The Daily Ledger: 10 October 2026

Subject: The implant sat beside the chip, not inside it
Preview: Ledger confirms a hardware implant in a drained device sold through a Southeast Asian reseller, what that means for tamper checks, plus an XRP Ledger bug disclosure and a Coinbase stablecoin deadline in Europe.

THE DAILY LEDGER

10 October 2026
Ledger confirms tampering in a CryptoBilis device, the XRP Ledger discloses a minting flaw, and Coinbase sets a European stablecoin deadline.

Reporting window: 9 October 2026, 00:00 UTC to 10 October, 20:00 UTC (22:00 Europe/Stockholm). Data cutoff: 20:00 UTC on 10 October, later than our usual 06:00 UTC so that this issue can include Ledger's Saturday confirmation. Prices are CoinGecko 00:00 UTC snapshots. This issue was published retrospectively on 16 October 2026 to fill a gap in the archive; it uses only information available at the cutoff.

How to tell if a hardware wallet has been tampered with stopped being a theoretical question on Saturday. Ledger confirmed that a drained device bought through CryptoBilis, a reseller in Southeast Asia, contained an unauthorised hardware implant. The lesson: a genuine chip can sit inside a compromised device.

1. The Day in Numbers

• Bitcoin: $82,564 at 00:00 UTC, up 1.1 percent against the previous day's 00:00 UTC snapshot. CoinGecko daily series.
• Ether: $2,485.70, up 0.5 percent on the same basis.
• Fear and Greed: 64, Greed, up 5 points from 59. Alternative.me daily reading stamped 00:00 UTC.
• Bitcoin market value: $1.659 trillion at the same snapshot.

2. How to tell if a hardware wallet has been tampered with

On Friday Ledger said it was investigating lost funds among CryptoBilis buyers. It asked the reseller to pause sales, told buyers from the past 90 days not to set devices up, and told those who had to move assets to a new Ledger with a new recovery phrase. On Saturday, Ledger Support said that "one of the impacted users' devices contained an unauthorized hardware implant".

Ledger did not describe how the implant works. The fullest account comes from former Mt. Gox chief Mark Karpelès, who posted photos of a unit he says he bought in Malaysia. He described a hidden board with an LTE mobile data module and an eSIM that recognises the setup screen and sends the recovery words out as text. He has not said his unit came from CryptoBilis.

That design sidesteps two standard checks. Generating your own phrase on the device still stops the older pre-seeded scam, but the words then appear on the screen, which is what a display-reading implant watches. Ledger's Genuine Check proves the secure element, the chip that holds the keys, is genuine. Ledger's buying guide, updated 18 September, says it cannot detect physical modifications such as spying implants if that original chip is intact. And Ledger's security lab calls tamper seals trivial to clone.

So the honest answer is that you often cannot tell from the outside without opening the casing and risking damage. What you can control is the route the device took. Buy from the manufacturer or a listed authorised reseller and treat a device whose history you cannot trace as untrusted. Our entry on spotting a counterfeit hardware wallet covers pre-seeded fakes. CryptoBilis buyers should follow Ledger's advice: new device, new phrase. Fresh addresses under the old phrase would not help, because the attacker may hold it.

The losses are estimates, and they disagree. Investigator Specter put them above $86 million (CoinDesk). Arkham-flagged addresses held about $71.5 million on Friday (Gizmodo). YFarmX estimated $93.4 million and Bitquery about $92.9 million (Bitcoin.com). Ledger has confirmed neither a total nor a victim count.

3. Today's Headlines

XRP Ledger discloses a decade-old minting bug

A disclosure published on 9 October describes an integer overflow, a sum too large for its counter that wraps round to a small number, in the payment engine. It could have created spendable XRP beyond the total supply. The emergency xrpld 3.4.1 release fixed it, skipping the usual validator vote (Crypto Briefing), and developers found no evidence of exploitation.

Coinbase sets a 30 October stablecoin deadline in Europe

European Economic Area customers holding USDT, PYUSD, DAI and other stablecoins without MiCA authorisation have until 30 October to withdraw them, CryptoTicker reports; leftovers will be converted to USDC. That is well inside the three months ESMA allowed on 8 October.

4. Security Note

Evergreen reminder: after a large theft, recovery offers follow. The FTC describes scammers who target people who have already lost money and promise to get it back for a fee paid first. Anyone asking for an upfront payment or your recovery phrase to "trace" stolen coins is running a second scam. Our note on whether stolen crypto can be traced and recovered explains what genuine tracing can do.

5. From the Academy Library

Use our crypto wallet security checklist before funding a new device, and the cold storage and hardware wallet guide for backups and device replacement.

A hardware wallet moves your trust from a computer to a device. The device's journey to you is part of that trust.

Disclaimer: This publication is for education and information only. It is not financial, investment, legal, tax, or security advice.

Sources and further reading

• Bitcoin.com: Ledger confirms hidden hardware implant in affected user's wallet, 10 October 2026
• CoinDesk: Ledger investigates potential wallet tampering, 9 October 2026
• Gizmodo: Arkham balances and Mark Karpelès's implant photos, 9 October 2026
• Ledger: best practices to securely buy a Ledger signer, updated 18 September 2026
• Ledger Donjon: device genuineness and attestation
• XRPL.org: vulnerability disclosure report for xrpld 3.4.1, 9 October 2026
• Crypto Briefing: XRP Ledger discloses overflow bug, 10 October 2026
• CryptoTicker: Coinbase delists USDT and DAI for EEA customers on 30 October
• FTC: refund and recovery scams
• CoinGecko: bitcoin daily price and market value series
• CoinGecko: ether daily price series
• Alternative.me: Fear and Greed daily readings