Self-Custody

Bitcoin is back at 75k, and there is not much to say about the price action itself. What was waiting this morning was another security incident in wallet infrastructure. Keplr’s social-login wallets were compromised, with assets drained from several thousand accounts. The official explanation points to a vulnerability in Web3Auth’s infrastructure[1]. Most of the users who lost funds did nothing wrong; they simply chose convenience when they created the wallet with a Google or Apple login. ...

Bitcoin (BTC) continues to pull back toward the 100-day line near 76.8k. The U.S. midterm election day just passed, and the market showed little reaction; trading volume was even lighter than in previous days. Overnight, Binance officially released a preliminary investigation report on the multibillion-dollar theft from a few days ago, roughly explaining how the hackers breached their internal systems. The specifics were covered in a separate internal briefing, so they won’t be repeated here. ...

There is a classic joke. A girl tells a boy: if you can get everyone on the forum arguing, I’ll go out with you. The boy posts a thread titled “PHP is the best programming language in the world.” The forum immediately erupts. The girl says, you’re amazing, let’s go. The boy replies: no — I have to make everyone believe PHP is the best language. The joke lands even if you know nothing about PHP, because the absurdity is universal. ...

Last Friday (Oct 9), BTC quietly retested its 50-day line (around $80.7k), then, after a two-day weekend, climbed back to $83k–$84k. But what sent a chill down the market’s spine was not the price action. It was a supply-chain attack on Ledger hardware wallets that, by some accounts, drained close to $100 million. A Ledger unit shipped from Malaysia, when opened, was found to contain a tiny board where the screen’s padding should have been — a board that had no business being there. On a fingernail-sized piece of silicon sat a full mobile-communications stack: an LTE module, an antenna, an eSIM, plus a microcontroller wired into the device’s SPI bus. It cannot crack your password, but it quietly watches the screen, memorizes the 24 words you jot down during setup, and beams them out[1]. ...

The recent supply-chain compromise of Ledger devices (analyzed in a companion piece) has left a lot of people nervous — suddenly doubting the hardware wallet they trusted. That reaction is understandable. But it does not mean a hardware wallet is a false proposition. To see why, we have to separate the product from the idea. A product, and a commodity A hardware wallet from Ledger, OneKey, or any other vendor is, first, a product — something designed and built to meet a need — and second, a commodity — something that enters the market to be exchanged and sold. The two words describe the same object from different angles: “product” emphasizes function, “commodity” emphasizes the transaction. ...

BTC has been climbing and now sits near $65k. The weekend’s market was calm. But this weekend in the Bitcoin community was destined to be anything but peaceful. ...