Crypto security in 2026

Crypto security covers the systems that hold assets, approve transactions and supply data to financial contracts. Theft can begin with a compromised exchange, an unsafe wallet setup or permissions that let someone move funds. Each incident needs its own evidence before its cause or financial impact can be stated confidently.

Bitget restored withdrawals after September’s theft

Bitget’s 24 September incident carried a reported gross theft of $387.5m, rounded to $388m in its official incident page. The dated timeline records USDT withdrawals resuming on 30 September and the final phase, including other cryptocurrencies, fiat and P2P services, on 2 October at 08:00 UTC.

Service restoration and recovery of stolen assets are separate milestones. An exchange can resume withdrawals using its own reserves or replacement funding while investigators continue tracing the theft.

Ledger is investigating CryptoBilis customer losses

Ledger Support said on 9 October that it was investigating losses involving customers of the Southeast Asian reseller CryptoBilis and had asked the reseller to pause sales and shipments.

YFarmX’s investigation, updated on 12 October, estimates a $103.4m gross drain at its 9 October valuation basis from 530 sending addresses. One person can control several addresses. Ledger confirmed an unauthorised hardware implant in one impacted device on 10 October, and CryptoBilis stopped all hardware-wallet sales. The wider investigation continues.

Contract permissions can move old funds

On 6 October, a keeper used for legacy MakerDAO ETH-A auctions lost 200 ETH, valued by CertiK at approximately $542,982 at the time. A keeper is software that submits transactions needed to keep a financial protocol operating.

CertiK’s transaction analysis identifies an unprotected function in the third-party keeper. The attacker used it to delegate account permissions, settle four auctions from 2020 and withdraw their collateral. This incident illustrates why permission reviews need to include old contracts and supporting services as well as the main protocol.

Read gross losses and recoveries separately

A token price change can alter a dollar estimate without another theft occurring. Early alerts can also cover only part of an incident. Keep the source, observation date and valuation basis beside the amount.

Match the protection to the system

For a wallet, follow the maker’s current advisory and verify software and device provenance. For a contract, review who can approve transfers, upgrade the code and supply prices. For an exchange, assess custody arrangements and the operator’s incident disclosures.

The exploit tracker links each recorded incident to its evidence and preserves the difference between an established mechanism and an investigation still in progress.