Ledger Probes CryptoBilis Wallet Drains Topping $86 Million

Hardware wallet maker Ledger is investigating fund losses among Southeast Asian users who bought devices from reseller CryptoBilis, an official partner in Indonesia, Malaysia and the Philippines. Onchain researcher Specter estimated the suspected thefts at more than $86 million, tracing funds to addresses on Bitcoin, Ethereum and Tron.

Ledger asked CryptoBilis to pause all sales and shipments, and told anyone who bought from it in the last 90 days not to set up their device. Owners who already did should consider moving assets to a new Ledger signer with a fresh seed, its support account posted.

The cause remains unclear and the figures are unverified, while researcher tanuki42 separately traced more than $72 million to suspected theft addresses and urged victims to contact SEAL 911. Specter first cited hundreds of victim wallets, then clarified that the true number of affected wallets is not yet known.

Former Mt. Gox CEO Mark Karpeles asked affected users to photograph their device circuit boards to reveal tampering, linking the reports to an issue he was already probing. Binance co-founder Changpeng Zhao pointed to a supply chain attack through one vendor, adding that self-custody comes with extra responsibilities.

XRP Ledger Patches 2015 Bug That Could Mint XRP

The XRP Ledger patched a flaw dating to 2015 that could have let an attacker create spendable XRP from nothing, breaking the token's fixed 100 billion supply. Researcher Cayden Liao and Veria AI reported it on September 22, and developers shipped the fix in xrpld 3.4.1 on September 25.

The attack abused the ledger's built-in exchange, where hundreds of accounts offering tiny token amounts for outsized XRP sums would be paid in full by one payment that overflowed the count. The method needed only a few hundred XRP, and RippleX found no sign of exploitation on public networks.

CFTC Issues Two Rules Splitting Prediction Markets From Gambling

The Commodity Futures Trading Commission issued two measures that would formally define event contracts on sports, politics, culture and weather as swaps under federal law. A proposed rule widens the swap definition, while an interim final rule, effective on publication, carves out sportsbook wagers and casino games.

Chairman Michael Selig called event contracts commodity derivatives under the agency's exclusive jurisdiction, a stance that would shield Kalshi and Polymarket from state gambling regulators. Both measures carry 30-day comment windows, while a court split pitting the NFL against Kalshi has already drawn the Supreme Court's attention.

French Panel Backs Stablecoin Tax, Rejects Budget 31-3

France's National Assembly Finance Committee adopted an amendment treating swaps of crypto into MiCA-regulated stablecoins as taxable sales from January 1, 2027, plus another extending the exit tax to households holding more than €800,000 in crypto. It then rejected the budget's entire revenue section by 31 votes to 3.

That vote sends the floor debate opening October 13 back to the government's original text, so backers must table the amendments again before the October 20 vote. Gains on swaps would face France's 31.4% flat tax, and a third amendment lets French crypto investors carry losses forward 10 years.

Data of the Day

A batch of 100.02 BTC mined in July 2010 moved for the first time in 16 years, worth about $8.3 million at roughly $83,000 per coin against around $29 when mined. The transaction split the coins into 10 BTC and 90.02 BTC outputs sent to two new bc1q addresses.

The holder paid a fee of 1,467 satoshis, about $1.22, and both outputs remained unspent with nothing onchain identifying the owner or showing a sale. Between August 16 and 26, six dormant wallets moved 553.59 BTC, about $40 million, extending a run of Satoshi-era awakenings.

More Breaking News

• Kalshi is investigating three early wagers on Katie Zacharia as Trump's press secretary, placed at 1% odds and set to pay about $9,600 on the prediction market.
• Crypto ETFs turned red in October, as spot bitcoin funds lost a net $386.3 million and Ethereum ETFs shed $635 million amid a nine-day outflow streak.
• Tokenized commodities hit $5.55 billion in market value by March, up from $1.43 billion, as Paxos Labs, Theo and EnSub push lending and oil onchain beyond gold-backed tokens.
• Bessent expects the US to seize $1 billion in Iran-linked crypto this week, saying "we know where it is," after July sanctions froze $130 million in USDT.
• Blockchain.com applied for two CFTC licenses to run its own US event contracts and crypto derivatives venue, joining 11 firms that filed for prediction market licenses this year.
• New York secured a settlement worth up to $35 million from ex-Celsius CEO Alex Mashinsky, who also accepted a permanent industry ban while serving a 12-year prison sentence.
• Visa found 46% of APAC consumers likely to use stablecoins within five years versus 16% in the past year, though only 6% understood how stablecoins work.
• Base's Jesse Pollak expects tokenized equities to lead a tokenization supercycle, with 50 stocks on Base drawing $70 million to $100 million in daily tokenized stock volume.
• Thailand's SEC issued crypto ETF rules effective October 16, initially limited to bitcoin and ether, barring margin loans and requiring locally licensed custodians for Thai crypto funds.