Issue #015 · Week of October 11, 2026

This Week’s Verdict

The threat model everyone ignored turned out to be the cheapest one: a reseller shipping pre-compromised hardware. While the industry argued about quantum apocalypse timelines, CryptoBilis was moving eight figures out of Ledger devices that looked factory-fresh. Self-custody is only as trustworthy as the supply chain it rode in on.

The Breaches

The headline number is Ledger, or more precisely the reseller CryptoBilis. Ledger confirmed an unauthorized hardware implant in at least one affected device, with on-chain investigators tracking suspected losses from $72 million to roughly $90 million depending on who is counting. The attack was isolated to a Southeast Asian reseller, which is cold comfort if you bought there. Buyers from the trailing 90 days were told to delay setup or migrate to a new device with a fresh seed, and CryptoBilis halted all hardware wallet inventory, not just Ledger’s.

The laundering was faster than the disclosure. A wallet linked to the thefts routed 464 ETH to Tornado Cash through an intermediary and four deposit wallets, keeping about 700 ETH in reserve. On Tron, stolen funds converted 2 million USDT into USDD through its stability module, stepping neatly outside Tether’s freeze controls. PeckShield traced $3.89 million of the proceeds to Binance deposits, giving investigators an exchange lead that intermediary wallets promptly muddied. Tether froze an estimated $10 million across the broader cluster. It is a tidy demonstration that freeze controls work right up until money reaches a stablecoin whose issuer does not cooperate.

Elsewhere, Liquid Bitcoin redemptions remain frozen at 85.8% reserve coverage, a roughly 603 BTC gap, with peg-outs paused pending full backing and a completed security review.

Vulnerabilities Worth Your Attention

  • XRP Ledger’s decade-old mint bug. The XRPL disclosed a flaw, fixed in xrpld 3.4.1 on Sept. 25, that could have created trillions of XRP from nothing. Developers found no evidence of exploitation on a public network. Ten years is a long time for a loaded gun to sit unfired.
  • EIP-7702 as an exfiltration path. $3.55 million in unclaimed bridge funds moved via EIP-7702 account authorizations. BlockSec notes the authorizations were valid, which does not establish whether the owner knowingly approved anything. The new account-abstraction surface is already being probed.
  • Coldcard’s X account phishing. A phishing link appeared on Coldcard’s official X account pointing to a fake migration site built to harvest recovery phrases. Coldcard found no matching login record, which raises more questions than it answers. Even the paranoid hardware crowd is a social-engineering target.
  • AnyDesk Linux pre-auth root. A working exploit is now public for a pre-authentication RCE in AnyDesk Linux, patched quietly in 8.0.3 back in June with no CVE and a changelog that called root access “a crash.” Silent patches age badly.
  • AhsayCBS miners. Two unpatched flaws (CVE-2026-105133 among them) in the AhsayCBS backup platform are being exploited to drop webshells and XMRig miners disguised as Microsoft Edge.

Threat Actors & Campaigns

No Lazarus sighting this week, but plenty of competition. The CryptoBilis supply-chain operation is the standout, combining physical tampering with a rehearsed laundering pipeline through Tornado Cash, USDD, and exchange deposits.

On the AI-abuse front, a Chinese actor used the ARTEX AI penetration suite and Claude agents against South Korean banks, while separate campaigns abused Google Ads and Bing redirects to push fake Claude installers delivering ClickFix payloads. Flax Typhoon, another China-linked group, drove five flaws into CISA’s KEV catalog, including a 10.0-scored ProFTPD bug from 2015. A credential-stealing GitHub Actions campaign compromised maintainer accounts (including the author of the 18,400-star pyxel engine) to plant malicious workflows across 340-plus repositories. The P7 DarkSword iOS exploit kit added on-device keychain and crypto-wallet theft.

On the enforcement side, the FBI arrested another suspected ShinyHunters member tied to its jobs-portal breach, Germany arrested an alleged core Qilin ransomware member, and a dual citizen pleaded guilty to running a 15,000-strong money-mule network.

The Bigger Picture

Quantum anxiety is now a product roadmap. Zcash targets hash-based signatures for January after a “bunker mode” scare, Tron claims post-quantum cryptography live on testnet, and Starknet floated becoming an L1 to pursue full quantum resistance by 2027 (the token jumped 20-30% on the maybe). Dragonfly’s Qureshi offered the sober counterpoint: asset migration is not a real fix if models break signatures, so build proactive defenses now.

Markets stayed soft. US spot Bitcoin ETFs shed $679 million on the week, a $920 million swing, with Ether ETFs extending a nine-day outflow streak and Bitcoin consolidating near $82,500 on the one-year anniversary of the 10/10 flash crash. Nobody learned much; altcoin liquidity still looks fragile.

Regulation did the heavy lifting. The CLARITY Act died in the Senate, leaving the SEC and CFTC to set market structure by rule rather than statute (a win for incumbents who can afford lawyers). The CFTC moved to fold event contracts into the swap definition while carving out casino-style wagers, teeing up a jurisdictional fight as Blockchain.com files for DCM and FCM licenses ahead of a $500 million IPO. The UK sanctioned crypto exchanges tied to Russia’s A7 network, the US telegraphed a $1 billion Iran-linked seizure, and New York secured up to $35 million and a lifetime ban from Celsius founder Alex Mashinsky. The grift gets litigated eventually; it just takes years, and by then it is already priced.

Resources

  • https://thedefiant.io/news/hacks/peckshield-traces-3-89-million-in-ledger-theft-funds-to-binance-deposits
  • https://thedefiant.io/news/security/xrp-ledger-discloses-decade-old-bug-that-could-mint-trillions
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.