News linked to both this project and an event.
Odaily reports: Bitcoin News posted on X platform that former Mt. Gox CEO Mark Karpelès accused Ledger of failing to adequately alert customers to sophisticated hardware implants after learning of the relevant threat as early as March 2026, and of burying related warnings in Ledger Academy articles. Karpelès stated that evidence of mass-produced, self-aligning implants should have triggered a highest-level alarm response. After Ledger CEO Pascal Gauthier responded by referencing his Mt. Gox experience, Karpelès fired back, saying he had trusted Ledger to learn from his failures and do better than he did. Karpelès also criticized Ledger for continuing to downplay the incident and questioned its communication with affected customers.
According to CoinDesk, blockchain analytics firm Chainalysis disclosed on Thursday on X that a cryptocurrency scammer who profited from a "task scam" (luring victims with paid review boosting or order brushing, then demanding account top-ups under the guise of a "negative balance") transferred the illicit proceeds to three Ledger hardware wallet addresses. These addresses were subsequently drained by attackers, resulting in a total loss of 60 BTC valued at over $4.9 million, making it one of the biggest victims in this Ledger device intrusion incident.
Odaily News: On-chain analyst Murphy posted on X that during the recent BTC decline, the scale of BTC transfers to exchanges by short-term holders (STH) increased significantly, with an average of approximately 2,200 BTC transferred per hour within a 4-hour window, reaching the fourth-highest level since the market rally began in August this year. However, the transfer peak on October 15 was already lower than that of October 8, indicating that the potential selling pressure from short-term holders has somewhat weakened.In contrast, long-term holders (LTH) transferred only about 480 BTC per hour to exchanges during the same period, roughly one-fifth of that of short-term holders. Murphy noted that on October 8, long-term holders had a transfer peak of approximately 3,700 BTC per hour, which may have been partly related to asset transfers triggered by a hardware wallet security incident. However, considering that both long-term and short-term holders showed large-scale transfers on that day and BTC prices fell rapidly, actual selling pressure still existed in the market.Murphy believes that during the current decline, those transferring BTC to exchanges are primarily short-term holders, while long-term holders remain relatively stable overall, and the transfer intensity of short-term holders has weakened compared to before, reflecting that the BTC holder structure still possesses a certain degree of resilience.
Odaily reports: Bitcoin News posted on X that Citizen Lab researchers have discovered the first publicly documented case of mercenary spyware being delivered through targeted online advertising, in which malicious code can initiate infection once an ad loads, without the user needing to click or download anything. The campaign is called "AdFection." At least 45 Al Jazeera devices were targeted between 2024 and 2025, and the operation has been linked to Israeli advertising company Discover-Tech and spyware vendor Candiru.After analyzing approximately 4 billion ad bidding records, researchers found that Discover-Tech's ads had appeared on nearly 200,000 websites and apps worldwide, but ad exposure does not necessarily lead to infection. Discover-Tech previously conducted business through major ad networks, including Google, and was removed after the investigation.
— In the theft incident involving crypto hardware wallet manufacturer Ledger, one of the biggest victims was also a scammer, who lost over 60 BTC worth approximately $4.8 million. The funds in question came from a task scam: participants were hired to fake sales and reviews for real products. A "negative balance" then appeared, and participants were told they had to put in their own funds in order to get paid. On September 22, the operator behind the scam transferred the proceeds to 3 separate Ledger addresses. On October 9, thieves emptied these 3 addresses, each transferring funds to the same wallet via a single transaction. The receiving wallet has been reported as being involved with stolen funds.
Odaily News: According to Bitcoin News monitoring, in the Ledger supply chain attack, attackers do not need to immediately steal users' Bitcoin. @MagicalTux explained that the implanted program can transmit users' seed phrases to the attacker, who can then wait for users to accumulate more Bitcoin before emptying their wallets.
According to on-chain investigator vxdb, the Gamdom platform was targeted in a security attack. Preliminary data indicates that attackers stole approximately $2.2 million worth of assets across EVM-compatible chains, including Ethereum, BSC, Polygon, Arbitrum, and Optimism. Additionally, the Solana network suffered losses of around $965,000, while the TRON and Bitcoin networks each lost approximately $375,000 and $668,000, respectively. The total value stolen across all chains now exceeds $4.2 million.
