Was Ledger Hacked?
No. Ledger’s software was not broken, its security chip was not cracked, and Bitcoin itself was untouched. What happened is a physical attack on the supply chain: someone got hold of genuine Ledger hardware wallets, opened them up, hid a tiny spying device behind the screen, sealed them back up and sold them through a Southeast Asian reseller called CryptoBilis. Every confirmed case of stolen funds so far traces back to a device bought from that one seller.
The damage is serious. On-chain researchers estimate that up to $93 million has been drained from more than 300 wallets since the thefts began on October 9. Ledger confirmed the implant the following day, and Tether has reportedly frozen around $10 million of the stolen funds held in its USDT stablecoin. CryptoBilis has stopped selling hardware wallets, and Ledger says it is working with the authorities to find whoever was behind it.
If you bought your Ledger directly from Ledger, or from one of its official retail partners, there is no evidence that your device is affected. Readers who remember our Coldcard coverage in August will recognise the pattern. That was a flaw in one company’s product, and this is a problem with one seller’s stock. Neither one means self-custody is broken. Both are reminders that where your wallet comes from matters as much as which wallet you choose.
How the Spy Chip Worked
When you set up a hardware wallet, it shows you a list of 24 words on its little screen. That list, your recovery phrase, is the master key to your Bitcoin. Anyone who has it can take everything, from anywhere in the world, without ever touching your device. The whole point of a hardware wallet is that those words are created and shown on a device that never connects to the Internet, so they can never be sent anywhere.
The implant broke that promise in the simplest way imaginable. It sat behind the screen and read the 24 words as they were displayed during setup. It then sent them to the attackers over the mobile phone network, using a tiny built-in eSIM, the same kind of digital SIM card found in modern phones. In effect, the attackers gave an offline device its own secret phone line, and it called them with your recovery phrase.
Security researchers who took the tampered devices apart found two versions. In the first, the attackers swapped the original battery for a smaller one to make room for the implant. The second was neater, tucked into the foam padding under the screen and running off the original battery. Researchers said the circuit board looked professionally made rather than hand-built, which suggests this was an organised operation and not a lone tinkerer. Some of the tampered devices were sold on large online marketplaces at around half the usual price.
Why Ledger’s Own Checks Could Not Spot It
Ledger devices come with a feature called Genuine Check, which confirms that the device is real and that its secure chip has not been tampered with. On these devices it passed, because the device really was genuine and the secure chip really was untouched. The implant never interfered with anything Ledger’s software checks. It simply looked at the screen.
Ledger has said plainly that Genuine Check cannot detect an added implant if the original secure chip is intact. That is why the advice is about where you buy, not which button you press. It also applies to every brand. A Trezor, a Bitkey or any other hardware wallet bought second-hand or from an unofficial seller at a suspicious discount carries exactly the same risk, because the attack does not depend on any weakness in the wallet itself.
What You Should Do
If you own a Ledger, or any hardware wallet, and you are not certain where it came from, these are the steps worth taking:
Check where you bought it. If it came directly from the manufacturer’s own website or a listed official retailer, you are in the clear on this particular attack.
If it came from CryptoBilis, a marketplace or an unknown seller, treat it as untrusted. Do not set it up if you have not already. If you have, assume your 24 words may have been seen.
Buy a new hardware wallet directly from the manufacturer. Set it up from scratch so it creates a brand new recovery phrase. Do not restore your old 24 words onto it, because those are the words that may be compromised.
Send a small test amount first. Move $5 or $10 to an address from the new wallet and confirm it arrives before you move anything else.
Move the rest. Once the test works, transfer the remaining funds to the new wallet, and retire the old device and its recovery phrase.
Going forward, the rule is simple. Buy hardware wallets only from the company that makes them, and be wary of any deal that looks too good to be true. Half price on a security device is not a bargain. It is a warning sign.
