Aggregate figures for the October 2026 supply-chain implant. Every number carries a provenance label; unless marked documented, it is a community-aggregated estimate, not a verified total.
All figures above are reported: community-aggregated from victim reports and public tracing, ranges shown where sources diverge. The true counts are likely higher — unreported victims and cold-storage losses are systematically undercounted.
| Channel | Region | Reports | Status |
|---|---|---|---|
| CryptoBilis (web + stores) | MY / SEA | — | largest reported source |
| Shopee / Lazada storefronts | MY, ID, PH, SG | — | marketplace sellers vary |
| Amazon Japan | JP | — | Amazon-direct and marketplace |
| Yahoo Auctions Japan | JP | — | secondary market |
| Metapod (Changi Airport) | SG | — | travelers affected globally |
| MediaMarkt Saturn | DE | — | in-store + online |
| EU reseller (unnamed) | EU | — | open — identity unconfirmed |
Per-channel counts populate as opted-in intake reports accumulate — this table is deliberately left unmarked until verified counts exist. Do not cite dashes as zeros.
Drain proceeds consolidate through identifiable exchange deposit addresses and OTC desks. The community tracing effort tracks destination clusters per chain. Confirmed drain addresses will be published here with transaction references once verified — until then, treat any "official drain address list" you did not fetch yourself as suspect (fake lists redirect reports away from real addresses).
| Chain | Share of losses | Freeze activity | Label |
|---|---|---|---|
| Bitcoin | — | n/a (no issuer) | reported |
| Ethereum / L2s | — | USDT frozen ~$10M | reported |
| Tron | — | partial freeze (USDT-TRC20) | reported |
| Solana / other | — | — | reported |
Live rows appear only where the submitter checked "show my non-identifying report fields." Self-reported and unverified — signal, not proof. Contribute yours via sealed intake.
| Channel | Device | Loss range | Chain | Status | Reported |
|---|---|---|---|---|---|
| loading… | |||||
Aggregate estimates come from: opted-in intake reports (self-reported), public blockchain tracing (drain addresses, consolidation flows), issuer freeze announcements, and press coverage. Nothing here is a substitute for verified loss accounting — which is why the sealed intake exists. Read the publishing standard summary on the home page: documented / reported / open, nothing else.