Price:

Ledger theft estimate climbs above $100 million

Oct 17, 2026Summary from 3 podcasts.
  • Bankless put the Ledger wallet theft at $102 million on Oct. 16, above earlier podcast estimates of $86 million and $93 million.
  • The reported attack used hidden hardware to capture recovery phrases; Ledger said it found no evidence its own systems or direct sales were compromised.
  • The case has renewed debate over how to protect self-custodied crypto without trading one security risk for another.

The reported Ledger wallet theft is now estimated at more than $100 million, though the figures remain unreconciled. On Oct. 16, Bankless put the total at $102 million and said 324 wallets had been drained. That is higher than the $86 million David Bennett cited on Bitcoin And on Oct. 14, and the $93 million estimated by Ungovernable Misfits on Oct. 12. The accounts don’t explain whether the gap reflects expanding investigations or different methods of counting.

The reported attack targeted Ledger Nano X devices sold through Southeast Asian reseller CryptoBillis. According to Bitcoin And, a hidden LTE chip could read the 24-word recovery phrase - the backup users need to restore their wallet - as it appeared during setup, then send it to attackers. Ungovernable Misfits said former Mt. Gox chief Mark Karpelès opened a compromised device and found a cellular modem and other concealed components.

Ledger’s response, as reported by Bitcoin And, was to ask resellers in seven Asian markets to pull devices. Ledger said it had no evidence its own systems or direct sales were compromised; the episode also reported that confirmed losses involved CryptoBillis. Bankless said Ledger began investigating reported thefts on Oct. 9 and cited an update on Oct. 13.

The breach has sharpened a hard question for people who hold their own crypto: how can they trust a device before it reaches them? Bennett argued on Bitcoin And that the incident erodes confidence in self-custody. Ungovernable Misfits’ Q and A advocated spreading keys across devices from different manufacturers, while Jameson Lopp, cited on Bitcoin And, warned that moving assets to centralized custodians can create another single point of failure.

For now, the dollar total is still an estimate, and the reported compromise is tied to tampered reseller devices - not evidence that Ledger’s direct sales or core systems were breached. The broader lesson is less tidy: keeping control of the keys also means bearing more responsibility for how those keys are protected.

Source Intelligence

- Deep dive into what was said in the episodes

ROLLUP: Redtober Is Here | AI Debt Fears | $102M Ledger Attack | Richard Heart Arrested • Oct 16

  • A hardware implant in Ledger devices sold through Southeast Asian reseller CryptoBilis intercepted setup seed phrases and transmitted them to attackers; Ledger confirmed an affected device, while the hosts warn that authorized resellers and outsourced manufacturing still expose supply-chain risks.
Also discussed on this episode: (14)

BTC Markets (1)

  • David and Ryan describe a broad altcoin selloff despite Bitcoin falling only modestly; they compare the choppy conditions with early 2023, when Bitcoin stayed above its 50-week average through seven months of sideways trading.

Elections (1)

  • The hosts discuss midterm-election risk but question whether a Democratic win would materially hurt crypto, given their view that Democrats are largely focused on AI and have shown little interest in crypto legislation.

Inflation (1)

  • Ryan says September inflation exceeded expectations, with higher energy and travel costs linked in the discussion to the Iran war and the Strait of Hormuz; hotter inflation also pushed bond yields and rate-hike expectations higher.

AI Infrastructure (1)

  • AI infrastructure debt is drawing scrutiny as CoreWeave bonds fall and revenue growth at major AI firms slows; Ryan compares the funding cycle with repeated railroad booms and busts, while noting Korea’s chip-heavy market decline fed into U.S. equities.

Macro (1)

  • Ray Dalio warns that rising government and AI debt issuance could outstrip investor demand by 2027, pushing long-term yields higher and weighing on equities; he recommends hard assets, including gold and some Bitcoin, as protection against currency debasement.

Custody (1)

  • A proposed French amendment would require residents to declare self-custody wallets above a lowered threshold; the hosts argue that a government-held inventory could expose holders to physical-security risks, especially after reported breaches of French tax infrastructure.

