The Hardware Wallet Attack That Passed Every Check, Core 32 Slips, and Bitcoin Holds $80K

The Attack That Passed Every Check

On Friday, October 9, Ledger said it was looking into reports of drained wallets. By the next day it had found the cause. "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant," the company said. Every confirmed case so far involves devices sold through CryptoBilis, a reseller serving Indonesia, Malaysia and the Philippines. Ledger says its own systems and direct sales were not compromised, and that the number of affected devices appears limited.

What the implant did. Ledger has not explained how the implant worked. Independent researchers who opened affected devices, including Mark Karpelès and the firm Tibane Labs, describe a small added circuit that watched what the screen displayed and which buttons were pressed. That is exactly what happens during setup, when a new wallet shows its 24-word seed phrase. One version carried its own cellular modem and eSIM to send the words out. The devices reportedly sold for nearly half the normal price.

Why the usual check didn't catch it. Ledger's Genuine Check proves that the device's secure chip is authentic. The implant left that chip untouched and sat between it and the screen, so the check came back clean. Ledger's own support pages say Genuine Check cannot detect added hardware when the secure chip is intact. Reports also say the shrink wrap could look untouched.

How much was taken. On-chain analysts put the total at $86 million to $93 million from more than 300 wallets across Bitcoin, Ethereum, Tron and other networks. Bitquery later raised its estimate to about $102 million. Ledger has not confirmed a figure. CryptoBilis suspended sales. Ledger told its authorized resellers not to restock returned devices, OneKey ended its relationship with CryptoBilis, and Trezor said it will end some reseller authorizations from January 1, 2027.

A second attack, the same target. On Sunday, October 11, Coldcard's official X account posted a fake warning about a "critical firmware vulnerability" in its Mk4, Mk5 and Q devices, with a link to a phishing site. It copied the firmware version numbers from July's real seed-generation flaw to look convincing. Coinkite says it found no sign that its own systems were breached and believes the access came through X itself. The only way to lose money was to type a seed phrase into that site.

Both attacks went after the same thing: your 24 words, at the one moment you might hand them over. The practical lessons are old ones, and this week proved them again.

Buy hardware wallets from the maker's own store. A discount from a reseller you don't know is the warning sign, not the bargain.

If you bought a Ledger from CryptoBilis, don't set it up. If you already did, Ledger's advice is to move your funds to a new seed on a device bought directly from Ledger.

No real update, support agent or security alert will ever ask for your seed phrase. Not on a website, not in a direct message, not on a call.

Confirm security news on the maker's own website, not from a social media post, even one from an official account.

If you do move to a new seed, do it calmly. Send a small test amount first, check it arrived, then move the rest. Rushed migrations cause real losses of their own.

Under the Hood: Core 32 Slips, Difficulty Jumps

An update on Bitcoin Core 32.0. Last week we reported that the final release was targeted for October 10. It did not ship that day. As of Bitcoin Optech's October 16 newsletter, a fourth release candidate is in testing and no new date has been given. A slipped date is normal for node software that thousands of people rely on, and testers finding problems before release is the process working. We covered what is in version 32 in issue #031. When it does ship, download it only from bitcoincore.org and verify the signatures before you upgrade.

Mining difficulty rose about 5.9%. At the difficulty adjustment on Friday, October 16, mining got about 5.9% harder, to roughly 140.6 trillion. Blocks had been arriving about every 9.5 minutes instead of 10, with the network's hash rate near 1 zettahash per second. By CryptoTicker's count it is the third-largest increase of 2026, after February's 14.7% and June's 7.2%. For miners it means roughly 5.6% less bitcoin earned per unit of computing power, in a month when the price has gone sideways. The next adjustment is expected around October 30.

LayerTree: a million users, one coin. On October 15, Lightning Labs published a design called LayerTree, written by its CTO Olaoluwa Osuntokun. It would let up to about a million people share a single on-chain UTXO, each with their own balance and keys. Any user could leave in one transaction, on their own, and the operator could not take their funds or block the exit. Some members could also receive Lightning payments without staying online. The catch: it depends on new script features, such as OP_CAT and OP_CHECKSIGFROMSTACK, that Bitcoin does not have and that would need a soft fork. None is scheduled. It is a blueprint, not a product, but it takes on a real question: how millions more people could hold their own Bitcoin when block space is limited.

Two Lightning bugs, already fixed. Two denial-of-service bugs were disclosed in Eclair, a Lightning node implementation. In version 0.14.0 and earlier, a stream of channel-opening requests could exhaust a node's memory and crash it. Both were fixed in version 0.14.1 in July. The Phoenix wallet, which runs on Eclair, was not affected. If you run Eclair yourself, make sure you are on 0.14.1 or later. It is the same pattern we described last week: bugs found, fixed quietly, and disclosed once users have had time to upgrade.

Hot Inflation, and Bitcoin Holds $80,000

The September consumer price index, released Wednesday, October 14, showed prices up 3.7% from a year earlier. That is up from 3.4% in August and above the 3.6% economists expected. Core inflation, which leaves out food and energy, rose to 2.6%. Gasoline alone rose 9.1% in the month, and AAA put the national average at $4.33 a gallon. Producer prices, released the next day, rose 1.3% in September alone and 6.3% from a year earlier, according to the Bureau of Labor Statistics. After the CPI report, markets put the chance of another rate hike at the Fed's October 27 to 28 meeting at about 50%, up from about 20%, according to Capital Economics. The Fed raised rates in September for the first time since 2023.

Bitcoin's low of the week came on Thursday, October 15, during an AI-led sell-off in tech stocks. It touched about $79,720, its lowest level since September 18, before climbing back above $82,000. It closed Friday at about $82,046, down roughly 0.6% for the week. Stocks tied to Bitcoin moved far more than Bitcoin did: on Friday, Strategy shares fell about 9.6% and Coinbase about 5.8%, while the Nasdaq dropped about 2.1%.

Spot Bitcoin ETFs had net outflows of about $228 million for October 12 to 16, after about $679 million left the week before. With hot inflation, Brent crude above $100 a barrel and growing odds of another hike, Bitcoin spent its second week in a row near $80,000 and has not broken down.