Bitcoin News posted on X that Mark Karpeles has launched a webpage to document reported cases of Ledger hardware implants, compiling cases he has reviewed and verified through public reports and images shared on X. The database also allows users to submit new cases to track the potential scope of the ongoing Ledger supply chain security incidents.
Odaily News: According to Bitcoin News monitoring, Bitcoin News released a podcast in which former Mt. Gox CEO Mark Karpelès and Foundation CEO Zach Herbert discussed the largest supply chain attack in crypto industry history. Mark Karpelès stated that he discovered the spy implant 3 weeks before the funds were stolen and contacted Ledger, but received no response. The implant had a built-in hidden cellular modem that could directly read the seed phrase on the screen and passed Ledger's own checks; even setting a passphrase could not prevent the seed phrase from being stolen. Mark Karpelès said that with $5 million, he could create an implant that would only be detectable through X-ray. The episode also discussed the hardware wallet reseller model, the Malaysian reseller behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The episode timeline shows that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.
Odaily News: According to monitoring by Bitcoin News, German Ledger user @jayr_crypto reports receiving another forged letter this week. The letter impersonates Ledger, claiming that new regulations require users to register a Bitcoin wallet through a service called ZenLedger by October 31. The letter uses Ledger's official branding elements, references German financial regulators, and includes a QR code that directs users to a so-called mandatory registration process. The user believes that addresses exposed in a previous data breach are being used to conduct targeted attacks against Ledger users. In the same week, Ledger coordinated with MediaMarktSaturn to suspend sales of its hardware wallets across a European retail network spanning 11 countries and more than 1,000 stores. It was previously reported that Ledger devices purchased from European retailers were found to contain malicious spy implants. Ledger separately confirmed that compromised devices sold by a distributor in Southeast Asia contained implants capable of stealing recovery phrases and transmitting them via cellular networks. Ledger has not yet confirmed that European devices were compromised. Ledger users are currently facing physical supply chain tampering and targeted phishing attacks exploiting home addresses. Do not scan suspicious QR codes or enter recovery phrases.
TRON founder Justin Sun recently gave an exclusive interview to Bonnie Blockchain, making it rare for him to open up about his personal upbringing and industry judgments. Sun revealed that at age nine, he was sent to boarding school by his parents, who later divorced, forcing him to live independently from that point onward. He summarized this experience as "extreme loneliness is also a form of freedom"—while most people do not truly make decisions for themselves until they are 18 or even 30, he began doing so at age nine. This premature independence shaped the underlying mindset behind his later audacious moves, such as paying $6.2 million for an absurdly priced banana, signing deals with Moon, and bidding on a lunch with Warren Buffett. Sun issued a warning regarding Quantum Threat Day (Q-Day), stating that if quantum computers crack Satoshi Nakamoto's early public keys, approximately one million BTC could be unlocked, delivering a catastrophic impact on the market—a risk he believes Wall Street and institutions like BlackRock have severely underestimated. While the Bitcoin community has been slow to upgrade, TRON has already deployed NIST post-quantum cryptography standards on its testnet. Sun also established the "Justin Sun Award," offering up to $1 million in rewards through a vulnerability bounty model for major mathematical breakthroughs, open to both humans and AI, with OpenAI already securing one of the top prizes.
According to monitoring by CryptoQuant analyst nocoffeenobrain, coins with a holding age of 1–3 years and over 3 years began showing signs of activity as early as late September, coinciding with BTC prices rising from the mid-$70,000 range to the mid-$80,000 range. Following the recent Ledger hack, which prompted numerous users to migrate assets to new signing devices and replace their seed phrases, the 7-day moving average is expected to climb further over the next few days. The analyst noted that a similar pattern occurred previously: during January to February this year, when BTC dropped from $90,000 to the mid-$60,000 range, and between July and August while BTC consolidated around the mid-$60,000 range, both of these holding age cohorts exhibited synchronized activity.
Odaily News: According to monitoring by Bitcoin News, well-known hardware security researcher and computer engineer Joe Grand (social media account @joegrand, also known as "Kingpin") stated that in August 2025, a man in Thailand contacted him, claiming to have discovered a compromised Ledger Nano X. The man had previously purchased a cheap Ledger device online to replace the battery in his existing device. After taking the device apart, he found that it contained a smaller battery, unauthorized circuitry, extra wiring, and an antenna. After the man posted his findings on Reddit, he reportedly did not receive much attention from local police, and subsequently contacted Grand to launch an investigation. This discovery came more than a year before the Ledger supply chain attack sparked major public controversy this week; according to reports, nearly $100 million in cryptocurrency was stolen this week.