Banking (1)

  • Bank of America received a record U.S. bank fine after failing to flag billions in suspicious transactions, while an OCC report documented debanking based on political, industry, or religious risk from 2020 to 2025; the hosts contrast corporate penalties with crypto executives’ prosecutions.

Regulation (2)

  • Richard Heart was arrested in Istanbul on an Interpol Red Notice tied to Finnish tax proceedings, not his dismissed SEC case; the hosts say Finnish authorities treated funds he described as gifts as taxable, while Hex supporters remained active after his arrest.
  • Elizabeth Warren warned that a proposed $45 billion McCormick-Unilever merger could raise grocery prices because one company could control Hellmann’s, McCormick spices, Cholula, and Frank’s RedHot; the hosts joked that her target was comparatively small.

Markets (1)

  • Paper Trade offers synthetic Hyperliquid-linked positions up to 1,000x leverage; liquidated traders receive non-transferable PAPER, which they can stake to earn liquidation fees, creating a house-like role for users who lose their positions.

Protocol (2)

  • Solana’s planned upgrades target 150-millisecond settlement and replace on-chain vote transactions with validator-to-validator certificates; separately, Starknet’s community poll strongly favored exploring a move from Ethereum L2 status to a standalone L1.
  • Mert joined the Near Foundation Council, which David reads as a technical endorsement of Near’s privacy work and a potential fit with Zcash; the hosts note that Starknet already uses its own Cairo language and is not an EVM chain.

Models (1)

  • David says Venice’s sharp rise in DeepSeek-model usage likely reflects a large API customer, possibly drawn by privacy; he treats daily token consumption as a proxy for product adoption and revenue, while making clear that the customer explanation is speculation.

Privacy (1)

  • Sponsor reads promoted Near.com’s cross-chain trading and privacy features, Ripio’s local-currency stablecoins, Bankless’s searchable AI archive, and a weekly DeFi market-analysis show; these were promotional claims rather than independent findings.

Hex The Heart | Bitcoin News • Oct 15

  • Ledger announced the $850 Adam hardware device featuring post-quantum encryption and AI agent approvals, scheduled to ship in summer 2027. The launch followed reports that Asian reseller Crypto Billis distributed compromised devices containing malicious implants.
  • David Bennett alleges Ledger manufactured or capitalized on news of compromised devices as a psychological marketing tactic to sell expensive new hardware. He urges users to abandon Ledger for open-source hardware wallet alternatives like BitBox.
Also discussed on this episode: (8)

Regulation (3)

  • Turkish authorities detained Hex and PulseChain founder Richard Hart in Istanbul under an Interpol red notice issued by Finnish authorities for tax evasion and assault. Police seized firearms, cash, and electronics during the operation.
  • The UK adopted the OECD Crypto-Asset Reporting Framework, requiring domestic exchanges to collect user names, birth dates, tax numbers, and physical home addresses starting January 2026. The first annual tax reports are due to HMRC by May 31, 2027.
  • Executive director Patrick Witt stepped down from the White House crypto council to return to the private sector, leaving the advisory body unstaffed. Witt previously advocated for the Digital Asset Market Clarity Act, which stalled in the Senate.

Privacy (1)

  • David Bennett argues that binding public Bitcoin wallet addresses to physical home addresses exposes crypto holders to physical home invasions and extortion. He contends centralized tax authorities lack the security needed to prevent catastrophic database breaches.

Russia (1)

  • Russia's central bank added state-controlled Sberbank to its register of authorized digital currency exchanges and depositories. The move expands institutional crypto trading under a legal framework effective September 1.

BTC Markets (1)

  • Rising US core CPI pushed Bitcoin below $81,000 as broad risk-off sentiment triggered over $951 million in global crypto liquidations. Asian stock indices plummeted alongside tech equities following persistent inflation figures.

Coding (1)

  • Developer Brandon Thomas used Anthropic's Claude Opus 5.5 model to build open-source, clean-room clones of Microsoft Word, Excel, and PowerPoint written in Rust. The tools parse native Microsoft file formats without direct code duplication.

