Token Airdrop Weekly News Review — October 5 – 11, 2026

Eleven source-verified items this week. The through-lines: a supply-chain compromise in hardware wallets became the month's defining security story; Binance Alpha ran its first multi-project "Alpha Box" airdrop; and three token unlocks — HYPE, ENA and ADI — reached their dates with trackers publishing incompatible sizes for at least two of them. Underneath it all, the October deadline stack kept tightening: one claim closed, one liquidation ended, and the next three dates moved a week closer. As always: who said it, where it was said, and nothing presented as fact unless the project itself has said it.

1. The Ledger CryptoBilis drain: a hardware-wallet supply chain turned into an attack surface

On October 9, 2026, hundreds of crypto wallets were drained in a single coordinated campaign, and the common thread was the hardware protecting them. Purchasers of Ledger devices from CryptoBilis — a reseller operating in Indonesia, Malaysia and the Philippines — lost an estimated $86 million (the lower of two headline figures, from on-chain analyst Specter) to $93.2 million (Bitquery's count of funds leaving victim wallets, excluding transfers between the attacker's own addresses). Bitquery counted 315 victim wallets across six chains: about $70.5 million from 131 TRON wallets (almost all USDT), 203.8 BTC (about $16.8 million) from 122 Bitcoin wallets, plus $3.7 million on Ethereum, $1.45 million on BNB Chain, $0.58 million on Polygon and about $250,000 on Solana, valued at prices on the morning of October 9. The main wave began at 05:07 UTC, when dozens of wallets on TRON, BNB Chain, Polygon and Ethereum signed the same approval within seconds; 111 Bitcoin wallets were emptied in a single block at 05:54 UTC. Bitquery found the attacker's control addresses were funded on September 25 and ran about twenty test cycles each over the following two weeks, the last two twenty-three seconds apart on October 7. Sources: Crypto Briefing (Oct 9); iTokenly / Bitquery (Oct 12).

Our take: hardware wallets exist to make seed-phrase theft impossible; this episode shows the failure simply moves one step up the supply chain. If a device is altered before it reaches the buyer — or arrives with its recovery phrase pre-recorded — then no amount of careful on-chain behaviour helps, because the attacker already holds the keys. The airdrop relevance is direct: the wallets being swept are the same ones farmers use to hold claimed tokens, and the loss fell mostly on TRON USDT balances. "Not your keys" was never a complete sentence; the unsaid half is "and not a tampered device."

2. Ledger's response, Tether's freeze, and the money trail to Binance

The response unfolded over three days. On October 9 Ledger said it was investigating losses among users who had bought from CryptoBilis, asked the reseller to pause all sales and shipments, and told anyone who had bought from it in the previous 90 days not to set up the device — and, if they already had, to move assets to a new device with a new recovery phrase. On October 10 it said one victim's device contained an unauthorised hardware implant, after the former Mt. Gox chief executive Mark Karpelès published photographs of a Nano X bought in Malaysia with an extra module hidden behind the screen. In a 72-hour update on October 11 Ledger said the number of affected devices was limited, that every confirmed case involved devices sold through CryptoBilis, that its own systems and direct sales channels were unaffected, and that it was working with authorities. Separately, Tether blocked 37 addresses on October 9 and froze about $10.0 million of USDT, later lifting the block on four wallets Bitquery describes as OTC desks. On October 11 PeckShield said roughly $3.89 million had been routed into Binance deposit addresses on TRON — about 3.685 million USDT and 615,000 TRX — after an earlier ~$10 million in USDT had already been sent to Binance the same day. Sources: iTokenly / Bitquery; Crypto Briefing / PeckShield (Oct 11).

Our take: the freeze-and-trace sequence is the most useful part of the story for anyone holding tokens. Tether clawed back $10 million by blocking the issuer-controlled asset — and the attacker adapted by swapping some funds into USDD, a stablecoin Tether doesn't control. That is the whole lesson of centralised recovery in two moves: a freeze works only on the token an issuer issues, and every freeze teaches the next attacker to route around it. The Binance deposit addresses are the hopeful thread. If they map to exchange accounts, there is a next step; if those wallets also served ordinary customers, any freeze risks catching the uninvolved.

3. Binance Alpha ran its first multi-project "Alpha Box" airdrop

On October 9, 2026 at 17:00 (UTC+8), Binance Alpha opened an airdrop using an upgraded format: instead of a single token, the pool held tokens from multiple projects, distributed through an "Alpha Box." Users holding at least 245 Alpha Points could claim one reward on a first-come, first-served basis, with each claim consuming 15 points. The box carried three tiers — Common (80% of the pool), Rare (15%) and Ultra Rare (5%) — and each tier corresponded to a different box value; a claimant was assigned to a tier at claim time. If rewards remained unclaimed, the points threshold fell by 5 points every five minutes. Sources: Binance Square (Oct 9); BlockBeats (Oct 9); Gate News (Oct 9).