According to K33 Research, the US government transferred approximately 17,733 BTC to Coinbase Prime this week, including 12,267 BTC linked to the Bitfinex hack incident. Following the transfer, the government’s tagged holdings decreased from 324,527 BTC to 306,795 BTC. If untagged suspected government wallets are included, the total BTC transferred to Coinbase Prime reaches approximately 21,500. Analysts believe this transfer is highly likely a custody operation rather than a liquidation—Coinbase Prime has served as the custodian for the US Marshals Service since 2024. Coins associated with the Bitfinex case remain in the claims process, with the Department of Justice requiring restitution to victims in BTC; the no-sale order for the Strategic Bitcoin Reserve also only applies to fully confiscated assets. Additionally, roughly 1,200 BTC originating from FTX and HashFlare were transferred simultaneously and may be disbursed to victims in cash through compensation channels. Notably, the completion of the transfer of approximately 15,000 Bitfinex-claim-related BTC within two days suggests that a distribution plan or relevant rulings may be advancing.
Odaily News: According to Bitcoin News monitoring, the attacker behind the Ledger supply chain theft has moved nearly 3,000 ETH through Tornado Cash in three separate transactions, and transferred the funds into the Zcash privacy pool before converting them to USDC. Investigator @YFarmX stated that despite the use of privacy tools, they have traced 108 transactions completed through Zcash by exact value matching. An estimated $2.85 million in stolen USDC is still held in 3 wallets, and Circle may be able to freeze the related funds. Meanwhile, Tether is reported to have frozen $10 million in stolen USDT; wallets associated with the attacker still hold approximately $38.6 million in ETH and $16.9 million in BTC.
Odaily News: According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update fixing vulnerabilities that could allow malicious nodes to steal funds. The most severe vulnerability involves Lightning channel reconnection. According to Bitcoin Optech, malicious nodes could falsely claim they did not receive previously confirmed channel updates. The vulnerable LDK software could then sign conflicting commitment transactions without properly recording the relevant transactions, allowing attackers to reclaim Bitcoin after forwarding payments are completed. LDK versions 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.
据 QCP Group 市场报告，BTC 在经历去年 10 月最大单日清算事件一周年后表现相对稳健，尽管市场对美国政府转移大量 BTC 及 Ledger 遭黑客攻击的消息有所担忧，价格仍维持区间震荡。BTC 多次冲击 87,000 美元未果，但下方 80,000 美元支撑较为稳固。期权市场方面，隐含波动率维持高位，看跌期权溢价收窄，市场整体偏向等待突破而非防御性布局；若 BTC 有效突破 87,000 美元，下一目标位或指向 94,000 美元。 值得关注的是，市场存在一笔较大规模的 10 月 30 日到期 90,000/95,000/100,000 美元看涨蝶式期权多头头寸，为当前月末最大持仓集中点。本周宏观面将迎来关键考验，周三（10 月 14 日）美国 CPI、周四（10 月 15 日）PPI 数据相继公布，周五（10 月 16 日）美联储主席 Warsh 将在 IMF-世界银行年会发表讲话，市场目前对 10 月加息的概率定价约为 17%，上述数据及政策信号或成为 BTC 方向选择的重要触发点。
Bitcoin News posted on X platform that, according to reports, the first Ledger Stax hardware wallet found to contain an unauthorized hardware implant is capable of transmitting users' seed phrases to attackers. The suspected modification includes a Nordic nRF9151 4G/LTE cellular modem, which may be used to transmit stolen seed phrase data and does not exist in genuine Ledger devices; additional unauthorized components were also installed next to the modem. A cable runs across the battery and connects to an antenna hidden inside the back cover.
According to a post by Bitcoin News on X, Ledger stated that the number of affected devices is limited, and as of now, all confirmed cases related to the October 9 fund theft incident involve devices sold through Southeast Asian distributor CryptoBilis. Ledger's internal systems and direct sales channels were not affected. CryptoBilis has suspended all hardware wallet sales, and Ledger is cooperating with law enforcement and contacting affected customers. Ledger advises CryptoBilis buyers not to initialize unused devices; users who have already completed initialization should transfer their funds to a new wallet using a new seed phrase. The investigation is still ongoing.