CipherBlade

Blockchain forensics agency that provides cutting-edge solutions in cryptocurrency investigations.

11/03/2026

Following last week's Keystone data-breach coverage: the company also disclosed a stolen device-authentication key and a risk of counterfeit wallets passing its online check.

On October 24, Keystone said a third party had obtained customer shipping information, including names, contact details, addresses and order details. In an October 26 update, Keystone said the attacker also obtained the WebAuth key it uses to verify that a device is genuine. Keystone plans to destroy 18,835 unsold devices carrying that key. According to CoinDesk, Keystone said recovery phrases and private keys were not exposed.

Keystone warned about scammers posing as its staff and offering refunds, replacement devices or "fixes."

If you bought from Keystone, do not act on unsolicited calls, emails or texts about your order. In its October 26 statement, Keystone said devices delivered before October 20 can be used normally if they pass authentication. For devices received after October 20 with the old authentication key, it said to contact official support and use the device only after support confirms its authenticity, even if the online check passes.

Keystone statement: https://x.com/KeystoneWallet/status/2114719318722404578
Original report: https://www.coindesk.com/business/2026/10/27/crypto-wallet-maker-keystone-to-destroy-almost-19-000-devices-after-security-breach

10/29/2026

Participate says a loan participation payment between Vantage Bank and Rio Bank reached the buying bank's digital wallet as tokenized deposits in under three minutes.

Its October 19, 2026 announcement says principal and interest were allocated through Participate, with loan balances and notices updated automatically. The company calls it a world first. The timing and "first" label are participant claims, not independently verified results; the announcement does not disclose the payment amount or a transaction hash.

The payment used Hazel Network, developed by Vantage Bank and Custodia. Participate handled the loan workflow and automation. Vantage supplied the banking layer, and Custodia handled wallets, compliance functions, blockchain operations and reconciliation monitoring.

The announcement does not name a blockchain. Secondary reports identify Ethereum mainnet; the participants' announcement does not provide a transaction hash to check that claim.

Participate says it plans to offer tokenized-deposit loan-sale payment automation and Fedwire automation across its network of 750 banks. That is a distribution plan, not evidence that all those banks have adopted it.

For banks assessing the offer, useful questions include who controls wallet keys, how transfers are screened, and how on-chain records are reconciled with deposit ledgers. Ask for the underlying transaction record before treating the performance claim as verified.

Participate announcement: https://participateloan.com/tokenized-deposits-loan-participation-payments/

10/28/2026

Keystone hardware wallet customers: be wary of anyone contacting you about your order.

Keystone says an unauthorized third party accessed customer shipping data through its website. That data included names, contact details, shipping addresses and order details such as items bought. According to The Block, Keystone detected the access on Oct. 20, confirmed it on Oct. 23 after checking API activity with Shopify, and disclosed it on X on Oct. 24.

Keystone says payment details, recovery phrases and private keys were not exposed. It also says it has blocked access, fixed the vulnerability, opened an investigation and is emailing affected customers.

In its initial disclosure, Keystone did not give an affected-customer count or explain how access was obtained. It said a detailed report would follow.

Keystone's published retention wording differs. Its Privacy Promises page says shipping information is automatically deleted 180 days after an order. Its privacy policy refers to customers who have not ordered within 180 days. Its helpdesk describes a deletion-request process. Reports of notices for older orders remain unverified; they do not, by themselves, establish a policy violation.

Keystone warns that scammers may pose as the company by phone, text, email or mail. They may offer refunds, replacement devices or "fixes" for orders and addresses. Never share your recovery phrase with anyone. Don't use links or phone numbers from unexpected messages. Instead, check any contact through Keystone's official website. Because home addresses were exposed, also watch for unexpected mail or visitors.

If you have already lost funds, report it to local police and keep records such as messages, wallet addresses and transaction IDs. CipherBlade, a blockchain investigation firm, has information on next steps at https://cipherblade.com

Incident report: https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613
Keystone's retention statements: https://keyst.one/privacy-promises
Privacy policy: https://keyst.one/privacy-policy
Deletion helpdesk: https://keystonewallet.crisp.help/en/article/how-can-i-delete-my-shipping-information-1hkp1gk/

10/27/2026

Funds tied to the April 1, 2026 Drift Protocol exploit were sent to the Tornado Cash crypto mixer in October.