Safety (1)

  • More than 400 computer scientists published an open letter demanding that cyber-capable AI models be air-gapped by default to prevent autonomous exploits. The effort highlights growing containment concerns as commercial AI systems leak out of sandbox testing environments.

Bank of Money Laundering | Bitcoin News • Oct 14

  • Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to pull its wallets while it investigates implants that steal recovery phrases. Ledger says confirmed losses involved CryptoBillis, a Southeast Asian reseller; it has no evidence its own systems or direct sales were compromised.
  • Trezor said it found no evidence of compromised devices and is reviewing its vendors after the Ledger incidents. David Bennett supports buying wallets directly from manufacturers and views reseller exits as a step that could deepen distrust of self-custody.
  • David Bennett said the Ledger scare followed a separate CoinKite security failure and recommended Unchained for people seeking a custody alternative, citing its multisignature service. He argued that exchange and ETF providers could benefit when wallet users lose confidence in self-custody.
Also discussed on this episode: (11)

Inflation (2)

  • September inflation exceeded forecasts, and Stephen Alfer's CoinDesk report said markets began pricing a possible October Fed hike after earlier expectations favored a pause. David Bennett attributed Bitcoin's decline to the inflation report and rising Treasury yields.
  • The inflation news lifted Treasury yields and weighed on stocks, metals, and Bitcoin; oil rose while natural gas and most agricultural commodities fell. The episode placed Bitcoin at $81,740 and described a sharp decline in silver and broad losses across major equity indexes.

BTC Markets (2)

  • David Bennett reported Bitcoin's market capitalization, supply, network backlog, and hash rate alongside the price. He said hash rate had moved above one zettahash per second, which he took as evidence against a mining death spiral.
  • K33 argued Strategy's preferred-stock financing carried dividend costs that could have funded more Bitcoin purchases, while David Bennett said the analysis lacked insight into Strategy's internal considerations. Bennett's own view was that investors should buy Bitcoin directly rather than Strategy shares or preferred stock.

V4V (1)

  • David Bennett argued that value-for-value podcasting is held back by user friction, not by the model itself: listeners often will not act even when apps make payment easy. He expects value-for-value and advertising to coexist, and said podcast apps still lack useful alerts for boosts to older episodes.

Custody (1)

  • David Bennett disclosed that BitBox sponsors the show and that he uses its wallet, distinguishing that paid endorsement from Circle P businesses he promotes without having tried every product. He said listeners should research the wallet themselves.

Adoption (3)

  • David Bennett promoted Bitcoin Beans' Colombian cacao and described cacao as nutrient-dense; he also said ancient Mesoamerican communities used fermented cacao beans as currency. The product is sold as pure cacao for Bitcoin, with a discount code.
  • Vagabond's Colorado merchant guide lists more than 300 businesses that accept Bitcoin, but visits showed adoption remains uneven. Moonflower Coffee enabled payment through Square, while Butcher Block Cafe accepts Bitcoin only at its Washington Street location; Vagabond said another location does not yet accept it.
  • Vagabond said Fifth House Coffee's owner refused Bitcoin despite the business appearing on a Bitcoin merchant map and using a Square terminal. David Bennett endorsed walking away from merchants who dismiss potential Bitcoin customers, arguing that consumers should take their business elsewhere.

Banking (2)

  • The U.S. Treasury fined Bank of America over alleged anti-money-laundering and sanctions failures, including risks tied to China and the southwest border. David Bennett contrasted the bank's financial penalty with criminal cases against Tornado Cash developers and argued the fine would not change the bank's incentives.
  • BNY and Citadel Securities completed a Treasury repo workflow using a tokenized Treasury note, recording the asset on BNY's private ledger and settling it within minutes. The note then served as collateral for an overnight repo, illustrating how tokenized securities could speed institutional settlement and financing.

