EL7 Research · Cryptocurrencies
12 October 2026 · Prices as of the close on 10 October UTC
An implant in a Ledger device, two vulnerabilities in a Lightning software library, a Singapore alert on Hyperliquid dating back to June, and a gold-backed stablecoin being liquidated in Kyrgyzstan. Each story hit a different link in the custody chain, and none touched the Bitcoin protocol. The money that actually left accounts this week was lost to leverage, not theft.
A cryptocurrency holder owns nothing tangible, but holds the private key, a secret number that proves ownership and allows funds to be moved. Storing and securing this key, whether by its owner or an entrusted third party, is called custody. Between owners and their coins lies a chain of parties they must trust: the device storing the key, the software running the wallet, the platform they trade on, and the entity issuing the currency itself. In recent days, news emerged about each of these four links.
At the link closest to the owner, Ledger, the maker of widely used hardware wallets—devices that store private keys—confirmed that one device whose owners reported stolen funds contained an unauthorised electronic implant, and linked the incident to a single distributor in Southeast Asia. Independent investigators estimate the thefts at approximately 72 to 90 million dollars; Ledger has confirmed no figure. At the software link, LDK, a software library used by wallets and nodes on the Lightning network—nodes being computers that run the network—patched two vulnerabilities that could enable theft of funds, with no confirmed reports of exploitation. At the platform link, news resurfaced of Hyperliquid's inclusion on Singapore's Investor Alert List, although the listing dates to 26 June and is not a ban. At the issuer link, Kyrgyzstan's government ordered the liquidation of the issuer, meaning the entity issuing the currency, of the gold-backed stablecoin USDKG. A stablecoin is a digital currency whose value is pegged to a reference asset.
This research concludes that each failure occurred at a different link, and none in the Bitcoin or Ethereum protocol itself—the rules governing the network. None of these incidents was reflected in prices: Bitcoin rose 1.08% on the day of Ledger's statement. What drained accounts that same week was leverage—borrowing to increase position sizes—not theft: roughly 1.19 billion dollars in positions were forcibly liquidated within 24 hours, around 14 times the highest estimate of the Ledger thefts.
A free account gives you 4 full research papers every month. Or subscribe to EL7 Pro for full access to more than 300 papers.
$700 per year · or $99 per month