A run of security incidents struck the crypto industry between July and early October, spanning exchanges, hardware wallets, bridges, and software wallets, according to a report from on-chain analytics firm Santiment. The period encompassed several of the quarter's largest losses and has pushed security concerns to the center of industry discussion, touching exchange customers and self-custody users alike. Against that backdrop, Ethereum researcher Justin Drake urged calm preparation for what he called "bunker mode," citing advances in AI-assisted mathematics that one day threaten elliptic-curve cryptography, the system that secures Bitcoin and Ethereum.

Santiment highlighted the shift in sentiment in a post on X on October 9:

🔐 Crypto fear is no longer just about price. From Coldcard and Trezor to Bitget, and now Ledger, security concerns have shifted due to the emergence of AI. We break down sentiment's shift. 👇 🔗 Surviving the Diminished Trust of Crypto in the Era of AI: pic.twitter.com/mmQ5UikT4V

— Santiment Intelligence (@SantimentData) October 9, 2026

The incidents were not all alike. Bitcoin's cryptography has not been broken, and Ledger has not confirmed a company-wide flaw. The cases ranged from exchange breaches to supply-chain compromises at wallet vendors, underscoring how differently attack surfaces present across the industry. Several of the incidents entered through third parties — a shipping provider, an email provider, compromised security products, and a reseller — giving the quarter a distinct supply-chain dimension.

Exchange and Bridge Incidents

AFX Trade lost about 24.15 million USDC on July 22 after an attacker obtained the five validator signatures needed to approve a withdrawal from its bridge, turning the approval process itself into the attack surface.

The Tectonic exploit followed on August 30. Cronos put affected borrowing at about $120.4 million, and validators rolled back 10,961 blocks — effectively rewriting recent chain history — to reverse about $111.2 million. Roughly $9.19 million had already left the network.

On September 6, a bug in the Liquid Network allowed about 4,000 LBTC to be created without backing. Blockstream said its reserve fell from about 4,205 BTC to about 197 BTC. The attacker returned 3,400 BTC after the bug was patched, but about 600 BTC remained outstanding, and Blockstream rejected a demand for a 10% bounty.

Bitget reported a breach on September 24, putting the total at about $387.5 million, up from an initial estimate of $351.6 million — an illustration of how loss figures can shift in the days after a breach. Mandiant and SlowMist traced the attack to compromised third-party security products. Bitget said its cold wallets were unaffected and that its protection fund would cover the impact on users.

Wallet Makers Report Breaches

Coldcard's trouble began on July 30. A firmware error dating to March 2021 weakened the randomness used to create seeds — the secret material from which a wallet's private keys are derived — and TRM Labs estimated that about 1,816 BTC, worth roughly $116 million, was drained from more than 5,200 addresses.

Hardware wallet maker Trezor disclosed a breach at its shipping provider, ShipMonk, in August, and later said about 67,000 more U.S. customers were affected because older order records had been kept. On September 9, Brevo, Trezor's email provider, was compromised. About 347,149 contacts were exported, and roughly 2,500 people clicked a phishing link. Trezor said its wallets were not hacked.

D'CENT's App Wallet lost about 12.4 million XRP across 7,393 wallets between September 15 and 25, and the company told users to move funds to new wallets.

The "Bunker Mode" Debate

On October 7, Drake called for measured planning around AI-related risks to elliptic-curve cryptography, the mathematical foundation of public keys in Bitcoin and Ethereum — a longer-horizon, mathematical class of risk that sits apart from the operational breaches that dominated the quarter. Coinbase's Yehuda Lindell responded that there is no evidence the underlying assumptions have weakened. The back-and-forth captured the two distinct anxieties running through the industry: demonstrated operational failures, and a threat to the cryptography itself that has not been demonstrated.

Other Developments

On October 9, Tether temporarily blacklisted four THORChain vault addresses holding about $1.45 million in USDT, then lifted the restrictions hours later.

Also on October 9, Ledger began investigating drained wallets among Southeast Asian customers who had bought devices from reseller CryptoBilis. On-chain investigator Specter estimated losses above $86 million, though Ledger has not confirmed the total. The cause remains under investigation, and recent buyers were told not to initialize unused devices.

Taken together, the string of incidents — from bridge exploits and exchange breaches to vendor compromises and firmware flaws — has made security the dominant theme of the quarter, even as firms stressed that core cryptographic assumptions remain intact. Several figures remain provisional — Bitget's total has already been revised upward once, the Ledger estimate is an unofficial third-party tally, and roughly 600 BTC from the Liquid Network bug remain outstanding — leaving the quarter's final accounting open as investigations continue.