A cluster of security incidents spanning late September to late October has underlined a growing risk for crypto users: assets and personal information can be compromised through access permissions, employee devices, software vendors and verification systems even when private keys and seed phrases remain untouched.
The pattern shifts attention from the familiar warning to protect a recovery phrase toward the less visible systems surrounding a wallet or trading account. Attackers increasingly seek ways to approve withdrawals, alter transaction interfaces, impersonate support teams or distribute counterfeit hardware, bypassing the need to break the cryptography that secures blockchain addresses.
Privileged access becomes a route to fund losses
One incident connected to Bybit involved attackers who used social engineering to compromise a Safe developer's device, according to the account described in the source material. The attackers obtained related access credentials and gained control of front-end resources within Safe wallet infrastructure.
A front-end compromise can be especially dangerous because it targets the interface users and organizations rely on to review and approve transactions. A wallet's on-chain smart contracts may remain unchanged, yet a manipulated interface could present misleading transaction details or direct signatures toward an attacker-controlled destination.
At Bitget, attackers exploited a vulnerability in a third-party security product to obtain high-privilege internal credentials, the article said. They then used forged withdrawal instructions that bypassed existing risk controls. The incident illustrates how controls designed to monitor or protect an organization can themselves become a high-value target when they are connected to sensitive internal systems.
The Binance intrusion described in the article was reportedly likely to have begun with a compromised DevOps engineer's laptop. Binance later said its investigation had identified additional intrusion points, leaving the full route of the breach unresolved at the time of the report.
DevOps teams often manage deployment systems, cloud environments and software credentials. A compromise of one employee device does not automatically provide access to customer assets, but it can create an entry point into systems that support websites, internal tooling or transaction operations. The cases place greater weight on device security, credential controls and limits on what any single account can authorize.
Customer data can fuel a second wave of attacks
The danger extends beyond immediate fund theft. Coinbase disclosed in May 2025 that attackers had bribed some overseas customer-support staff to use their legitimate access to enter internal support systems.
Coinbase said the breach did not directly expose user passwords, private keys or funds. The company said personal, account and trading-related information was accessed, creating material for targeted social-engineering campaigns in which criminals could pose as support staff and attempt to persuade customers to move assets.
Such information can make fraudulent contact substantially more convincing. A scammer who knows a customer's name, account history, phone number or recent activity may be able to imitate routine compliance, security or account-recovery outreach. For users, the practical consequence is that a message can appear credible even when the wallet itself has never been technically breached.
The episode also raises questions about how much user data platforms collect, where it is stored and which employees or vendors can reach it. Exchanges may require identity information for legal and compliance purposes, but users can still examine a provider's data-retention practices, access controls and incident disclosures before deciding where to hold assets or conduct transactions.
Hardware-wallet verification is also under pressure
Hardware wallets are commonly used to keep signing keys away from internet-connected devices, but the Keystone case described in the article shows that risks can emerge before a user signs a transaction.
On Oct. 20, Keystone said its official website had suffered unauthorized access. Later disclosures cited a flaw in a third-party website data-monitoring tool that was used to obtain some purchase records and WebAuth keys associated with device-authenticity checks.
If stolen WebAuth keys allow counterfeit devices to pass official verification, users could be exposed to tampered hardware that appears genuine during setup. The threat would arise from the device supply chain and authentication process rather than a direct theft of a seed phrase.
The article also cited Ledger-related supply-chain and device-security concerns, where protection depends on controls across manufacturing, certification, logistics and sales. A secure chip provides little protection if a device is swapped, modified or fitted with a malicious component before it reaches its owner.
Buying directly from official channels, inspecting packaging and completing official activation or verification checks remain useful safeguards, though they do not provide absolute protection against counterfeits.
Key custody remains the first question
The incidents do not reduce the importance of private-key control. They add layers to the security model users need to assess.
In a custodial arrangement, the user generally accesses assets through an account and a permission system operated by the platform. The platform manages the wallet infrastructure and authorizes transactions on behalf of the customer. A compromise of internal credentials, staff tools or withdrawal workflows can therefore affect customer balances without an attacker ever obtaining individual user seed phrases.
A non-custodial wallet follows a different model: the user holds the private key, while the wallet software supplies tools to view balances and sign transactions. This removes the provider's direct control over signing rights, but it also leaves the user responsible for backing up recovery material, verifying transaction requests and avoiding malicious software.
Users assessing any wallet should establish whether keys are created locally on their device or on a provider's servers, whether recovery phrases or keys are ever uploaded, and whether the wallet can be restored through other compatible software. Those details determine whether a provider failure could affect access to funds.
Security claims need ongoing evidence
The article used imToken as an example of a non-custodial architecture, stating that private keys are generated locally and are not stored by the provider. It said TokenCore, the wallet's core code, has been open-sourced since 2018 and that its mobile wallet uses iOS and Android randomness sources for local key generation.
For the imKey hardware wallet, the article said seed phrases and keys are generated by a true random number generator inside a secure chip. It identified the hardware as an Infineon SLE78 chip line and said the M7893 security-controller platform had received Common Criteria EAL6+ enhanced certification, supporting secure storage, secure boot and random-number generation.
The wallet also offers offline signing through QR codes, the article said. Under that arrangement, an online phone prepares an unsigned transaction, while a separate offline phone signs it. The signed transaction is then returned by QR code for broadcast. The approach, which the article said supports the ERC-4527 QR protocol, could reduce exposure from malware on a device used for routine browsing or network access.
Security design should be assessed alongside operational behavior. Open code, independent audits, bug bounty programs, repeated testing and clear incident reporting provide more useful evidence than a one-time certification or a general claim that a product is secure.
Crypto users now need to judge products across three connected areas: who controls signing rights, how much personal information is collected, and whether the provider can demonstrate that its defenses are continuously tested and improved. The recent incidents show that protecting a seed phrase remains essential, but it is only one part of defending digital assets.
Worried about hacks beyond private keys? Learn practical defenses in this crypto safety standards guide tailored for everyday traders.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
