The Commoner

Monday, October 12, 2026

Sup, freaks.

Hope you freaks had a restful weekend. I can't say the same for a lot of Ledger owners in Southeast Asia.

WHAT TO EXPECT IN THIS NEWSLETTER

• Ledger confirmed an implant in a wallet sold by one of its own authorized resellers. Here's where to go if you bought one.
• A cyberattack hit refrigeration in hundreds of French supermarkets, and food went in the trash.
• CBO estimates a $1.993 trillion deficit while Treasury buys back its own bonds at a discount. Tom Luongo weighs in.
• Ukraine hit Yandex data centers. The chart behind the "bots went quiet" story doesn't establish that claim, so ask who benefits.
• France has had 77 violent attacks on crypto holders this year, and Washington is letting Russian diesel in.

Marty's Bent

Ledger Found an Implant in a Wallet Sold by Its Own Authorized Reseller

Another weekend passes and I'm reminded yet again that trusted third parties are security holes. This time the third party wasn't a bank, an exchange or a leaky email list. It was the third-party reseller that sold you the Ledger device.

On Saturday, Ledger confirmed that "one of the impacted users' devices contained an unauthorized hardware implant." The device came from CryptoBilis, a Ledger authorized reseller in Southeast Asia, and people who bought from them have been watching their wallets get emptied since Friday. In its latest update, Ledger says every confirmed case tied to the October 9 draining involves a device sold through CryptoBilis, that the number of affected devices is "limited," and that its own systems and direct sales channels remain unaffected. CryptoBilis has stopped selling hardware wallets altogether.

Nobody has a clean number on the damage yet. Galaxy's Alex Thorn estimated roughly $91 million in losses on Friday afternoon, across bitcoin, Ethereum, Tron, Polygon and Arbitrum. Bitquery's analysis, with figures marked verified October 12, estimates about $93.2 million across six chains and throws out one bitcoin collection address Thorn had counted. Ledger hasn't put a number on it. Whatever the final tally, investigators are talking about tens of millions of dollars drained from people who bought hardware wallets. The people who did what we tell everyone to do. Get a hardware wallet. Get your coins off the exchange.

Ledger needs to answer for the confidence that "authorized" badge gave its customers. People saw the Ledger badge and assumed the box went straight from Ledger's factory to their front door. It didn't. Ledger's own reseller page warns that in certain jurisdictions the "Ledger Authorized Store" on marketplaces like Amazon, Shopee and Lazada is run by a reseller, not by Ledger. Every set of hands between the factory and your desk is a trusted third party, and trusted third parties are security holes. We said it in December 2020, when Ledger's leaked customer database turned into a hit list. The following June, some of those customers got doctored "replacement" Nano X devices in the mail with a flash drive wired inside. Different attack. Same lesson.

Thomas Pacchia and I spent a good chunk of Friday's Rabbit Hole Recap on this, before Ledger confirmed the implant. My advice then is the same as my advice now: "So don't ever buy from third-party resellers." Buy direct from the manufacturer. Thomas had been thinking about restocking Foundation devices at PubKey, and as much as he loves the idea of people picking up a hardware wallet at their local pub without handing over any information, he's reconsidering whether he wants the pub in that chain of custody at all. Every extra set of hands is another place for something to go wrong.

A wallet can pass Ledger's Genuine Check and still contain a spying implant. Ledger says so on its own hardware integrity page: leave the original secure element intact and the check can miss the implant. Researchers at Tibane documented Nano X implants in devices bought on Japanese marketplaces that read your recovery words off the screen and send them out over a cellular radio while the secure element stays genuine. These were devices sold to people, not conference demos. Tibane hasn't tested a CryptoBilis device, and Ledger hasn't said how the implant it found worked. Ledger owes the people who trusted its reseller that answer.

None of this makes self-custody a mistake. There's no evidence here of a break in bitcoin's cryptography. Ledger has confirmed a physical implant in one device, and the supply chain turned out to be the soft spot. Again. Coins on an exchange are one database leak, one bank partner and one subpoena away from being somebody else's problem. Self-custody puts the keys in your hands. Buying direct reduces one supply-chain risk, but it doesn't remove every risk. A properly configured multisig wallet requiring at least two independent keys can keep one exposed key from being enough to spend your coins.

Bought a Ledger from CryptoBilis? Go to the right place:

• Haven't set it up? Don't. Ledger says leave it in the box.
• Already set it up? Move your coins to a brand new seed generated on a device you got directly from Ledger. Restoring the same seed on a new device doesn't fix anything. Treat that seed as burned.
• Start here: support.ledger.com and Ledger's ongoing issues page. Ledger also asks victims to file a report with local police. Information on the attack goes to security@ledger.com.
• Scammers are already working this. Ledger will never call you, DM you or ask for your 24 words. Anyone who does is a thief.
• Buying a new device? Buy from the manufacturer. For Ledger that's shop.ledger.com. If you use a reseller, check it against Ledger's official list, and remember it's still a third party.
• Check every device with Ledger's genuineness steps. Never use one that arrives with a PIN or a filled-in recovery sheet. And know that a passing check doesn't rule out an implant.

Bitcoin lets us hold our own money without asking a bank or an exchange for permission. Don't give that up because a reseller failed the people who trusted it. Your hardware wallet is still a computer somebody else built and shipped. Buy direct. Consider a multisig wallet that needs at least two independent keys, held on devices from different manufacturers, so one bad box can't spend your coins on its own. Or build your own signer from off-the-shelf parts. And stop handing your name and shipping address to every company that asks for it. The people draining these wallets love a customer list.

