News linked to both this project and an event.
Odaily News: According to Bitcoin News monitoring, the attacker behind the Ledger supply chain theft has moved nearly 3,000 ETH through Tornado Cash in three separate transactions, and transferred the funds into the Zcash privacy pool before converting them to USDC. Investigator @YFarmX stated that despite the use of privacy tools, they have traced 108 transactions completed through Zcash by exact value matching. An estimated $2.85 million in stolen USDC is still held in 3 wallets, and Circle may be able to freeze the related funds. Meanwhile, Tether is reported to have frozen $10 million in stolen USDT; wallets associated with the attacker still hold approximately $38.6 million in ETH and $16.9 million in BTC.
Odaily News: According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update fixing vulnerabilities that could allow malicious nodes to steal funds. The most severe vulnerability involves Lightning channel reconnection. According to Bitcoin Optech, malicious nodes could falsely claim they did not receive previously confirmed channel updates. The vulnerable LDK software could then sign conflicting commitment transactions without properly recording the relevant transactions, allowing attackers to reclaim Bitcoin after forwarding payments are completed. LDK versions 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.
据 QCP Group 市场报告，BTC 在经历去年 10 月最大单日清算事件一周年后表现相对稳健，尽管市场对美国政府转移大量 BTC 及 Ledger 遭黑客攻击的消息有所担忧，价格仍维持区间震荡。BTC 多次冲击 87,000 美元未果，但下方 80,000 美元支撑较为稳固。期权市场方面，隐含波动率维持高位，看跌期权溢价收窄，市场整体偏向等待突破而非防御性布局；若 BTC 有效突破 87,000 美元，下一目标位或指向 94,000 美元。 值得关注的是，市场存在一笔较大规模的 10 月 30 日到期 90,000/95,000/100,000 美元看涨蝶式期权多头头寸，为当前月末最大持仓集中点。本周宏观面将迎来关键考验，周三（10 月 14 日）美国 CPI、周四（10 月 15 日）PPI 数据相继公布，周五（10 月 16 日）美联储主席 Warsh 将在 IMF-世界银行年会发表讲话，市场目前对 10 月加息的概率定价约为 17%，上述数据及政策信号或成为 BTC 方向选择的重要触发点。
Bitcoin News posted on X platform that, according to reports, the first Ledger Stax hardware wallet found to contain an unauthorized hardware implant is capable of transmitting users' seed phrases to attackers. The suspected modification includes a Nordic nRF9151 4G/LTE cellular modem, which may be used to transmit stolen seed phrase data and does not exist in genuine Ledger devices; additional unauthorized components were also installed next to the modem. A cable runs across the battery and connects to an antenna hidden inside the back cover.
According to a post by Bitcoin News on X, Ledger stated that the number of affected devices is limited, and as of now, all confirmed cases related to the October 9 fund theft incident involve devices sold through Southeast Asian distributor CryptoBilis. Ledger's internal systems and direct sales channels were not affected. CryptoBilis has suspended all hardware wallet sales, and Ledger is cooperating with law enforcement and contacting affected customers. Ledger advises CryptoBilis buyers not to initialize unused devices; users who have already completed initialization should transfer their funds to a new wallet using a new seed phrase. The investigation is still ongoing.
Odaily News: The LBTC-to-Bitcoin redemption operation on Bitcoin sidechain project Liquid Network has been suspended for 35 days. As of October 11, 2026, the project maintains an 86% support rate. Attackers previously exploited a vulnerability in the Elements software to steal nearly 4,000 Bitcoins, of which approximately 3,400 have been returned. The wallet still holds 598.5 Bitcoins, worth $49.69 million.Blockstream rejected the attackers' demand for a 10% bounty and demanded the immediate return of the remaining Bitcoin. Liquid Network stated that an independent external security audit of Elements v23.3.4 is underway, and the Liquid Federation has simultaneously updated the PAK list and placed all redemption keys in cold storage.There is currently no specific date for resuming redemption operations. Some LBTC holders have migrated funds through applications such as Sideswap and Sideshift.ai. One user reported that due to insufficient liquidity, the migration took several weeks, with spreads and fees totaling approximately 5%. (Bitcoin.com News)
PaperTrade posted on X stating that trading volume in the first 6 hours after launch exceeded stock market trading volume; one day after launch, PaperTrade has become a trading platform supporting 1000x leverage, with liquidity pool (LP) size reaching $5 million and $25 million in rewards distributed to staking users.In response to community concerns about the fair launch mechanism and BTC/ETH market manipulation, PaperTrade stated that due to the need to prevent frontend congestion and spam request attacks, small orders cannot enjoy exactly the same priority as large orders, and the team has maximized fairness within these constraints. Some users exploiting the Hyperliquid BBO mechanism to manipulate BTC/ETH was not an oversight in mechanism design, but rather resulted from opening a higher OI cap during the initial launch period to alleviate queuing pressure. As traffic has declined, the team has begun tightening position limits at both the on-chain and relay levels to reduce the profit space for manipulation.PaperTrade added that no system can completely eliminate manipulation, and the goal is to make attacks nearly unprofitable through parameter adjustments, noting that in the relevant incidents, some users ultimately returned most of their profits to the platform due to persistent manipulation attempts.
