Ledger Hack Contagion Fears Spread
Plus, Ledger says the implants send recovery phrases over LTE
gm, Defiers!
These are the biggest stories in DeFi and crypto:
- MediaMarktSaturn pulled Ledger in 11 countries
- Anza set Solana's Alpenglow switch for Oct. 21
- DRW and Marex traded a bond-index swap on Canton
- MNX listed futures on OpenAI and Anthropic
- Kalshi's $3.9B days were 70% parlays
Ben Yorke bought a Ledger Flex at Singapore's airport in late June and left it in his desk. He never plugged it in. When reports of tampered Ledgers spread this week, he sent it to Mark Karpelès, the former Mt. Gox chief executive who has been opening suspect devices. Karpelès found a spy implant inside. The seller, Metapod, appears in Ledger's own reseller directory.
Some background for anyone who has not followed the story. Ledger makes hardware wallets, small devices that keep a crypto owner's 24-word recovery phrase offline. On Oct. 9, Ledger asked CryptoBilis to halt sales after buyers from that Southeast Asian reseller lost funds. Bitquery, a blockchain analytics firm, now counts $102.0 million taken from 324 wallets. Today MediaMarktSaturn, the German electronics chain, removed Ledger products from its stores and websites in all 11 of its countries. How far has the problem spread in four days?
On Oct. 10, Ledger confirmed an implant in one victim's device. The next day, a buyer posting as Johannes reported an implant in a Nano X from a MediaMarkt store in Germany. On Oct. 12, he found the same hardware in a second one. In last night's issue, I wrote that "the perimeter keeps moving." Today it moved again, to a third sales channel and another country. Trezor also began cutting its own reseller network.
Ledger's security team says the implant reads the recovery phrase off the screen during setup and sends it over a mobile network. It leaves the secure chip and the software untouched, so Genuine Check, Ledger's test of that chip, still passes. A retailer therefore has no software test that clears its shelves. The only check is to open each device, and Ledger's guide warns that opening a Flex or Stax can damage it. A store cannot prove a sealed box is clean without breaking the seal, and an opened box no longer sells as new.
Two facts should stay apart. Every confirmed loss still traces to CryptoBilis, and none of the three devices found elsewhere has lost funds. Ledger says it is reviewing the reports from other devices and locations. If those devices carry the same implant, the problem sits before the shop counter, in the supply chain that feeds several resellers at once. Trezor's letter to partners says the resellers it drops lose authorization on Jan. 1, 2027, and may sell their remaining stock until then. Shops Trezor has chosen to drop will keep selling its wallets for 80 more days.
Read more below!
As of 20:14 UTC, Oct. 13. Data: CoinGecko, Aave, Hyperliquid. Full list
MediaMarktSaturn Pulls Ledger Products Amid Tampering Reports
MediaMarktSaturn pulled Ledger products from its stores and websites in all its markets, and Ledger says it agreed to the pause. The trigger was one German customer's implant report, with no funds lost. Neither company has announced a recall, refund or replacement for wallets already sold. Ledger points buyers outside CryptoBilis to its hardware-inspection guide and recommends qualified technicians for Flex and Stax models. Its instruction to move funds to a new device with a new recovery phrase still covers only CryptoBilis buyers, so MediaMarkt customers have no formal step to take.
Anza Sets Oct. 21 for Solana’s Alpenglow Mainnet Upgrade
Anza scheduled Solana's Alpenglow upgrade for mainnet on Oct. 21 at about 10:50 a.m. ET. It replaces TowerBFT, and finality, the point after which a transaction cannot be reversed, falls from about 12.8 seconds to roughly 150 milliseconds. Validator votes move out of blocks into direct messages, which frees blockspace and lowers reported transaction counts without any drop in user activity. Validators must run an Agave 4.3.0 client, and Firedancer is not supported during the migration. Indexers that group data by slot must change their code before the switch.
