Onchain Security Roundup: Oct 5 - 11

Ledger Reseller Devices and a Supply-Chain Seed Capture

TL;DR: On October 9th, wallets set up on Ledger devices bought through the reseller CryptoBilis were emptied across 6 chains with $93.2 million taken from 315 wallets. Ledger confirmed an unauthorized hardware implant in a single device and says its own systems were not compromised. Tether froze $10.0 million of USDT, per Bitquery.

CryptoBilis resells Ledger devices in Indonesia, Malaysia, and the Philippines. On October 9th, Ledger said it was investigating losses among CryptoBilis buyers. On October 10th Ledger Support stated that "one of the impacted users' devices contained an unauthorized hardware implant," with all confirmed cases tied to that reseller. Per CryptoSlate, Mark Karpelès describes an eSIM, a small processor, and an LTE module in a tampered Ledger Nano X that read the recovery words from the screen and send them over a cellular link. SlowMist's 23pds describes a tap on the screen's serial peripheral interface lines. Ledger has not published the implant's design or confirmed either description.

Per Bitquery, the drain began at 04:59 UTC on October 9th, when 30 TRON wallets added the same new signing key within 3 seconds. Approvals followed at 05:07 UTC, and within 6 seconds $29 million in USDT had left TRON wallets. Within 47 minutes the actor had emptied wallets on Ethereum, BNB Chain, Polygon, Solana, and Bitcoin, including 111 Bitcoin wallets in a single block. ETH began arriving at the drain address 0x83aeaC166f6832aE3500000a24510a95a052A599 at 05:08 UTC, and 203.26 BTC reached the 2 Bitcoin drain addresses in a single block. Bitquery reads the synchronized signing, after 41 test loops from September 26th, as evidence of a single key holder.

Ledger has not publicly confirmed the total impact. Onchain analysis shows losses of $93.2 million across all chains, with Bitcoin, Ethereum, BNB Chain, Polygon, and Solana accounting for $22.8 million, and 70.2 million USDT (plus some TRX) on TRON, the largest leg, for $70.5 million. Per Bitquery, 2,990 ETH went through Tornado Cash and Zcash on October 9th and 10th, and 5.35 million USDC landed in wallets Circle could freeze. PeckShield tracked $3.89 million to Binance deposit addresses on TRON. 

A passphrase or externally generated seed offers no protection against an implant that reads the screen. Ledger advises anyone who bought through CryptoBilis in the last 90 days not to initialize unused devices and to move funds to a new seed generated on a device bought directly. 

79thVault and a Privileged Pool Withdrawal

TL;DR: On October 7th, an operator-role key in the 79AU token on BNB Chain pulled 2.51 million 79AU out of the PancakeSwap 79AU/USDT pair over 8 transfers to two attacker addresses, which sold it for a combined 18,534 BNB. The main cash-out was 16,249 BNB ($12.5 million, per CertiK). The project blames a stolen operator key. The attacker returned 15,000 BNB on October 9th, and 3,534 BNB is still outstanding.

79thVault runs 79AU, a BNB Chain token. Its contract has an OPERATOR_ROLE-only function that moves any amount of 79AU out of the pair to any address and then calls sync(). Between 07:25 and 08:19 UTC on October 7th, the team's operator hot wallet used it eight times, sending 2.51 million 79AU to two fresh addresses: 2.01 million to the main attacker address and 500,000 to a second. The main address sold its tokens back into the pair through 92 transactions, and the pair lost a net $11.21 million of USDT, consistent with Defimon's reserve figures of $15.2 million before and $3.9 million after. The proceeds left as 16,249.12 BNB in a single transfer to 0x629b368c at 10:10 UTC. The second address sold its 500,000 79AU for 2,284 BNB that afternoon.

The project's October 8th statement says the attacker "obtained an operator's private key" in an attack stemming from "weaknesses in account permission management," and that the role has been revoked. Defimon points to a complication: 41 seconds after the cash-out, the operator key sent its own 3.79 BNB to the attacker's receiving address, and the 79thVault team's later bounty messages were signed by the same key. Either the attacker controlled the key throughout, or someone inside did; GoPlus framed the question the same way. 

The team's first onchain message on October 8th offered a 10% bounty, a second demanded half the funds within 12 hours, and a third on October 9th proposed that the attacker return 15,000 BNB and keep the rest. The attacker sent 15,000 BNB to the team's designated address that day from a wallet its receiving address had funded. CertiK and PeckShield valued the return at $11 million. The remaining 3,534 BNB ($2.71 million at the time of loss) includes 2,284 BNB that the second address moved into Tornado Cash on October 9th and 10th.

The team has stated it will return the BNB to the liquidity pool and burn the liquidity provider tokens. The vulnerability is a single hot key with the power to drain a DEX pair through a function that worked as written. 

