Tampered Ledger wallets turned resale into an $83 million risk
- Rabbit Hole Recap reported an $83 million drain tied to tampered Ledger devices sold by Malaysian reseller Crypto Billis.
- The show said Ledger described the compromise as isolated to that reseller, not its core manufacturing.
- How the devices were altered and when the theft occurred remain unclear in the supplied account.
A hardware wallet can keep keys away from online attackers, but only if the device reaches its owner untampered. On Oct. 9, 2026, Rabbit Hole Recap hosts Marty Bent and Thomas reported that devices distributed by Malaysian reseller Crypto Billis were linked to an $83 million drain across Bitcoin, Ether and Tron. Their account did not say when the theft occurred.
The hosts said Ledger confirmed the compromise was isolated to Crypto Billis rather than a flaw in its core manufacturing. That distinction matters: the reported weakness was in distribution, where a device can be altered between factory and buyer. A wallet’s security depends not just on its design, but on trusting the physical route it took.
How the devices were modified remains uncertain. The show described soldered eSIM chips on adapter boards as a possibility, with attackers potentially intercepting private-key data and sweeping funds after balances reached preset thresholds. Those details were presented as likely mechanisms, not confirmed findings.
Rabbit Hole Recap urged anyone who bought a device from an unauthorized vendor to move their funds. The practical stakes reach beyond this reseller: the reported loss shows how a compromised intermediary can put self-custody at risk without breaking the wallet’s underlying cryptography. The supplied account leaves unanswered how many devices were affected, when the drain took place and how investigators established the total.
Source Intelligence
- Deep dive into what was said in the episodes
$86M Drained From Ledgers & Can AI Break Bitcoin's Crypto? | Rabbit Hole Recap • Oct 9
- Attackers drained over $83 million across Bitcoin, Ether, and Tron from Ledger hardware wallets sold by reseller CryptoBillis. Mark Karpeles noted attackers likely desoldered hardware eSIMs to transmit private keys to malicious actors.
Also discussed on this episode: (12)
BTC Markets (1)
- Bitcoin traded at $82,720 with a market cap of $1.66 trillion as block height reached 970,657. Mempool fees remained low at 3 sats per vByte despite elevated chain activity.
Protocol (3)
- Justin Drake warned that frontier AI could break elliptic curve cryptography without quantum computers, advising against address reuse. Coinbase cryptographer Yehuda Lindell dismissed the claims as speculative FUD lacking technical evidence.
- Cryptographers Jonas Nick and Mikhail Kudinov previously acknowledged ECDSA will eventually face cryptographic decay. Bitcoin researchers are proactively developing post-quantum signature schemes to replace legacy public key pairs.
- Bitcoin Red Team initiative Project Lupe identified five Core vulnerabilities using frontier AI scanning tools. Developers including Hodlnator and Sebastian patched RPC port binding flaws, data races, and silent payment issues.
Safety (1)
- A financially motivated hacker used open-source AI tools and Claude session histories to breach nine South Korean banks. The attack exposed personal financial data for over 68,000 customers, including 25,000 at Shinhan Bank.
Regulation (2)
- SEC Commissioner Hester Peirce urged policymakers to overhaul corporate KYC warehousing and the Bank Secrecy Act. Centralized identity databases mandated by financial surveillance laws create persistent target honeypots for automated AI exploitation.
- Candidate Bruce Blakeman pledged to dismantle New York state's BitLicense and end energy moratoriums. Conversely, Manhattan District Attorney Alvin Bragg and state lawmakers proposed attaching criminal liability to BitLicense compliance violations.
Energy (1)
- Dark Horse partnered with Hopkinsville Electric to fund a 65-megawatt substation within the Tennessee Valley Authority system. Dark Horse will utilize 50 megawatts while allocating 15 megawatts to stabilize local residential grid capacity.
Mining (1)
- Major mining operators are actively shifting infrastructure capacity toward higher-margin AI high-performance computing. Marty Bent anticipates this transition will flood the secondary market with cheap ASICs over the next twelve months.
Nation-State (1)
- The US government transferred roughly $1 billion in Bitcoin connected to the historic Bitfinex hack. Separately, Treasury Secretary Scott Bessent announced plans to seize $1 billion in Iran-linked crypto assets.
Adoption (1)
- Block initiated a nationwide mainstream advertising campaign across movie theaters and major sports broadcasts. The campaign aims to make Bitcoin accessible to general consumers while highlighting persistent fiat currency devaluation.
Coding (1)
- Community developers are leveraging frontier AI models to rapidly build custom video game mods and recreate complex software suites. These user-driven vibe coding tools directly threaten existing SaaS and gaming business models.