Our take: an "Alpha Box" is a randomisation layer on top of an allocation, and its real effect is to make the reward hard to price before you commit 15 points. Because the tier is assigned at claim time and the threshold decays every five minutes, the rational move is no longer "claim early for the biggest allocation" — it is a bet on the distribution of box values versus the points you burn. The 245 threshold matters less as a bar to clear than as the price of a lottery ticket, and the 80/15/5 split tells you the median outcome is the Common tier.

4. Hyperliquid unlocked 3.75 million HYPE — and sold all of it over the counter

On October 6, 2026, a scheduled release of 3.75 million HYPE to Hyperliquid's core contributors reached its distribution date — the largest single token unlock on that week's calendar, worth about $337 million at Tokenomist's reference prices (the same batch was worth roughly $347 million at the day's $92.60 quote). HYPE was trading near $92.60, up 1.4% over 24 hours, with a session range of $91.11 to $95.21. The tokens did not go to public order books: Hyperliquid Labs unstaked the full batch and sold it privately, over the counter, to a single institutional buyer, according to co-founder "iliensinc" on the project's Discord, as reported by Tokenomist. The buyer, the sale price and any holding period were not disclosed. Two sizing notes matter. First, Tokenomist puts the committed claim at 3.75 million HYPE — about 38% of the 9.92 million HYPE that some unlock calendars still display as the whitepaper ceiling. Second, Tokenomist puts the 3.75 million at about 1.69% of HYPE's released supply; core contributors hold 23.8% of the 1 billion max supply and have received monthly team distributions, the first at 1.2 million HYPE. Tokens moving back from staking pass through a seven-day unstaking queue. Sources: The Crypto Times (Oct 6); BeInCrypto; Crypto News Focus.

Our take: an OTC sale does not neutralise an unlock — it only postpones the question of whether the supply reaches the market. The tokens left the team's staked position and entered a single buyer's hands off-exchange, so the order book never had to absorb them on October 6. What happens next is an on-chain question, not a price one: watch whether that batch moves toward exchange deposit addresses in the coming weeks. The 3.75-million-versus-9.92-million gap is the other story — a committed claim at 38% of the scheduled ceiling is a reminder that "amount unlocked" and "amount claimed" are different numbers that calendars routinely conflate.

5. Ethena's ENA unlock: 171.88 million or 1.41 billion, depending on the tracker

Ethena's October 5, 2026 unlock produced two very different prints. One set of trackers — Tokenomist, cited by BeInCrypto — records 171.88 million ENA worth about $41.52 million, equal to 1.88% of released supply, split into 93.75 million tokens to core contributors and 78.13 million to investors. Another record, carried by Bittime and toscale, describes the remaining investor allocation of about 1.41 billion ENA worth roughly $340 million, framed as the final major release that ends the monthly unlock schedule about 17 months early; a third (WikiBit) sizes the same 1.41 billion at ~14% of supply and ~$380 million. Both figures were reported for the same October 5 date. We print them side by side and do not average. Sources: BeInCrypto (Tokenomist data); Bittime (Tokenomist data); toscale (Q4 calendar).

Our take: a 171.88-million print and a 1.41-billion print describe the same event, and the gap is not a rounding error — it is roughly an 8× difference in claimed size. The likely explanation is that one number counts a single tranche while the other counts a programme's remaining allocation, but we cannot confirm that from the sources, so we publish both rather than pick the tidier one. For a claimant the practical point is that "the unlock" is often a label for several releases bundled under one date, and the label alone cannot tell you how much supply is actually moving.

6. ADI's October 9 unlock: the week's largest standard release, sized two ways

ADI unlocked 6.99 million tokens on October 9, 2026 — roughly $56.45 million at CryptoRank's reference and the largest standard (non-team) release of the week, with an additional tracker sizing it near $56.89 million. The allocation is about 0.70% of total supply and splits into roughly 4.79 million from a community fund and 2.2 million from a treasury reserve, released on a linear schedule rather than a cliff. The sizing disagreement is sharp: OKX describes the unlock as 7.18% of market cap / circulating supply, while DropsTab, cited by TokenPost, puts the unlocked value at 74.12% of market cap — because ADI's circulating float is small, the same token count reads as a very different share of the market depending on the denominator. Sources: OKX (Oct 5–11 unlocks); TokenPost (DropsTab data); KuCoin (week's top unlocks).

