cabaldesk.com/articles/nine-figures-left-bitget-s-hot-wallets-and-the-exit-closed-behind-it-143/"
    }
  ]
}