Once crypto leaves a wallet, nobody can reverse the transaction. Whether the money comes back depends on whom it meets on the way out.
This week we follow stolen funds from the checks that failed to the few places where someone could still refuse them, and end at TOKEN2049 Singapore.
How Attacks Get Past the Checks Users Rely On
Two recent attacks reached users through channels they trusted: an implant in Ledger devices from an official reseller passed Ledger's own verification, and a fake ChangeNOW site arrived through a Chrome recommendation. Neither victim could realistically have spotted the attack in time.
Ledger Donjon described the CryptoBilis implant on October 13. A hidden board inside the enclosure reads the 24-word recovery phrase from the screen during setup and sends it out over LTE through its own eSIM. The Secure Element stays untouched, so the device still passes the Genuine Check.
The devices came from CryptoBilis, an official Ledger reseller in Southeast Asia. Bitquery estimates $102 million drained from 324 wallets, a figure Ledger hasn't confirmed; our Ledger CryptoBilis coverage follows the investigation.
The second case is closer to home. In May 2025, SlowMist reported that a user lost more than $20,000 on a site impersonating ChangeNOW, its domain swapping one "e" for a lookalike from another alphabet. Albert Quehenberger, CEO of AQ Forensics and a ChangeNOW Ambassador, explains in our Punycode phishing guide why experience doesn't help:
Even experienced crypto users can miss the difference. We tend to recognise familiar names rather than inspect every character, especially on a phone or under time pressure.
— Albert Quehenberger, CEO of AQ Forensics and ChangeNOW Ambassador
A bookmark skips the route where the substitution happens.
Bitget Hack: Who Can Freeze $387.5M in Stolen Crypto?
The Bitget hack on September 24, 2026 drained about $387.5 million from the exchange's hot and warm wallets. The attacker obtained privileged internal credentials through a flaw in a third-party security product; private keys and cold storage were untouched. Customers are covered by Bitget's protection fund; the stolen coins are another matter.
Here the exchange's own checks were the target: test transfers in ETH and TRX stayed under alert thresholds before the main outflow began. Our Bitget hack breakdown shows where the breach stopped.
Gracy Chen publicly asked THORChain to stop servicing the attacker's addresses. By her account on The Starting Block, the protocol said it could no more intervene than Bitcoin or Ethereum. Bitget then offered 5% to any platform that freezes the funds, and 5% more on recovery.
Can Stolen Crypto Be Recovered? How $790K Went Back to a Victim in Venezuela
Stolen crypto can be recovered when it passes through a platform able to stop it and law enforcement then requests its return. After a theft in Venezuela, ChangeNOW refused five swap attempts from the thieves' wallets and, at the request of the CICPC, returned about $791,252 in USDT and SOL to the victim.
These funds took a different exit. CRIXTO and AQ Forensics traced them to a dormant wallet, then checked what the same actors had done shortly before, which pointed to ChangeNOW.
How does a non-custodial service stop anything? We don't hold user balances, but every swap passes through our infrastructure while it's processed, and that is where monitoring acts. The addresses were blocklisted on a tip, before any formal request. Afterwards the coins waited: funds under a lawful request can't be released on a platform's own initiative. The Venezuela recovery case has the full sequence.
Quehenberger covers the victim's side in our guide to what to do if your crypto is stolen, including why anyone offering to "hack back" stolen coins is usually running the next scam.
Why Crypto Wants to Hide the Blockchain: Notes From TOKEN2049 Singapore
TOKEN2049 Singapore 2026 ran on October 7–8 with around 25,000 attendees. ChangeNOW CSO Pauline Shangett argued that the next billion users should never touch a blockchain directly, and ChangeNOW joined MetaMask and Trezor on a panel about why wallets are still hard to use.
Shangett built her talk around an iced latte. If paying for one with crypto still means picking a network and holding up the queue, people will keep using cards. The Day 1 recap has the moment. That evening we hosted the Retrofuture Soiree, and the invitation reel sets the mood.
On Day 2, our colleague Yana discussed wallet usability with Francesco Andreoli of MetaMask and Denis Rojčyk of Trezor, five days before Ledger Donjon published its findings. The Day 2 recap covers the panel and the rest of the day.
Who Should Carry Crypto Security, the User or the Product?
Crypto security is moving from users to the products they use. That protects users only if the product can act when something goes wrong: block flagged addresses, refuse suspicious swaps, freeze funds on a lawful request.
Martin Masser, our Director of Strategic Partnerships, came to ChangeNOW from banking and TON. In an interview about banks and crypto, he explains why few users will run those checks themselves:
A lot of the time we're in this bubble of a bubble. The average person that has a touch point of crypto, they just want to be buying it.
— Martin Masser, Director of Strategic Partnerships at ChangeNOW
He also describes the part of ChangeNOW most users never see: many wallets run their swaps through us. The Venezuelan swaps were refused from that same position in the middle.
Shangett's latte test asks how little a user should have to do. This week's cases suggest the answer depends on what sits between their wallet and the next address.
Thanks for reading this week's digest! Before trusting a wallet, exchange or swap service, ask: if stolen funds passed through here, could anyone stop them?