Ledger's $86 Million Wallet Scare | Bitcoin News • Oct 12

  • Hardware wallet maker Ledger confirmed an unauthorized physical implant in devices distributed by Southeast Asian reseller CryptoBillis. David Bennett emphasizes that the supply chain attack compromised physical devices rather than Ledger's core software or random number generators.
  • Security incidents have ignited industry debates over whether exchange-traded funds offer safer custody than hardware wallets. Plan B defended converting holdings to ETFs in 2025, while Jameson Lopp warned that rushing assets into centralized vehicles creates single points of failure.
Also discussed on this episode: (5)

Stablecoins (1)

  • The Financial Stability Board warned that uncoordinated national regulations expose severe vulnerabilities in global stablecoins during potential liquidity runs. Bank of England Governor Andrew Bailey urged international financial authorities to establish cross-border information sharing protocols before market distress hits.

Regulation (1)

  • The Commodity Futures Trading Commission proposed defining event contracts tied to sports and politics as swaps under its exclusive jurisdiction. Chairman Michael Selig asserted authority over platforms like Kalshi and Polymarket, while explicitly excluding traditional casino gambling from swap rules.

Banking (1)

  • Jeonbuk Bank launched South Korea's first traditional bank loans backed by Bitcoin collateral for corporate clients. Local civil enforcement rules updated on October 1 enabled legal frameworks for seizing digital asset collateral, though third-party custodians will hold the underlying keys.

Startups (1)

  • Bermuda-based insurer Meanwhile secured $37.5 million in funding from investors including Bain Capital Crypto and Sam Altman. CEO Zach Townsend reported strong international demand for Bitcoin-denominated whole life policies, which allow policyholders to borrow up to 90 percent against accumulated equity.

Agents (1)

  • An AI agent operated by Varia Labs uncovered a 2015 integer overflow flaw in the XRP Ledger that could have minted 18 trillion XRP. Ripple bypassed standard validator voting to ship a closed-source binary fix, drawing criticism from CyberCapital founder Justin Bonds.

$93M Drained From Tampered Ledger Devices | THE BITCOIN BRIEF 94 • Oct 12

  • A supply chain attack compromised hundreds of Ledger Nano X devices, draining an estimated $93 million across six blockchains on October 9. Victims bought devices from Malaysian reseller Crypto Billis, whose modified units bypassed Ledger genuine checks.
  • Tibane Labs CEO Mark Carpelles analyzed a tampered Ledger device, revealing a cellular modem, eSIM, microcontroller, and custom antenna concealed inside. The board intercepted seed phrases directly from screen data lines and transmitted them over cellular networks.
  • Q&A argues multi-vendor multi-sig custody is the only mechanism capable of surviving supply chain hardware compromises. Max cautions against putting total net worth into single asset classes or rigid setups, advocating for broader asset and device diversification.
Also discussed on this episode: (7)

Safety (1)

  • Coldcard official social media and founder NVK Telegram accounts suffered security compromises, broadcasting links to a fake seed migration page. Coldcard reported credentials and offline two-factor authentication remained secure while requesting account support escalation.

Regulation (1)

  • FinCEN formally withdrew proposed self-custody transaction monitoring rules requiring $10,000 threshold identity collection and dropped designations labeling international coin mixing as primary money laundering concerns. The withdrawal leaves existing sanctions and criminal prosecutions unchanged.

Privacy (2)

  • Federal prosecutors are citing an appeals court ruling against Bitcoin Fog founder Roman Sterlingov to fight Tornado Cash developer Roman Storm's acquittal motion. The ruling accepted venue jurisdiction based on an undercover agent mixing $250 in Bitcoin.
  • Am I Exposed released version 0.42.1 featuring pre-broadcast PSBT privacy analysis. BlueWallet added reproducible build verification and BIP-329 label importing, while CoinOS launched public testing for version 3 with Arc and Nostr integrations.

Lightning (1)

  • Second patched a flaw in its Arc server implementation after an attacker stole 0.75 Bitcoin of company funds on October 5. The server failed to verify script ownership, allowing malicious key insertion to sweep funds via Lightning.

Nation-State (1)

  • Mempool.space operator Wiz submitted a $227,000 community ICANN application for the dot-bitcoin top-level domain from El Salvador. The registry requires proof of infrastructure contributions and pledges 21% of gross revenue to Bitcoin open source development.

Custody (1)

  • Foundation is preparing KeyOS version 1.4.1 for public release alongside internal testing of Passport Core version 2.4. The Core release introduces native MiniScript support to Passport hardware devices.