MakerDAO Legacy Keeper and an Unprotected Exit

TL;DR: On October 6th, a Tornado Cash-funded address drained 200 ETH ($542,982, per CertiK) from a dormant third-party MakerDAO liquidation keeper. The keeper had won 4 ETH-A auctions in 2020 and never claimed the collateral, and its proxy exposed an exit routine with no access control. Maker's core contracts behaved as designed and were not impacted. No funds have been recovered to date.

MakerDAO, the lending protocol now called Sky, sold collateral from liquidated vaults in 2020 through ETH-A flip auctions run by Flipper contracts. The keeper, an upgradeable proxy at 0x9c05a05893ada984fc20d0da0c046de5cc0e8273, won auctions 1457-1460 at 50 WETH each and never called deal() on the Flipper, so 200 WETH sat claimable for six years. At 06:13 UTC on October 6th, an address that Defimon and CertiK traced to Tornado Cash funding, deployed a contract that called the keeper's drain routine. Four deal() calls settled the auctions; the Vat moved four lots of 50 WETH to the keeper; the keeper pushed 200 WETH to the attacker's helper; the ETH-A GemJoin released it, and 200 ETH arrived at 0x01eb957e5c7dcddd60f3c875956ccc6fb9bda5fa. Between 06:19 and 06:28 UTC, the attacker moved all 200 ETH into Tornado Cash over 20 deposits.

Defimon's reading of the unverified implementation shows the exit function (selector 0x8804d1de) was not wrapped in the ds-auth check the rest of the contract used. The owner was set but the authority was zero, so any caller could pass, and the function handed the collateral to a recipient the caller chose. The bug sits in a private keeper bot. Sky's Vat, Flipper, and GemJoin executed the calls they were designed to accept. The keeper's owner, 0xadc374e7, has not been identified.

Keeper bots written for the liquidation system Maker retired years ago are still live, still hold claims, and are no longer maintained. Teams that ran auction keepers in the 2019-2020 era should check whether their proxies still hold unclaimed collateral and whether their exit functions are guarded.

Papertrade and a Movable Reference Price

TL;DR: Hours after Papertrade launched on HyperEVM on October 10th, traders were accused of abusing an alleged design flaw: moving Hyperliquid's ETH mid price with large orders to profit on Papertrade positions priced off that mid. One wallet withdrew a net of $1.28 million. Papertrade tightened limits and says it was defending against manipulation attempts. It has not publicly confirmed a loss.

Papertrade is a perpetuals venue that prices fills at the midpoint of Hyperliquid's best bid and offer (BBO) and pays winners from a house USDC pool. A trader can move that mid with large orders on Hyperliquid and collect on a much larger Papertrade position. Trader _El33_ laid out the loop on October 10th: open ETH shorts on Papertrade, market-sell ETH on Hyperliquid to push the mid down, close the shorts, and flip long. X user Dr_bobo54 alleged that two wallets ran this with orders of $20 million each, moving the ETH mid by 10-20 basis points.

On the public fill history for the named wallet, 0x2025137a136bea7446deba681cbfc7cf1970840e, there were 10,192 ETH fills between 20:53 UTC on October 10th and 03:00 UTC on October 11th for $222.9 million in notional. On Hyperliquid the wallet closed with a $43,105 loss and paid $49,862 in fees, a total cost of $92,967. Through its Papertrade deposit contract, the wallet deposited 1,200,101 USDC. The Papertrade Exchange contract paid it 2,479,207 USDC for a net withdrawal of 1,279,106 USDC, matching The Block's reported figure of $1.28 million. Papertrade told The Block that the trader later returned almost all of the gains through new accounts and that some users agreed to reverse manipulated trades. The Block could not verify either claim, and our team could not identify the new accounts. The Hyperliquid cost is small next to that gain, consistent with paying to move the price.

A chart in Papertrade's post shows the pool falling from $5 million to $2.4 million before recovering; other reporting puts the low at $2.55 million and the recovery at $3.14 million by October 11th. The pool shares the Exchange contract's USDC balance with trader margin, so we could not verify these figures. No source reports a loss of user deposits. The pool absorbs trader profits by design, and if it drops below $2 million, the venue mints PAPER tokens to losing traders instead.

Whether this is an alleged design flaw being abused or the venue working as designed is contested. Papertrade's documentation reportedly lists BBO manipulation as a known, unresolved risk, and a co-founder had said before launch that it would not be profitable. Papertrade said the attempts were "not an oversight in the mechanism design we spent six months working on," and blamed open-interest caps it had set loosely for launch demand, which it has begun tightening. A derivative that settles against another market's live mid is only as manipulation-resistant as that market is deep relative to the derivative's open interest. The trader's gain is verified onchain.