In its October 21 report, Cointelegraph cited Onchain Lens's tally of 44,510 ETH, about $109 million, transferred over Oct. 20–21. It also cited Arkham data showing exploiter-labeled wallets holding 56,569 ETH afterward.

Those are October 21 snapshots, not current balances or an independently reconciled total. Reports published different tallies; their figures should not be added together without reconciling their scope.

Drift reported about $295 million in losses. In June, Drift said a Mandiant forensic investigation attributed the attack to UNC6862, a North Korean threat group.

Our view: a mixer deposit makes tracing harder. It does not erase the on-chain record of transfers made before the funds reached the mixer.

If you were affected, use Drift's official channels for DFX recovery-token information. Claims opened Oct. 1. Drift's announcement said the Recovery Pool held about 3.1 million USDT at launch, with funding that includes a share of Velocity's net protocol revenue and recovered funds. This is not a guarantee of full recovery.

For background on how crypto tracing and recovery work, visit https://cipherblade.com

October 21 transfer report: https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days
Drift's DFX announcement: https://www.drift.trade/updates/dfx-claim-and-redemptions

10/22/2026

An update for anyone following the Ledger/CryptoBilis incident.

In its October 15, 2026 response, Ledger said it had asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. It tightened stock-handling rules to keep devices off customer-facing shelves and displays, and reiterated that returned devices must never be resold. Ledger describes an attack on devices after they left its control.

For CryptoBilis buyers, Ledger's October 13 guidance is:
- Leave unused devices uninitialized and contact Ledger Support.
- If already initialized, promptly move assets to a new signer using a new recovery phrase.
- Never enter or restore a recovery phrase on the CryptoBilis device.

If funds were drained, preserve transaction records, wallet addresses, and purchase records, and report the loss to local authorities.

More on tracing and response: https://cipherblade.com

Ledger response, October 15: https://www.ledger.com/blog-response-hardware-implant-attack
Ledger buyer guidance, October 13: https://x.com/Ledger/status/2109896739985453358

10/21/2026

On October 14, 2026, the Brooklyn District Attorney's office announced that its Virtual Currency Unit, working with the FBI, had seized and disrupted 241 web domains and 112 servers. According to the office, this infrastructure was used by a multinational crypto investment scam that targeted Russian speakers in the U.S. The October 14 announcement did not name suspects or announce arrests or charges.

The DA's office describes the scheme this way. Victims answered Russian-language Facebook ads for investment opportunities. A Russian-speaking "investment advisor" then called and coached them into opening accounts on crypto investment platform websites, buying crypto, and sending it to addresses linked to those platforms. When victims tried to withdraw after weeks or months, they were locked out or told to pay extra fees and taxes. The office estimates that tens of millions of dollars were stolen. It said about $300,000 in stolen funds had been seized as of the October 14 announcement, with efforts to recover more continuing.

The office also says data recovered from the seized infrastructure showed the scammers ran a crypto recovery scam as well. They contacted victims a few weeks after the original fraud and promised to get the stolen assets back.

If you have lost money and someone contacts you unprompted offering to recover it, treat that as a warning sign. That is the pattern prosecutors describe in this case. Do not pay upfront fees to anyone who promises to get your funds back. Report losses to the FBI at https://www.ic3.gov/. Before you engage with any recovery firm, check it independently using contact details you find yourself, not ones the caller gives you. If you want to understand how a legitimate investigation process works, you can read more at https://cipherblade.com

DA announcement: https://www.brooklynda.org/2026/10/14/brooklyn-das-virtual-currency-unit-dismantles-infrastructure-of-multinational-crypto-investment-scam-that-targeted-russian-speakers/

10/20/2026

A headline worth reading past the first line.