Why Bitcoin Fell Back Towards $80,000
Bitcoin started the week just under $87,000, the same level it had failed to break through several times before, and fell to around $80,400 on October 8 before recovering to about $83,000 by Tuesday. The cause was not anything happening inside Bitcoin. It was the cost of borrowing money in the United States, which jumped to its highest level in 24 years.
The interest rate on 10-year US government bonds rose above 5.35%, and the rate on 30-year bonds reached 5.70%. Both are the highest since 2002. When the US government is offering a guaranteed return of more than 5% a year, some big investors choose that safe income over assets that pay no interest at all, and Bitcoin is one of those assets. Higher oil prices, driven by tensions in the Strait of Hormuz, added to fears that inflation will stay high.
On the same day, the minutes of the Federal Reserve’s September meeting showed that every official supported last month’s rate rise, and most expect at least one more before the end of the year. That was enough to tip a crowded market over. More than $1.1 billion of borrowed bets were wiped out in a single day, and around 95% of them were bets that the price would go up. When those positions are forced to close, they turn into automatic selling, which pushes the price down further and triggers the next batch.
Bitcoin ETFs, the funds that let people own Bitcoin through an ordinary investment account, saw about $654 million flow out over the week, including $484.9 million on October 7 alone, the biggest single-day exit since June. On the other side of the ledger, large long-term holders bought roughly 15,000 Bitcoin into the dip.
Why Rising Borrowing Costs Point Back to Bitcoin
In the short term, higher interest rates make Bitcoin less attractive to big investors, and this week showed that clearly. The longer-term picture is different, and it is the same argument we made in September.
The US government owes around $40 trillion, more than its entire economy produces in a year, and it already spends more on interest than on its military. Every rise in bond rates makes that interest bill bigger as old debt is replaced with new, more expensive debt. A government in that position has very few comfortable options, and history suggests the most likely one is creating more money to keep the bills paid. Each new dollar makes the existing ones worth a little less.
That is the slow, steady pressure that sends people looking for something whose supply nobody can increase, and Bitcoin’s 21 million cap is fixed. The Fed can raise rates to fight inflation, but it has only one lever and a lot of problems to solve with it. Weeks like this one are the cost of holding Bitcoin through that process, not a sign that the reason for holding it has changed.
Who Gets the Profit on 61,000 Seized Bitcoin?
In the UK, the High Court has made a ruling that could leave the British government holding billions of pounds of Bitcoin profit. The coins, around 61,000 of them, were seized from Zhimin Qian, who ran an investment fraud in China between 2014 and 2017. The scheme deceived more than 128,000 people, and the money was turned into Bitcoin. Qian was sentenced in a UK court in November 2025 to 11 years and 8 months.
The problem is the size of the gap. The victims lost around £600 million in total. The Bitcoin bought with their money is now worth around $5 billion, or about £3.8 billion. Mr Justice Turner ruled that the victims’ claims must be decided under Chinese law rather than English law. That matters because English law would have given victims a stronger argument for a share of the Bitcoin’s rise in value, while Chinese law is more likely to limit them to roughly what they put in.
If the ruling stands, victims could get their money back while the remaining billions stay with the UK state. The victims’ lawyers plan to appeal, with a hearing expected in 2027. It is a genuinely new problem, created by an asset that rose enormously in value while it sat in a police evidence store.
Europe Is Pushing Tether Off Its Exchanges
The EU’s markets regulator, ESMA, has given licensed crypto platforms until January 8, 2027 to stop letting European customers buy stablecoins that do not comply with the EU’s MiCA crypto rules. Stablecoins are digital tokens designed to stay worth exactly one dollar or one euro, and the biggest one, Tether’s USDT, is not authorised in the EU. ESMA did not name it, but it is the obvious target.
Customers will still be able to sell, convert or withdraw what they already hold. They just will not be able to buy more on an EU-licensed platform. Coming a week after Washington scrapped its plan to track self-custody wallets, it is another sign of how differently the US and Europe are now approaching crypto.