Our take: 7.18% and 74.12% of market cap for the same unlock is not a contradiction about the tokens — it is a contradiction about the denominator, and it is the cleanest illustration this tracker has seen of why "unlock as % of supply" needs its base named. Linear releases into a small float can look catastrophic on a market-cap basis and trivial on a total-supply basis; neither number is wrong, but only one of them describes the shock to holders. The number that travels on social media is the larger one, and it is the one least well defined.

7. Ethos's WHUF unlock executed — transferable, but no confirmed listing

Ethos Network's WHUF token became transferable at 15:00 UTC on October 8, 2026, exactly as the hardcoded timestamp in the upgraded contract specified. All 1,425 locked sale and bonus wallets unlocked automatically — no claim, no contract interaction, no manual step — ending the 30-day lock that followed the September 8 token generation event. The upgrade, shipped September 28 and audited by Guardian, replaced a multisig-controlled global unlock switch with a fixed on-chain timestamp and split the Foundation treasury from sale wallets so market makers could receive inventory before transferability began; the lock list is frozen and publicly verifiable on Basescan. Ethos states that no exchange listing was officially confirmed for October 8 — transferability means tokens can move on-chain, but a secondary market depends on whether an exchange or liquidity pool lists the token. The 85% price guarantee for vouched tokens remains redeemable in USDC until October 8, 2027. The auction, for context, cleared at $4.20 for 2 million WHUF (20% of the fixed 10 million supply), raising $8.4 million from 1,560 bidders at an implied fully diluted valuation near $42 million. Sources: Ethos Help Center; Bitrue; Cryptolaxy.

Our take: this was the cleanest airdrop-adjacent event of the week, and the reason is that it removed discretion rather than added it. A hardcoded timestamp cannot be delayed by a committee, the frozen lock list lets every holder verify their own expiry, and the treasury separation put liquidity in place before the crowd could trade. The one caveat is the one Ethos itself flags: transferable is not listed. A token that can move on-chain but has no venue is still a token you cannot sell at a published price, and the distinction is exactly the kind of thing deadline trackers tend to blur.

8. Kraken's Beldex and Humanity liquidation closed on October 9

The payout for Kraken's delisted Beldex ($BDX/$BELDEX) and Humanity ($H/$HUMANITY) tickers closed on September 25, 2026 at 14:00 UTC, and whatever remained entered automatic liquidation. That window has now ended. Kraken's support notice and its own status update place the liquidation between October 2 and October 9, 2026; the status page marked the window "in progress" as of 18:10 UTC on October 5 with a scheduled end at 23:59 UTC on October 9, and Kraken said assets would be removed from accounts and any proceeds credited by end of day October 9. Earlier third-party reporting (CryptoCompass, Crypto World Headline) had described a September 28 – October 2 window; we treat the exchange's own notice as primary and had printed both. The exchange's blunt warning stood throughout: liquidation prices may fall well below recent reference prices, and proceeds could be minimal or zero. The four affected tickers trace to two earlier attacks on the projects, after which both issued replacement contracts that Kraken credited 1:1. Sources: Kraken — Beldex migration notice; Up & Down — crypto brief (Oct 7); CryptoCompass.

Our take: this entry closes the loop on a row we have followed for three weeks, and the closure is the whole point — an airdrop you never had to claim can still expire, and this time it expired on a date the exchange, not a tracker, set. The gap between the two printed windows (Sep 28 – Oct 2 vs Oct 2–9) was never resolved by argument; it was resolved by the calendar. For anyone affected, the practical residue is documentation: a forced liquidation is a taxable event even though the holder did not trigger it.

9. Cambria's opt-in deadline passed as it teased a mid-October TGE

Cambria, a "risk-to-earn" browser MMO with a confirmed $RSGP token, extended the deadline for historical users to accept its Genesis Event Opt-In Agreement to October 8, 2026 — after which eligible users who had not opted in risked losing access to their allocation. The same day it opened the Priority WL mint for Founding Charters and ran a final whitelist wave. According to the team's recent AMA, the $RSGP token generation event is expected around October 13–14, 2026, with tokens fully unlocked at launch — no lockup or vesting — though the date has not been finalised. The project runs two reward tracks: Loot Chests, which score wallets on a "Degen" and "Chad" profile of Solana trading, Polymarket positions and perp activity, and a Genesis Airdrop built on Trinkets and Essence Points earned in gameplay. Sources: Airdrops.io (Cambria); 99Airdrops — October 2026.