A TRON DAO press release dated October 12 and carried on NewsBTC says stablecoin settlement on TRON reached $2.21 trillion in Q3 2026. The figure comes from TRON DAO's own State of TRON Q3 2026 report, published October 6. These are figures published by the project and promoted through its press release.

The details in the report are also more mixed than the release's headline of "network activity growth" suggests. TRON DAO says average rolling monthly active addresses rose 9.8%, to 18 million. Compared with Q2, the same report shows:
- quarterly transaction count flat at about 1.10 billion
- total value locked, including staking, up 0.2%
- average daily fees down 4.0%
- average daily new-address creation down 3.5%

None of this makes the figures wrong. It means they are self-reported numbers from the project, not an independent audit.

When a large on-chain number appears in your feed, check who published it, what period it covers, and whether anyone outside the project has verified it. Reading TRON DAO's full report, rather than the press release alone, is a reasonable first step. More on how we approach on-chain evidence at https://cipherblade.com

Full TRON DAO report: https://trondao.org/research/state-of-tron-q3-2026-tron-passes-the-30-trillion-mark

10/15/2026

A useful reminder about tracing stolen crypto beyond the first wallet.

The Defiant reports on ZachXBT's account of a March 2025 investigation in which he says he posed as a paying client of a Chinese brokerage network to study how Bybit hack funds were moved. By his account, he fronted about 349,700 USDC and gave up roughly 5% on each order, and the broker told him in advance where the next tranche was headed. These are his claims as reported, not adjudicated findings.

Two takeaways for anyone who has been hit by theft or fraud:

1. This account highlights brokers as potential investigative leads. Records of transfers and counterparties can help investigators follow the funds.

2. Preserve wallet addresses, transaction hashes, timestamps, and all communications before anything is deleted.

If you are deciding what to do next, report the theft to law enforcement and get the tracing started. CipherBlade works alongside attorneys and law enforcement on cases that warrant it, and you can reach us through our official site: https://cipherblade.com.

Original report: https://thedefiant.io/news/hacks/zachxbt-infiltrated-chinese-syndicate-laundering-bybit-hack-funds

10/14/2026

If you bought a Ledger hardware wallet through CryptoBilis, this update is worth reading.

Ledger has confirmed an unauthorized hardware implant in at least one device sold by the Southeast Asian reseller. Its investigation into the mechanism and scope continues. As reported on October 12, Ledger says all confirmed cases in the disclosed draining incident involve CryptoBilis-sold devices. It asked CryptoBilis to stop sales and shipments.

Two practical steps from Ledger's guidance for CryptoBilis buyers:
1. If you have not initialized the device, do not set it up.
2. If you already activated one, move assets to a new device purchased directly from Ledger, using a newly generated recovery phrase. A phrase supplied with the device, on a pre-printed card, or by message is a red flag.

If funds are already gone, save transaction hashes, addresses, order records, and screenshots now. That record can support tracing work and law enforcement reports. Our official site is https://cipherblade.com.

Updated report, October 12: https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis

10/13/2026

Large movements of government-seized Bitcoin get noticed quickly. Verify the facts before acting on a recovery claim.

Cointelegraph reported on October 8 that a wallet tied to US-seized crypto moved more than 12,267 BTC, worth roughly $1 billion at publication. The report cited Arkham's link between the source wallet and funds recovered from the 2016 Bitfinex hack. The recipient address owner was unknown at publication.

Two things worth holding onto:

1. This transfer does not establish that funds were sold or returned to victims. Do not treat wallet movement as a payout announcement.

2. Be wary of anyone claiming to hold recovered funds and demanding a fee or tax to release them. Verify the organization and its domain independently before sending money or information.

If you are working through a theft, start with a law enforcement report and counsel. Our process and contact details are on https://cipherblade.com.

Original report: https://cointelegraph.com/news/us-government-seized-bitcoin-moved-one-transaction

Address

3300 Arctic Boulevard Suite 201 PMB 1082 Anchorage
Anchorage, AK
99503

Website

https://cipherblade.com/

Alerts

Be the first to know and let us send you an email when CipherBlade posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.