An $86M crypto heist!

Ledger is investigating $86M in crypto stolen from wallets sold through a Southeast Asian reseller. A supply-chain attack is one possible explanation. Plus: Mashinsky gets a lifetime ban from New York too. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ SPONSORED BY Friday, October 9, 2026 Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen Ledger is investigating reports that more than $86 million in crypto may have been stolen from hundreds of wallets linked to devices sold by CryptoBilis, a Southeast Asian reseller — though the losses and connection have not been independently verified. One possible explanation is a supply-chain attack in which devices were tampered with before reaching customers, giving an attacker access to a pre-generated recovery phrase. Ledger has asked CryptoBilis to halt all sales and shipments and advised recent buyers not to set up their devices; customers who already activated wallets should consider transferring funds to a new device with a newly generated recovery phrase. Read more → A message from eCash Bitcoin hasn't shipped a meaningful upgrade since Taproot in 2021. So on October 31, Bitcoin's 18th birthday, it's being hard forked. eCash (ECX) is a Bitcoin hard fork that activates Drivechains (BIP300/301): opt-in sidechains for payments, privacy, and prediction markets. Same ledger, same addresses, same SHA-256 proof of work, plus the upgrade Bitcoin never merged. If a sidechain succeeds, Bitcoin miners earn new fee revenue. If it fails, L1 is unaffected. At the fork block (~973,728), every self-custodied BTC address is credited ECX 1:1, no claim, no sign-up. Your BTC stays on Bitcoin, untouched. Beta is live now, with 7 pools mining and a community already shipping new wallets, explorers, and trackers, unprompted. Holding BTC in your own wallet? You're in. See how the fork works Policy CFTC moves to fold event contracts into swaps regulations as legal fight rages The CFTC issued one rule and proposed another Friday to formally classify prediction market event contracts — like those on Kalshi and Polymarket — as swaps under federal jurisdiction, placing them outside the reach of state gambling regulators. The agency simultaneously carved out casino-style gambling from the swap definition. TD Cowen's Jaret Seiberg called it a move designed to improve the CFTC's position in court, where several federal appellate rulings have already gone against the agency in its battle with states that want oversight authority. The Supreme Court may ultimately settle it. 3-minute read → Policy New York AG secures up to $35 million and lifetime crypto ban from Celsius' Alex Mashinsky New York AG Letitia James secured up to $35 million from former Celsius CEO Alex Mashinsky and a permanent ban from the securities, commodities and cryptocurrency industries — on top of the 12-year federal prison sentence he's already serving for fraud. The settlement requires Mashinsky to forfeit $10 million in ill-gotten gains or pay New York $25 million, plus a further $10 million if he fails to serve his full sentence. Celsius customers have recovered more than $3.4 billion through bankruptcy proceedings since the lender collapsed in 2022. 1-minute read → Know someone who should be reading this? Share this newsletter See all of CoinDesk’s newsletters    CoinDesk, Inc., 61 9th Avenue, 5th Floor, New York,NY,10011,USA, Unsubscribe Manage Preferences   Copyright © 2026 CoinDesk, All rights reserved.