Odaily reports, according to monitoring by Bitcoin News, @0xJohannes stated that a Ledger hardware wallet purchased from an official European reseller several weeks ago was found to contain an unauthorized spy implant device. Suspicious wiring not present in genuine Ledger hardware was discovered inside the device, indicating it may have been physically tampered with before being sold. The implant appears to be an older version, as newer versions typically conceal the components behind the screen. Funds in the affected device have not been stolen thus far. Suspected cases have currently been reported in Asia, South America, and Europe. If the original secure element remains intact, Ledger's Genuine Check software cannot detect unauthorized physical modifications.
Odaily reports: Hyperliquid News has disclosed that ETH's trading volume over the past 24 hours has surpassed BTC, reaching approximately $1.1 billion. Analysts suggest that this increase in ETH trading volume may be related to a recent incident in which PaperTrade was allegedly exploited through its mechanism, and the associated trading activity may have driven up demand for ETH in the market.Community user boblob previously disclosed that two wallets were suspected of actively "attacking" the PaperTrade platform, using trades worth approximately $20 million to briefly trigger a small fluctuation in ETH price on the Hyperliquid platform (about 10-20 basis points), and established a "9-figure" long position on PaperTrade. boblob further added that there are clear issues with the current protocol that need to be fixed as soon as possible, otherwise it could affect the protocol's long-term sustainability.Crypto trader Rune pointed out that PaperTrade's official documentation has in fact already disclosed that its pricing mechanism carries an "attack" risk, noting that the main risk at the protocol level lies in the use of Hyperliquid's order book BBO (Best Bid and Offer) for price manipulation. This risk involves unresolved price manipulation pathways, contract economic mechanisms and risk exposure control, as well as operational-level protective measures and permission management mechanisms.
Odaily reports: Bitcoin News posted on X that hardware wallet manufacturer COLDCARD stated its official X account had published a fake security advisory directing users to a phishing website disguised as a wallet migration guide; the post has been deleted, but no corresponding login, session, or access records were found. COLDCARD said its credentials and offline two-factor authentication remain secure, leading it to suspect that the attacker may have obtained X platform-level or administrator privileges, and it has asked X's security team to investigate urgently. The company also mentioned unverified reports of X administrator accounts being sold on darknet markets, but has not yet found a connection to this incident.
Odaily reports: Bitcoin News posted on X platform that Ledger has confirmed at least one affected user's device contained an unauthorized hardware implant, and is currently investigating the matter with relevant authorities and SEAL_911. Hardware wallet reseller CryptoBilis has suspended sales of all hardware wallets. Ledger stated there is currently no indication that its internal security infrastructure, systems, or services have been compromised. Ledger advises users who purchased devices from CryptoBilis and have not yet completed setup to refrain from doing so; users who have already completed setup should consider generating a new seed phrase and transferring their Bitcoin to a new hardware wallet. Ledger also stated it is developing additional tamper-proof protections.
according to on-chain analyst Yu Jin's monitoring, an address received 263 ETH from Tornado Cash yesterday, then swapped it for approximately 643,000 USDC and deposited it into Hyperliquid.The address opened a 40x leveraged cross-margin short position on 305.5 BTC, with a position size of approximately $25.38 million, an average entry price of $83,068, and a liquidation price of $84,088. The current unrealized profit is about $160,000. The source of the address's funds involves Tornado Cash, but it cannot yet be confirmed whether it is related to hacker activity.
According to monitoring by Galaxy's head of research, in the Ledger CryptoBillis attack incident, approximately $72.9 million remains in addresses controlled by the attacker, involving Bitcoin, Ethereum, and USDT; $3.1 million entered Tornado Cash, while the remaining funds have been bridged across chains, swapped, or layered and transferred through relayers.
According to Odaily, citing Galaxy's head of research, the losses from the Ledger CryptoBillis supply chain attack currently amount to 213.42 BTC, approximately $17.7 million. Of this, 92% of the funds were held for less than 90 days at the time of consolidation, while some funds were held for longer periods. All traced Bitcoin remains unspent and is stored in 3 consolidation addresses.