Strategy Slows Down as Robinhood Starts Buying
Strategy, the company run by Michael Saylor that holds more Bitcoin than any other, made its smallest purchase of the year: 250 Bitcoin for about $21.5 million, bringing its total to 848,250. In the same week it spent $192.4 million buying back its own STRC preferred shares, the high-yield product we have covered before. Put simply, it spent about nine times more supporting its own shares than buying Bitcoin.
At the other end of the scale, Robinhood bought $25 million of Bitcoin for its own company balance sheet for the first time. That is small by Strategy’s standards, but it is a sign that companies earning money from crypto are starting to hold Bitcoin themselves, rather than just selling it to customers.
Quick Hits
The UK sanctions Russia-linked crypto firms. The Foreign Office sanctioned three crypto exchanges and two payment processors, including Cryptomus, accused of helping Russia get around sanctions.
Celsius founder banned for life. Alex Mashinsky, already serving 12 years in prison, agreed to pay up to $35 million to New York and accepted a permanent ban from the crypto industry.
A darknet boss loses 1,230 Bitcoin. Raheim Hamilton, co-creator of the Empire Market darknet site, was sentenced to 40 years and ordered to give up coins worth about $101 million.
A Korean bank lends against Bitcoin. Jeonbuk Bank has become the first traditional bank in South Korea to offer business loans secured with Bitcoin.
Thailand opens Bitcoin ETFs to more investors. From October 16, Thai mutual funds can buy locally listed Bitcoin and Ether ETFs.
Binance closes its mining pool. Binance Pool and its cloud mining service shut on November 10, giving miners about four weeks to move elsewhere.
A sleeping whale wakes up. A wallet holding 4,582 Bitcoin, worth around $378 million, moved its coins for the first time in six years.
Next up: Fed Chair Kevin Warsh speaks on Friday, October 16, and markets will be listening for any hint about another rate rise. If you want that explained in plain English as it happens, make sure you are subscribed.
And Finally…
Coldcard’s own account posts a phishing scam. On October 11, Coldcard’s official X account published an “urgent” warning about a “critical seed generation issue” in its firmware, with a link to a fake migration site. The post was itself the scam, cleverly playing on the real flaw we covered in August. Coinkite says its own review found no unauthorised logins at all and has asked X to explain how a post nobody at the company made ended up on its account. If a wallet company ever asks you to “migrate” by clicking a link, don’t.
Fifteen years of patience for $4,150. A Bitcoin address that had not moved since December 2010 woke up on October 11 and sent its entire balance. That balance was 0.05 Bitcoin. Someone held a twentieth of a coin through every crash and every boom for almost 16 years, and on-chain analysts dutifully tracked where it went.
XRP’s supply cap survived on luck. The XRP Ledger disclosed and fixed an 11-year-old bug that could have created trillions of new XRP out of thin air, far beyond its 100 billion limit. It went unnoticed for over a decade mostly because nobody had tried hard enough to trigger it. Bitcoin’s 21 million cap, by contrast, is checked by every node on the network, every single block.
Quick Questions
Is my Ledger safe?
If you bought it directly from Ledger or an official retailer, there is no evidence it is affected. Every confirmed theft so far involves a device sold by CryptoBilis. If you bought yours from a marketplace or an unknown seller, move your funds to a new wallet bought direct, with a brand new recovery phrase.
Why do higher bond rates make Bitcoin fall?
When US government bonds pay a guaranteed 5% or more, some large investors prefer that safe income to assets that pay no interest, so they sell. Over the longer term, though, higher rates make the US debt problem worse, which is part of the reason people hold Bitcoin in the first place.
Does the UK government get to keep the 61,000 seized Bitcoin?
Not decided yet. The court ruled that Chinese law applies to victims’ claims, which may limit them to roughly what they lost. If that stands, the rest could stay with the UK state, but an appeal is expected in 2027.
This article is for information only. (Not financial advice.)