Our take: Cambria is a useful counterweight to the week's unlock-heavy news because it is the opposite design — no lockup, no vesting, fully unlocked at launch. That is attractive on the way in and unhelpful on the way out: a fully-unlocked community token has no taper, so any selling pressure arrives all at once rather than spreading across a schedule. The Opt-In deadline is the item that actually cost people value this week, because it was a hard gate on eligibility rather than a live claim: miss it and there is nothing left to claim later.

10. Monad set its claim portal for October 14 as pre-market hypers opened

Ahead of the week's close, Monad confirmed its airdrop claim portal opens on October 14, 2026 at 13:00 UTC, running for three weeks. The airdrop is built on a task-based, time-bound model — the project says qualifying tasks grant eligibility directly, with no manual review or random selection — and targets roughly 5,500 Monad community members plus about 225,000 members of the wider crypto community, selected for on-chain activity, notable NFT holdings, DEX and Solana trading, DAO participation and ecosystem contributions. Eligible users may see allocations as early as October 28, with claims open until November 3. In parallel, Hyperliquid listed MON-USD "hyperps" (pre-market perpetuals, up to 3× leverage) on October 8, and MON was quoted on grey markets near $0.08 with over $7.3 million in 24-hour volume. The Foundation flagged strict anti-sybil measures, and Head of Growth Kevin McCordic urged users to rely only on official sources. Sources: Gate Learn (Oct 14 portal); Decrypt via MainCrypto (eligibility); FX168 / TradingView (October TGE list).

Our take: the most notable thing about Monad's design is that it publishes a claim portal date and an allocation-check date but no eligibility rules at the time of writing — which is the inverse of how a task-based airdrop usually reads. "Complete tasks, qualify immediately" is a transparency claim, not a disclosure; until the task list and weighting are published, the 225,000-recipient figure is a target, not a verified distribution. The pre-market hypers are the tell that a real market already exists for this token before the network does, and they will price the airdrop's value faster than any claim guide can.

11. The week ahead: October 12, 15 and 25 tighten the stack

Dated items now on the calendar. InterLink's "First 10M Linkers" claim closes October 12, 2026 at 23:59 UTC (1 ITL plus a commemorative NFT per eligible user; holders need at least 10,000 ITLG at distribution). Sonic's unclaimed-token burn executes October 15, when roughly 32.69 million S tokens from Seasons 1 and 2 that went unclaimed are burned with no grace period. Pharos (PROS) closes its claim portal on October 25 — the first week this row carries a printed end date — after which unclaimed tokens return to the Pharos Foundation. Grass Stage 2 runs to January 22, 2027, paid in USDC rather than GRASS. Beyond the claim side, October's TGE calendar is the densest of the year: Monad's portal (Oct 14), Enso and Yei Finance (CLO) on Binance Alpha plus a CLOUSDT perpetual (Oct 14), and Fleek's 10 million FLK community airdrop (Oct 14). The Binance USD1 campaign's next weekly WLFI payout also falls inside this window, with the switch to Stage 2 terms due on or before October 16. Sources: CryptoTicker — Week 41 deadlines (Oct 15 Sonic, Oct 25 Pharos); AirdropBuzz (InterLink Oct 12); FX168 / TradingView (October TGE stack).

Our take: read the stack as expiry rather than news. October 12 (InterLink) and October 25 (Pharos) are claim-side events where inaction is permanent; October 15 (Sonic) is the same but supply-side, since the burn changes the arithmetic for everyone who claimed and everyone who did not. The TGE cluster is the opposite risk — it adds tokens rather than removing them, and the flood of mid-month launches means eligibility windows are compressing: a task-based claim like Monad's can open and leave a participant behind in the same fortnight. Every date here is a published schedule, not a forecast; we will verify execution next week.

Data Snapshot

Every figure above is attributed in the linked sources; the threshold series, the unlock disagreements and their caveats are tabulated in the weekly data report.

What we did not find

• No published per-distribution value for the campaign's first Stage 1 WLFI payout (due October 10) in sources accessible to us — the measurement gap continues into the renewed round.
• No Ledger root-cause report: as of October 11 the company had confirmed at least one tampered device and limited the issue to CryptoBilis, but had not published how the devices were altered or by whom.
• No confirmed exchange listing for WHUF on October 8 — transferability and a trading debut are different events, and Ethos says only the former happened.
• No published eligibility rules or task list for Monad's airdrop at the time of writing, three days before its October 14 claim portal opens.

Sources

FAQ

Related Reading

• Token Airdrop Weekly Data Report — October 5 – 11, 2026
• The CryptoBilis Drain: Anatomy of a Hardware-Wallet Supply-Chain Attack
• NEAR's $3.8M Week: An ETF Debut, an Exploit, and a Full Recovery
• Airdrop Market Report — September 2026