Some people want a check that doesn't involve cracking the case open. Robin Linus says it's a good idea to weigh your Ledger, and cryptographer Kostas Kryptos suggests a precision scale and a comparison against a genuine unit bought somewhere else. Ledger publishes the numbers: the Nano S Plus is 21 grams, the Nano X is 34, the Stax is 44.2 and the Flex is 57.5. Grab a scale that reads to a hundredth of a gram. If your device is off, stop and contact Ledger support before you set it up. If it matches, that doesn't clear it. Ledger co-founder Nicolas Bacca warns that weighing isn't reliable because production weights aren't guaranteed identical. Documented implants sometimes add hardware while replacing or removing original components, so added and removed weight can offset each other. If you bought from CryptoBilis, follow Ledger's instructions no matter what the scale says.

An "authorized" badge is no substitute for knowing what you bought, freaks.

SIGNAL

Somebody turned French supermarket freezers into ovens

French grocers spent Monday morning throwing out food. Coopérative U chief Dominique Schelcher confirmed a cyberattack has been hitting refrigeration in several of its stores since Sunday night. Les Mousquetaires told BFMTV 300 Intermarché and Netto stores were affected, U says fewer than 100 of its own, and E.Leclerc confirmed hits too. Les Mousquetaires says temperatures were set to 50°C. Danfoss, which makes the controllers, says most affected units are obsolete models that no longer get security updates. Paris prosecutors have opened an investigation and the attackers haven't been publicly identified. Albert Heijn and Delhaize are dealing with a separate incident in the Netherlands and Belgium, with no known link.

This is what security holes look like. Nobody thinks about the software running the freezer aisle, and that's exactly what made it a target. Hackers got into store refrigeration systems remotely and cranked up the temperature, and Danfoss says most affected controllers no longer receive security updates. That's a very low-budget way to attack a country's food supply and create chaos. Keep your own pantry stocked, freaks.

Treasury is buying back its own bonds at 51 cents on the dollar

The CBO's preliminary estimate puts the fiscal 2026 deficit at $1.993 trillion, up 12% from last year. Meanwhile, Treasury is shopping its own bargain bin. Thursday it bought back $6 billion of face value in long bonds, including $1.851 billion of a 2% bond due 2051 at about 51 cents on the dollar, after announcing in August that maximum long-bond buybacks would rise from $2 billion to at least $4 billion per operation starting September 9.

On TFTC #800, Tom Luongo told me Bessent is "picking and choosing the ones he wants that are the best value, the ones that he knows are going to lower the future and present liabilities of the United States." Retiring a dollar of debt for 51 cents does shrink what's owed on paper. But Treasury's own FAQ says buybacks can be paid for with new debt, and last week it sold 30-year bonds at a 5.618% yield. Until Washington stops spending money it doesn't have, I expect the borrowing to keep coming and the printing to follow.

Ukraine bombed Russia's search engine. Ask who benefits

Ukraine hit three Yandex data centers in four days. Yandex says its Sasovo data center was "seriously damaged in a drone attack" and shut down, part of Kaluga went out the next morning, and on Sunday Reuters reported a third, in Vladimir, was shut down too. Zelenskyy called it "our symmetrical response."

Then X decided Russian bot traffic had dropped to nearly zero. The chart going around counts automated web requests from Yandex's network, not political accounts posting on X, and researchers like Pekka Kallioniemi say it mostly reflects web crawlers. In a post Tom Luongo reposted, @ColonelTowner, a self-described retired Air Force colonel, asks a better question: why is a search engine a target at all? He says Yandex surfaces foreign reporting on NATO and the CIA that American search engines bury. The chart doesn't establish that political bots went quiet. Yandex's data centers were still hit, and its services disrupted. Ask who benefits. Bitcoin runs on machines in closets and basements all over the world, which makes it a much harder target than three buildings in Russia.

France has had 77 violent attacks on crypto holders this year

French prosecutors have recorded 77 violent attacks on people they think hold crypto this year, OCCRP reports, citing the national organized-crime prosecutor's office. That's kidnappings, home invasions and extortion, up from 67 in all of 2025 and 18 in 2024. Prosecutors say the gangs now go after people who are "little known or entirely unknown to the general public," and find them through data leaks, social media posts and phishing. In January, French reporting described a tax office employee already charged in a case involving an attack on a prison officer. She was accused of passing confidential information to criminals, and investigators reportedly found searches of crypto investors' records on her workstation. The government also warned about data leaks at crypto firms, including tax software company Waltio.

This is the 2020 Ledger hit list playing out in the real world. Force companies to collect the name, address and balance of every bitcoin holder and you've built a target list. When it leaks, the people on it pay.

Washington is letting Russian diesel back in

On Friday, OFAC issued General License 135, authorizing the sale, delivery and "importation into the United States" of Russian diesel through 12:01 a.m. EDT on April 7, 2027. It's narrow. Diesel only, and it still bars debits from U.S. accounts of Russia's central bank, finance ministry and National Wealth Fund. But the U.S. Treasury just signed a license to let Russian diesel into the country.

OFAC didn't say why it issued the license. The national average for diesel was $6.199 a gallon as of October 5, up $2.49 from a year ago. Diesel moves the trucks that move the food and runs the equipment that grows it. Those costs work their way into everything else we buy. Try selling sanctions to the people paying that bill. Treasury has already opened the door to Russia's diesel.

⚡ FREEDOM TECH CORNER

DATA SNAPSHOT

Spot price, block height and hashrate estimate: October 12, 2026, 9:21 a.m. ET. Bitcoin Lab daily series: October 11, 2026. U.S. spot ETF flows: October 9, 2026.

Sources: Kraken spot quote, mempool.space block height and hashrate, Bitcoin Lab daily metrics, and TFTC ETF flows. Daily metrics use the provider’s October 11 observation, not live intraday estimates.

Talk tomorrow, freaks.

Marty Bent · TFTC · Nostr

YouTube

Podcast