Odaily News: According to monitoring by Galaxy's head of research, the Bitcoin losses caused by the Ledger cryptocurrency supply chain attack currently amount to 213.42 BTC, valued at $17.7 million. Of this, 92% of the funds were transferred in less than 90 days ago, while some funds were transferred even earlier. All Bitcoin traced so far remains unspent and is held in 3 aggregation addresses.
Bitcoin News posted on X platform stating that corporate records for Malaysian hardware wallet distributor CryptoBilis show that, as of August 3, an individual named Jiaming, with a registered address in Heilongjiang Province, China, holds 100% of the company's shares. The company's former co-founder confirmed that CryptoBilis completed its acquisition in March, with the original owner withdrawing from all operational, managerial, and administrative roles. The founder has been unable to learn about the company's operations since the handover but still assists with event coordination. This information emerged during an investigation into a suspected supply chain attack on Ledger hardware wallets, where affected devices were implanted with hidden components that could steal seed phrases; there is currently no conclusive evidence linking the change in CryptoBilis ownership to the compromised wallets.
According to Onchain Lens monitoring, the suspected hacker behind the reported $90 million Ledger reseller incident has deposited 430.2 ETH, worth $1.07 million, into Tornado Cash through 4 wallets. After Tether froze the related funds, the hacker swapped USDT for USDD through SUN.io and USDD's PSM, with some funds also flowing into Binance hot wallets.The hacker's wallet tracked by Arkham currently holds a total of $70.6 million in assets, including 11,406 ETH worth $28.35 million; 213.371 BTC worth $17.65 million; 13.646 million USDD worth $13.65 million; and 10.909 million USDT worth $10.91 million. Onchain Lens is calling on Binance to investigate these transfers and freeze accounts associated with the stolen funds as soon as possible.
Odaily News — According to monitoring by Bitcoin News, former Mt. Gox CEO Mark Karpelès may have inadvertently triggered a coordinated transfer of funds across multiple wallets after publicly disclosing physical tampering with Ledger devices equipped with hidden surveillance implants. On October 8, Karpelès warned that counterfeit or tampered Ledger devices with hidden SIM cards were being sold on the market, and these SIM cards were capable of transmitting stolen seed phrases. The implants were reportedly able to intercept data sent to the device screen, thereby capturing the recovery phrases displayed to users during wallet setup. Such devices could allegedly still pass Ledger's official genuine product verification, because the original secure element remained intact and the verification process was unable to detect unauthorized physical modifications. One emerging speculation is that attackers collected seed phrases from affected devices and waited to simultaneously transfer funds from multiple wallets. Karpelès's warning reportedly received approximately 90,000 views, which may have made the attackers aware that their operation had been exposed and prompted them to move the stolen funds. Karpelès stated that one affected Ledger device he examined came from Malaysia, was packaged in intact shrink wrap, and had an implant hidden beneath the screen. The suspected attack path is currently a compromised hardware supply chain rather than a vulnerability in cryptographic algorithms. The connection between Karpelès's warning and the subsequent wallet fund transfers has not yet been confirmed, nor has it been verified whether the same batch of implants was responsible. If the relevant circumstances are confirmed, the incident would demonstrate that even if a device is certified by the manufacturer, compromised hardware can still undermine users' self-custody security.
Odaily News: Bitcoin fell to $80,350 on Thursday before rebounding, climbing back above $83,000 at the Friday U.S. stock market open and subsequently fluctuating around $82,500. The rolling 24-hour cryptocurrency liquidation amount had previously exceeded $1 billion. Despite news circulating that Ledger hardware wallet users' funds were stolen, the crypto market has not yet shown significant selling pressure.Analysts suggest that before the U.S. CPI data is released on October 14, Bitcoin may remain range-bound, with the main trading range between $81,300 and $86,500, and could repeatedly test $84,000. The market is also watching whether Bitcoin can hold the key level of $82,500 before the weekly close. (Cointelegraph)
Ledger Support posted on X platform stating that it is currently investigating a theft of assets involving Southeast Asian users, who had purchased devices through reseller CryptoBilis. Ledger has asked CryptoBilis to suspend sales and shipments, and recommends that users who purchased devices through this reseller within the past 90 days refrain from initializing their devices; users who have already completed setup should create a new Ledger signing device using a new mnemonic phrase and transfer their assets to a new wallet.On-chain investigator Specter previously estimated that this incident has led to the theft of hundreds of wallets across Bitcoin, Ethereum, and Tron networks, with losses exceeding $86 million. Security researcher tanuki42 previously estimated losses had exceeded $72 million and stated that the amount is still increasing. Currently, the specific cause of the incident and whether the affected devices have security vulnerabilities remain to be investigated and confirmed.