$93M Drained From Tampered Ledger Devices | THE BITCOIN BRIEF 94

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.

AOB KeyOS v1.4.1 released Passport Core v2.4 internal beta testing Prepping for Freedom Fest UK and Amsterdam Max renovating the house

NEWS Hundreds of self-custody wallets belonging to Southeast Asian Ledger customers who bought their devices from CryptoBilis, Ledger's authorised reseller for Malaysia, Indonesia and the Philippines, were emptied in a coordinated sweep across six chains on 9 October, with on-chain tallies putting losses at $86M to $93M; Tether froze about $10M of the stolen USDT, and on 10 October Ledger confirmed an "unauthorized hardware implant" in one affected user's device. Mark Karpelès's Tibane Labs teardown found a hidden board inside a Nano X tapping the screen's data lines to read the 24 words during setup and send them out over its own cellular modem, never touching the secure element, so the device still passes Ledger's genuine check; CryptoBilis changed hands in March, with unverified registry screenshots showing a new owner based in China, though nobody has shown a link between the new owner and the theft. Anyone who bought from a non-direct seller should not set the device up, and anyone who already did should move funds to a new seed generated on a device bought direct -- Ledger Support (implant), Ledger Support (halt), Ledger (72-hour update), Bitquery investigation, Tibane Labs teardown, Mark Karpelès, Specter, CoinDesk, The Block, Crypto Briefing (Tether), Cointelegraph (EU report) On 11 October Coldcard said a post carrying a phishing link went out from its official X account and was deleted, telling users not to visit it and that coldcard.com is its only official site; it found no matching login or session record, says its credentials and offline 2FA remain secure, and has asked X Support to escalate, with no losses reported and no confirmation yet of how the post was published -- COLDCARD, COLDCARD follow-up, Cointelegraph, Stacker News Second says an attacker exploited a bug in its Ark server's boarding flow on 5 October, registering boards with only his own signature and then exiting them while also spending the same balances out of Second's node over Lightning, taking 0.75 BTC of the company's own liquidity; Second blocked the source within hours, briefly took the server offline and shipped a fix, with users' pre-signed exit paths unaffected, and links the attacker's coins to the 19 September Blink theft -- Second, bark MR #2612, Stacker News FinCEN filed notices on 5 October withdrawing the 2020 unhosted wallet proposal, which would have required reports on transfers to self-custody wallets over $10,000 and records over $3,000, and the 2023 finding that labelled international coin mixing a primary money laundering concern, saying it will take no further action on either; existing exchange AML rules and OFAC sanctions on specific mixers are untouched -- Federal Register (wallets), Federal Register (mixing), Coin Center, CoinDesk, TFTC On 25 September the DC Circuit upheld Roman Sterlingov's Bitcoin Fog conviction, finding that moving funds in and out of the mixer furthered its ability to launder funds for all users, enough to try him in Washington; on 5 October, the same day FinCEN withdrew its mixer rule, SDNY prosecutors cited that ruling against Tornado Cash developer Roman Storm, whose lawyers replied that Bitcoin Fog was custodial and Tornado Cash is not, with his retrial set for 26 April 2027 -- The Rage, TFTC, DC Circuit opinion ICANN's Reveal Day on 7 October published 1,615 applications for new top-level domains, including mempool.space operator Wiz's community application for .bitcoin, which proposes a restricted namespace for vetted Bitcoin builders with no auctions or premium names and 21% of gross revenue going to Bitcoin development; a rival standard .bitcoin application from Bird Pepper LLC, linked to Identity Digital, is also in the contention s