Ledger theft puts self-custody under a harder test
- Reports tie a Ledger wallet drain to reseller-tampered devices, but estimates vary from $83 million to $93 million.
- The breach sharpens the custody debate: diversify keys and devices, but centralized custodians carry their own risks.
A wallet designed to keep keys offline can still be compromised before it reaches its owner. The Ledger incident is not described by the shows as a failure of the company’s core software: the reported attack involved devices altered in the supply chain.
Rabbit Hole Recap first covered the incident on October 9, 2026, reporting $83 million drained from devices sold by Malaysian reseller Crypto Billis. In later coverage, Ungovernable Misfits put the estimated loss at $93 million, while Bitcoin And reported $86 million. The shows do not explain the difference, so the totals remain competing estimates, not a settled final figure.
Ungovernable Misfits said the affected Nano X devices contained a concealed cellular modem and microcontroller that could capture seed phrases through display data lines and transmit them. The show reported 315 affected wallets across six blockchains, including 111 Bitcoin wallets emptied in a single block. It said Ledger’s genuine-device checks were bypassed; Bitcoin And stressed that the attack was physical tampering, not a failure of Ledger’s random-number generator.
The incident has renewed arguments over how to hold large amounts safely. Ungovernable Misfits’ Q and A argued that multi-vendor multisignature custody can limit the damage from one compromised device or manufacturer, while co-host Max warned that complex setups bring friction and that users should avoid concentrating all their wealth in one asset or arrangement.
Bitcoin And reported a different proposed trade-off: some investors favor exchange-traded funds over managing keys themselves, while security researcher Jameson Lopp warned that centralized custody creates its own single points of failure. The breach does not settle which option is safest. It does show why “offline” alone is not a complete security plan: where a device came from, how keys are split, and who controls them all matter.
Source Intelligence
- Deep dive into what was said in the episodes
Ledger's $86 Million Wallet Scare | Bitcoin News • Oct 12
- Hardware wallet maker Ledger confirmed an unauthorized physical implant in devices distributed by Southeast Asian reseller CryptoBillis. David Bennett emphasizes that the supply chain attack compromised physical devices rather than Ledger's core software or random number generators.
- Security incidents have ignited industry debates over whether exchange-traded funds offer safer custody than hardware wallets. Plan B defended converting holdings to ETFs in 2025, while Jameson Lopp warned that rushing assets into centralized vehicles creates single points of failure.
Also discussed on this episode: (5)
Stablecoins (1)
- The Financial Stability Board warned that uncoordinated national regulations expose severe vulnerabilities in global stablecoins during potential liquidity runs. Bank of England Governor Andrew Bailey urged international financial authorities to establish cross-border information sharing protocols before market distress hits.
Regulation (1)
- The Commodity Futures Trading Commission proposed defining event contracts tied to sports and politics as swaps under its exclusive jurisdiction. Chairman Michael Selig asserted authority over platforms like Kalshi and Polymarket, while explicitly excluding traditional casino gambling from swap rules.
Banking (1)
- Jeonbuk Bank launched South Korea's first traditional bank loans backed by Bitcoin collateral for corporate clients. Local civil enforcement rules updated on October 1 enabled legal frameworks for seizing digital asset collateral, though third-party custodians will hold the underlying keys.
Startups (1)
- Bermuda-based insurer Meanwhile secured $37.5 million in funding from investors including Bain Capital Crypto and Sam Altman. CEO Zach Townsend reported strong international demand for Bitcoin-denominated whole life policies, which allow policyholders to borrow up to 90 percent against accumulated equity.
Agents (1)
- An AI agent operated by Varia Labs uncovered a 2015 integer overflow flaw in the XRP Ledger that could have minted 18 trillion XRP. Ripple bypassed standard validator voting to ship a closed-source binary fix, drawing criticism from CyberCapital founder Justin Bonds.
$93M Drained From Tampered Ledger Devices | THE BITCOIN BRIEF 94 • Oct 12
- A supply chain attack compromised hundreds of Ledger Nano X devices, draining an estimated $93 million across six blockchains on October 9. Victims bought devices from Malaysian reseller Crypto Billis, whose modified units bypassed Ledger genuine checks.
- Tibane Labs CEO Mark Carpelles analyzed a tampered Ledger device, revealing a cellular modem, eSIM, microcontroller, and custom antenna concealed inside. The board intercepted seed phrases directly from screen data lines and transmitted them over cellular networks.
- Q&A argues multi-vendor multi-sig custody is the only mechanism capable of surviving supply chain hardware compromises. Max cautions against putting total net worth into single asset classes or rigid setups, advocating for broader asset and device diversification.
