Special Report. Two custody and market-rails stories for the week ahead.
1. Ledger confirms a hardware implant in a reseller-sold device
Ledger said Saturday that one affected user’s device contained an unauthorized hardware implant. The update came from @Ledger_Support at 1:09 p.m. Eastern. Ledger said it is reaching out to impacted users as its investigation continues.
The probe started Friday. In an Oct. 9 statement, Ledger said it was investigating reported losses among users in Southeast Asia who bought devices from CryptoBilis, a reseller. Ledger asked CryptoBilis to pause all sales and shipments of Ledger devices. News reports describe CryptoBilis as an authorized reseller in Indonesia, Malaysia and the Philippines.
Ledger said it has no indication that its security infrastructure, systems or services have been compromised, per @Ledger_Support replies on Saturday. Ledger has confirmed one implanted device. It has not said how many devices were affected or how the implant got there.
Loss figures are not from Ledger. On-chain researchers tanuki42 and Specter published thief addresses with losses above $86 million. Blockchain data firm Bitquery, in a tally verified Oct. 11, counts $93.2 million taken from 315 wallets across six chains, mostly USDT on TRON. Bitquery says Tether froze $10.0 million. Ledger has not confirmed any of these totals.
Independent research adds context but not proof. Tibane Labs examined two Nano X units with suspected implants that could read the recovery words shown during setup, ForkLog reported. Those units were not shown to come from CryptoBilis.
What Ledger advises. If you bought from CryptoBilis in the last 90 days and have not set up the device, do not set it up. If you already set it up, consider moving assets to a new Ledger signer with a new recovery phrase. Never share your 24 words with anyone, including people claiming to be Ledger.
Basic custody hygiene.
- Buy hardware wallets only from the maker’s official store or resellers it lists by name.
- Run the device’s built-in authenticity check through the official Ledger Wallet app before loading funds.
- Be wary of a device that arrives with a recovery phrase already printed or set up.
- Generate your own seed on the device, and keep it offline.
The key point is the supply chain. A hardware wallet is only as trusted as the path it took to your hands.
2. XRPN debuts on Nasdaq Monday
Evernorth’s closing 8-K, filed Oct. 9 at 4:25 p.m. Eastern, names Monday, Oct. 12 for Nasdaq trading. Class A shares trade as XRPN. Warrants trade as XRPNW. As of Sunday morning, Oct. 11, EDGAR shows no newer Evernorth filing.
The filed facts:
- The Armada merger closed Oct. 9.
- About 80.3% of shares with redemption rights cashed out, about $195.39 million in total.
- The XRP lots filed at closing add up to about 389 million XRP. Evernorth projected about 473 million on Oct. 1.
- Each XRPNW warrant lets the holder buy one Class A share at $11.50.
What to watch on day one. First prints for XRPN and XRPNW. Trading volume against a float thinned by heavy redemptions. Any first holdings update or press release from Evernorth. Any fresh SEC filing, such as a Form 4 or a resale prospectus.
The trust angle holds. Evernorth’s XRP now sits inside a Nasdaq-listed company that reports to the SEC. Monday shows how the market prices that wrapper. Background: Westen’s Evernorth close piece.
This is reporting, not investment advice. Hardwire Crypto makes no price calls.










