Not Your Hardware Wallet, Not Your Keys
Plus, Tether freezes $10M of the Ledger drain
gm, Defiers!
These are the biggest stories in DeFi and crypto:
- Ledger implants turned up outside CryptoBilis
- Papertrade traders lost $32.4M in two days
- ESMA set a Jan. 8 stablecoin wind-down for MiCA firms
- Citi will settle stablecoin checkout in fiat
- Robinhood reported $15B in Stock Token DEX volume
Mark Karpelès bought a Ledger in Malaysia, opened the case, and found a circuit board where the display padding should be. By his account it carries a microcontroller, an antenna, an LTE chip and an eSIM, and it reads the 24 words off the screen as the device shows them. The packaging arrived sealed. The unit passed Ledger’s Genuine Check.
Ledger’s 72-hour update said every confirmed draining case involves a device sold by CryptoBilis, a Southeast Asian reseller that changed hands in March, and that its own systems and direct sales were untouched. CZ says the hackers bought the reseller, a claim nobody has established. Ledger has confirmed an unauthorized hardware implant in at least one affected device. Bitquery puts losses above $93 million across roughly 300 wallets, and Tether has frozen $10 million of it. The perimeter keeps moving: a researcher reported an implant in a unit bought from MediaMarkt in Europe, and a second buyer has called for a recall.
This is the second time this year that holding your own keys was the thing that failed. In July, a Coldcard firmware bug that shipped in 2021 made seed phrases from affected versions guessable, and attackers swept more than 1,800 BTC across four waves. Those victims had done everything right: offline signing, steel backups, no seed ever typed into a computer.
“Not your keys, not your coins” assumes the keys are the hard part. Both incidents turned on something underneath them. Coldcard’s entropy came from code nobody caught for five years. Ledger’s attestation authenticates the secure element, so an implant seated beside it under the screen clears the check. A buyer can confirm the chip is genuine and the firmware is signed. Nobody can confirm the box is the box the factory shipped.
What self-custody has left is narrow: buy direct, generate entropy you can watch, and split keys across vendors so one supplier’s failure is not total. That last one is multisig, which almost nobody runs. In this case, the partial recovery came from outside self-custody anyway — Tether’s blacklist. The common saying is “don’t trust, verify,” but holders could have verified the seal and run the vendor’s attestation tool, and both checks would have passed.
With Love,
Cami, The Defiant founder
Read more below!
Karpelès Flags Another Ledger Implant as Company Keeps CryptoBilis Warning
Mark Karpelès flagged another implant in photos of a Ledger wallet on Oct. 12, and Ledger said the same morning that confirmed drains still involve only devices sold by CryptoBilis. A buyer posting as Johannes found implants in two Nano X wallets bought from MediaMarkt stores in Europe, the first on Oct. 11, and called for a recall. Neither wallet lost funds, but MediaMarkt is a large European retailer outside the CryptoBilis channel that Ledger's warnings cover. Ledger confirmed an implant in one victim's device on Oct. 10 and says it is reviewing reseller controls.
Papertrade Trader Losses Reach $32.4 Million Two Days After Launch
Papertrade traders lost about $32.4 million net in the two days after the HyperEVM perpetuals venue launched on Oct. 10 with $85 million deposited. Those losses made it DefiLlama's top earner for Oct. 11, at $3.78 million against Pump.fun's $2.11 million and Hyperliquid's $1.70 million. They also paid $26.3 million of PAPER staking rewards, and the traders who lost the money get none of it back. Observers alleged a trader was gaming its price feed, and Papertrade is tightening open-interest caps.
ESMA Calls for Noncompliant Stablecoin Wind-Down by Jan. 8
ESMA told national supervisors that MiCA-authorized crypto firms must end services involving noncompliant stablecoins by Jan. 8, 2027. The Oct. 8 opinion covers custody, transfers, advice and portfolio management as well as trading. In January 2025, ESMA said custody and transfers of these tokens could continue. The opinion names no coins, but Tether is not on ESMA's register of e-money-token issuers. EU clients who hold USDT at a MiCA-licensed firm will have to move or convert it, and supervisors may allow limited, time-bound services to wind those holdings down.
Citi Details Stablecoin Checkout With Coinbase and Fiat Payouts
Citi plans stablecoin checkout for Spring by Citi, its merchant payments service. Coinbase Payments accepts the stablecoins and converts them to fiat, so merchants never hold a stablecoin, and Citi settles the money to their bank accounts. Citi's payments business handles about $6 trillion a day. The launch is U.S. first, but neither company names merchants, tokens or a date. Coinbase and Gennius also plan ONED dollar services inside Latin American bank apps, starting in Argentina. Standard Chartered now offers RLUSD custody through its Dubai branch.
Robinhood Reports $15B in Stock Token Trading as Chain Passes 100 Days
Robinhood reported $15 billion of DEX volume in its Stock Tokens as Robinhood Chain passed 100 days. More than 190 tokens are live, with 200,000 holders in over 120 countries, and Morpho shows about $1.1 billion deposited on the chain. Chain-wide DEX volume fell 30% over the past week to $6.27 billion, per DefiLlama. The tokens are debt securities with no rights in the underlying shares, and U.S. persons cannot buy them. The IMF found that most tokenized equity trading happens outside regular market hours, when the stock exchanges themselves are closed.
Other Stories Worth Your Time
Ontology Restarts Mainnet After Nearly 43-Hour Security Halt — the team says the network itself lost no funds.
Derive Proposes Treasury Funding for US-Regulated Derivatives Push — the proposal leaves licensing, products and launch timing undecided.
Sui Backs DATA With $30 Million as Network Plans to Retire Its Chain — the former Story project will move from its own chain to Sui.
THORChain Fees Rebound but Remain 84% Below September Surge — The Defiant's count from Midgard data runs through Oct. 11.
Bybit Launches USDC-Funded Trading in More Than 1,000 US Stocks and ETFs — orders run through Alpaca with a 0.1% fee.
ENSv2 Activation Proposal Would Halt New ENSv1 Registrations — existing names stay, and ENS Labs' admin roles move to the DAO.
SUI Gains 54% in Four Weeks, Outpacing Bitcoin and Ether — Sui's TVL and stablecoin supply grew less than the token.
Coinbase Completes Deribit Integration for Institutional Traders — options access for U.S. Prime clients follows separately.
Liquid Bitcoin Redemptions Remain Frozen With 85.8% Reserve Coverage — peg-outs are still shut 35 days after the Elements exploit.
PeckShield Traces $3.89 Million in Ledger Theft Funds to Binance Deposits — earlier, a wallet linked to the thefts sent 464 ETH to Tornado Cash.
US Bitcoin ETFs Shed $679 Million in Weekly Reversal — most of the Oct. 5–9 withdrawals came in two sessions.
Papertrade Draws Reported $3 Billion in Positions in First Hour — the dashboard showed $10.3 million in staker rewards within hours and $18.2 million of trader losses on day one.
StarkWare Calls Starknet L1 Shift Its 'Clearest Path Forward' — STRK rose 30% in a day as Starknet weighed the move.
Aero Sets Oct. 21 Merger Launch and Token Conversion Terms — AERO rose 48% in four weeks ahead of the Velodrome merger.
Trending on The Defiant
Free newsletters
Good reporting. Delivered.
Choose your coverage: crypto and DeFi, the future of finance, or both.
Free. Unsubscribe anytime.