DRW and Marex Execute Bond-Index Swap on Canton
DRW and Marex executed a total return swap on Canton through Derivnex, referencing a tokenized version of the iBoxx USD Liquid Investment Grade bond index. Both firms now work from one shared record of valuations and lifecycle events, a process that normally runs across several systems with constant reconciliation. Margin, collateral and payments stay offchain for now. The firms disclosed no notional or maturity. ISDA counted $1.6 trillion of margin collected on uncleared derivatives at the end of 2025, the flow DRW's Don Wilson wants on the same record next.
MNX Launches Futures on AI Lab IPOs and Revenue
MNX went live with futures on the valuations of OpenAI, Anthropic, DeepSeek and Moonshot AI, plus a contract on OpenAI and Anthropic's combined 2027 revenue. Trades settle onchain on MegaETH in USDM, with up to 3x leverage on the valuation futures, and U.S. users are excluded. Without an IPO by the end of 2027, settlement falls back to private rounds, fund marks and finally an operator-set value. The same day, 21Shares listed an Anthropic product in Vienna priced off Binance's Anthropic perpetual, so a regulated European security now takes its price from a crypto derivatives market.
Parlays Drive Kalshi’s $3.9 Billion Trading Days, Analysis Finds
Kalshi traded about $3.9 billion in notional volume on both Oct. 10 and Oct. 11, and parlay-style combos made up about 70% of it, per Bitcoin.com's analysis. Notional volume counts each contract at its full $1 payout, so a cheap combo adds as much volume as an expensive single bet without equal spending. A combo pays only if every leg wins. Also on Tuesday, Blockchain.com applied to the CFTC to run an exchange and hold customer funds for U.S. futures, options and prediction markets, with no launch date.
Other Stories Worth Your Time
DOJ Announces Two Arrests in North Korean ‘Laptop Farm’ Crackdown — agents seized about 187 devices; an Ohio indictment describes crypto transfers.
APT Gains 51% in Four Weeks, Outpacing Bitcoin and Ether — JUP also rose 51% over the same span, while Jupiter's fees fell.
Robinhood Opens Social Trading Feed to Eligible US Customers — eligible U.S. customers can share charts and portfolios.
Base Introduces Earn & Borrow With Aave and Morpho — apps on Base can route users into Aave and Morpho lending markets.
cirBTC Borrowing on Morpho Tops $190 Million as Arc Liquidity Tightens — the main Arc market has about $5 million left to borrow.
Avalanche Highlights KSD Links Ahead of Korea’s 2027 Tokenization Rollout — Korea's securities depository plans a phased rollout from February 2027.
UK Court Rules Chinese Law Governs Victims’ Claims to 61,000 Bitcoin — final entitlements to the seized bitcoin remain undecided.
Mezo Sets Oct. 13 Bridge-Out Deadline for swBTC and USDe — Zest also set Oct. 23 for users to exit aeUSDC on Stacks Market V1.
StarkWare Launches Shadow Accounts on Starknet — apps can keep DeFi positions apart from main wallets; positions stay public.
Interactive Brokers Launches Ethereum Staking Through Zerohash — combined fees are capped at 30% of staking rewards.
Mysten Reports Sui's First Native Quantum-Safe Devnet Transaction — ML-DSA-65 accounts remain off on testnet and mainnet.
Metaplanet Plans ¥52 Billion Bond Sale to Refinance Bitcoin Loans — the bonds repay bitcoin-backed loans and fund buybacks while total debt rises.
Autheo’s THEO Plunges 92% After Suspected Bridge Exploit on Base — the project told users not to trade or bridge THEO.
Sanctioned A7 Announces USDT-to-SWIFT Payment Service — the service runs into OFAC sanctions and a proposed FinCEN transfer ban.
Trending on The Defiant
Free newsletters
Good reporting. Delivered.
Choose your coverage: crypto and DeFi, the future of finance, or both.
Free. Unsubscribe anytime.