Also discussed on this episode: (7)
Safety (1)
- Coldcard official social media and founder NVK Telegram accounts suffered security compromises, broadcasting links to a fake seed migration page. Coldcard reported credentials and offline two-factor authentication remained secure while requesting account support escalation.
Regulation (1)
- FinCEN formally withdrew proposed self-custody transaction monitoring rules requiring $10,000 threshold identity collection and dropped designations labeling international coin mixing as primary money laundering concerns. The withdrawal leaves existing sanctions and criminal prosecutions unchanged.
Privacy (2)
- Federal prosecutors are citing an appeals court ruling against Bitcoin Fog founder Roman Sterlingov to fight Tornado Cash developer Roman Storm's acquittal motion. The ruling accepted venue jurisdiction based on an undercover agent mixing $250 in Bitcoin.
- Am I Exposed released version 0.42.1 featuring pre-broadcast PSBT privacy analysis. BlueWallet added reproducible build verification and BIP-329 label importing, while CoinOS launched public testing for version 3 with Arc and Nostr integrations.
Lightning (1)
- Second patched a flaw in its Arc server implementation after an attacker stole 0.75 Bitcoin of company funds on October 5. The server failed to verify script ownership, allowing malicious key insertion to sweep funds via Lightning.
Nation-State (1)
- Mempool.space operator Wiz submitted a $227,000 community ICANN application for the dot-bitcoin top-level domain from El Salvador. The registry requires proof of infrastructure contributions and pledges 21% of gross revenue to Bitcoin open source development.
Custody (1)
- Foundation is preparing KeyOS version 1.4.1 for public release alongside internal testing of Passport Core version 2.4. The Core release introduces native MiniScript support to Passport hardware devices.
$86M Drained From Ledgers & Can AI Break Bitcoin's Crypto? | Rabbit Hole Recap • Oct 9
- Attackers drained over $83 million across Bitcoin, Ether, and Tron from Ledger hardware wallets sold by reseller CryptoBillis. Mark Karpeles noted attackers likely desoldered hardware eSIMs to transmit private keys to malicious actors.
Also discussed on this episode: (12)
BTC Markets (1)
- Bitcoin traded at $82,720 with a market cap of $1.66 trillion as block height reached 970,657. Mempool fees remained low at 3 sats per vByte despite elevated chain activity.
Protocol (3)
- Justin Drake warned that frontier AI could break elliptic curve cryptography without quantum computers, advising against address reuse. Coinbase cryptographer Yehuda Lindell dismissed the claims as speculative FUD lacking technical evidence.
- Cryptographers Jonas Nick and Mikhail Kudinov previously acknowledged ECDSA will eventually face cryptographic decay. Bitcoin researchers are proactively developing post-quantum signature schemes to replace legacy public key pairs.
- Bitcoin Red Team initiative Project Lupe identified five Core vulnerabilities using frontier AI scanning tools. Developers including Hodlnator and Sebastian patched RPC port binding flaws, data races, and silent payment issues.
Safety (1)
- A financially motivated hacker used open-source AI tools and Claude session histories to breach nine South Korean banks. The attack exposed personal financial data for over 68,000 customers, including 25,000 at Shinhan Bank.
Regulation (2)
- SEC Commissioner Hester Peirce urged policymakers to overhaul corporate KYC warehousing and the Bank Secrecy Act. Centralized identity databases mandated by financial surveillance laws create persistent target honeypots for automated AI exploitation.
- Candidate Bruce Blakeman pledged to dismantle New York state's BitLicense and end energy moratoriums. Conversely, Manhattan District Attorney Alvin Bragg and state lawmakers proposed attaching criminal liability to BitLicense compliance violations.
Energy (1)
- Dark Horse partnered with Hopkinsville Electric to fund a 65-megawatt substation within the Tennessee Valley Authority system. Dark Horse will utilize 50 megawatts while allocating 15 megawatts to stabilize local residential grid capacity.
Mining (1)
- Major mining operators are actively shifting infrastructure capacity toward higher-margin AI high-performance computing. Marty Bent anticipates this transition will flood the secondary market with cheap ASICs over the next twelve months.
Nation-State (1)
- The US government transferred roughly $1 billion in Bitcoin connected to the historic Bitfinex hack. Separately, Treasury Secretary Scott Bessent announced plans to seize $1 billion in Iran-linked crypto assets.
Adoption (1)
- Block initiated a nationwide mainstream advertising campaign across movie theaters and major sports broadcasts. The campaign aims to make Bitcoin accessible to general consumers while highlighting persistent fiat currency devaluation.
Coding (1)
- Community developers are leveraging frontier AI models to rapidly build custom video game mods and recreate complex software suites. These user-driven vibe coding tools directly threaten existing SaaS and gaming business models.