Justin Drake’s “Bunker Mode” Warning Meets Ledger and Bitget Security Fears

TLDR

• Bitget lost about $387.5 million in a September 24 breach tied to compromised third-party security products.
• Coldcard’s firmware flaw led to about 1,816 BTC being drained from more than 5,200 addresses.
• Trezor reported two vendor breaches, ShipMonk and Brevo, without any wallet hacks.
• Ethereum researcher Justin Drake urged planning for AI-related risks to elliptic-curve cryptography.
• Ledger is investigating drained wallets linked to reseller CryptoBilis, with losses unconfirmed.

---

Crypto saw a run of security incidents between July and early October, according to a Santiment report. The cases involved exchanges, hardware wallets, bridges and software wallets.

🔐 Crypto fear is no longer just about price. From Coldcard and Trezor to Bitget, and now Ledger, security concerns have shifted due to the emergence of AI. We break down sentiment’s shift. 👇

🔗 Surviving the Diminished Trust of Crypto in the Era of AI: https://t.co/no3l9jUjWV pic.twitter.com/mmQ5UikT4V

— Santiment Intelligence (@SantimentData) October 9, 2026

The incidents were not all alike. Bitcoin’s cryptography has not been broken, and Ledger has not confirmed a company-wide flaw.

Exchange and Chain Incidents

AFX Trade lost about 24.15 million USDC on July 22. An attacker obtained the five validator signatures needed to approve a withdrawal from its bridge.

The Tectonic exploit followed on August 30. Cronos put affected borrowing at about $120.4 million, and validators rolled back 10,961 blocks to reverse about $111.2 million. Roughly $9.19 million had already left the network.

On September 6, a bug in the Liquid Network allowed about 4,000 LBTC to be created without backing. Blockstream said its reserve fell from about 4,205 BTC to about 197 BTC.

The attacker returned 3,400 BTC after the bug was patched. About 600 BTC remained outstanding, and Blockstream rejected a demand for a 10% bounty.

Bitget reported a breach on September 24. The exchange put the total at about $387.5 million, up from an initial estimate of $351.6 million.

Mandiant and SlowMist traced the attack to compromised third-party security products. Bitget said its cold wallets were unaffected and its protection fund would cover the impact on users.

Wallet Makers Report Breaches

Coldcard’s trouble began July 30. A firmware error from March 2021 weakened the randomness used to create seeds, and TRM Labs estimated about 1,816 BTC, worth roughly $116 million, was drained.

Trezor disclosed a breach at its shipping provider, ShipMonk, in August. It later said about 67,000 more U.S. customers were affected because older order records had been kept.

On September 9, Brevo, Trezor’s email provider, was compromised. About 347,149 contacts were exported, and roughly 2,500 people clicked a phishing link. Trezor said its wallets were not hacked.

D’CENT’s App Wallet lost about 12.4 million XRP across 7,393 wallets between September 15 and 25. The company told users to move funds to new wallets.

On October 7, Ethereum researcher Justin Drake urged calm planning for what he called “bunker mode.” He cited advances in AI-assisted mathematics that could target elliptic-curve cryptography. Coinbase’s Yehuda Lindell said there is no evidence the underlying assumptions have weakened.

On October 9, Tether temporarily blacklisted four THORChain vault addresses holding about $1.45 million in USDT. It lifted the restrictions hours later.

Also on October 9, Ledger began investigating drained wallets among Southeast Asian customers who bought from reseller CryptoBilis. On-chain investigator Specter estimated losses above $86 million, but Ledger has not confirmed the total. Recent buyers were told not to initialize unused devices.