Welcome to Galaxy Research's Weekly Research Brief. Subscribe to get this newsletter delivered to your inbox every Friday morning.
This week, Alex Thorn analyzes the $91m exploit of Ledger hardware wallets by third-party resellers, Thad Pinakiewicz breaks down the OCC’s report on debanking under the previous administration, and Will Owens shares takeaways on the Papertrade launch.
Not Your Reseller, Not Your Coins
WHAT HAPPENED
Ledger is investigating the theft of roughly $91 million from customers who bought its hardware wallets through CryptoBilis, a Southeast Asian reseller, after confirming that at least one of the devices sold contained a hardware implant that read the recovery phrase off the screen.
On Friday, Oct. 9, Ledger said it was investigating reports of lost funds from users in Southeast Asia who purchased devices through CryptoBilis, which Ledger's own site listed as an authorized reseller for Indonesia, Malaysia and the Philippines. Ledger asked the reseller to pause all sales and shipments and told anyone who bought from it in the past 90 days not to set up the device, or, if they already had, to move funds to a new device with a newly generated seed. The next day Ledger confirmed that "one of the impacted users' devices contained an unauthorized hardware implant," and on Tuesday it described how it works: a separate component inside the enclosure reads the screen during setup, captures the 24-word recovery phrase and sends it out over LTE through a provisioned eSIM. It leaves the Secure Element and Ledger's operating system untouched, which is why Ledger's Genuine Check passes on a tampered unit. Independent teardowns have found at least three generations of the implant, the latest a professionally fabricated flex circuit hidden under the display. Ledger says its own systems and direct sales channels were not compromised, that the volume is "limited," and that every confirmed case so far involves a device sold through CryptoBilis, which has suspended all hardware sales.
Onchain, the theft looks less like a run of individual victims than a harvest. By our count, roughly $91 million left 474 victim addresses across bitcoin, Ethereum, Arbitrum, Polygon and TRON: about $64.5 million in USDT and TRX from 146 TRON addresses, 213 BTC (about $17.6 million) from 279 bitcoin addresses, and $8.8 million of ETH and stablecoins from 49 Ethereum-type addresses. Trackers that also count BNB Chain, which we have not scoped, put it a little higher, at $93 million to $95 million; ours is a floor. The bitcoin sweeps began on Oct. 7, but 88% of the value, about $80 million, moved in a single hour starting at 05:00 UTC on Oct. 9, the morning of Ledger's first statement. Nearly all of the bitcoin victim addresses had never spent before. This was cold storage, most of it funded within the previous 90 days, though some addresses date to 2021, consistent with existing seeds being restored onto tampered devices.
As of Oct. 15, about $56.6 million is still parked at attacker-controlled addresses: roughly 208 BTC untouched at the bitcoin collectors, about 12,800 ETH (much of it bridged from TRON) and 7.5 million USDT in TRON relay accounts created the morning of the drain. About 5,400 ETH ($13.5 million) has gone through Tornado Cash, on the order of $2 million appears to have reached exchange deposit addresses, and Tether has frozen $10 million of USDT tied to the theft. At least one victim has resorted to writing to the thieves onchain, offering them a cut if they return the rest.
OUR TAKE
Two weeks ago in this newsletter, Thad Pinakiewicz wrote that nobody attacks the private-key math anymore; they attack whatever tells the math what to do. The Ledger reseller theft is the physical-world version of the same lesson. The Secure Element did its job. The seed was simply read off the screen by a chip that was not supposed to be there. Three things about it are worth dwelling on.
Cyber vulnerabilities in the age of AI. Last week Jianing Wu weighed the debate over whether AI will eventually break ECDSA. That is the wrong place to look for the near-term threat. Nothing in this quarter's losses required a mathematical breakthrough: a firmware build flaw at Coldcard, a verification-cache bug in Liquid, a compromised third-party security product at Bitget, and now a flex circuit and an eSIM. None of these incidents has been attributed to AI tooling, and we are not attributing them. But AI changes the economics of everything around the key. Frontier models now find real vulnerabilities in widely used code, and the window between a bug shipping and being exploited is collapsing: Hacken attributes 77% of third-quarter losses to vendor and developer tooling, disclosed-but-undeployed fixes, and infrastructure outside the audit scope. The same tools make the operation around an exploit cheap to run at scale: a plausible storefront, responsive "support," a backend that files away hundreds of recovery phrases and waits for the deposits to arrive. The implication for anyone building or holding in this industry is to assume that every dependency and every link in the supply chain is being probed continuously by adversaries who do not get tired, and to point the same automation at your own code, firmware and vendors before they do.
The particular risk of digital bearer assets. This is what a bearer asset looks like when custody fails. The property that makes bitcoin impossible to confiscate makes it impossible to claw back. There is no issuer to call, no chargeback, no court order that moves a UTXO. Of the $91 million taken, the only portion now under anyone's control but the thief's is the $10 million Tether froze, which is itself a reminder that USDT is not a bearer asset at all but a liability with an admin key. The 208 BTC resting at three bitcoin addresses is visible to the entire world and reachable by no one. A bank theft of this size would come with a task force; here, 474 addresses, most of them belonging to retail buyers in Southeast Asia, are reduced to pleading in OP_RETURN. None of this is an argument against self-custody. It is an argument that self-custody is an operational discipline rather than a product you buy. The device is one link; the supply chain that delivered it, the screen you trusted, the backup and the plan for your heirs are the others. Buy direct from the manufacturer. Treat any device that arrives set up, or with a pre-printed seed, as compromised. For balances you cannot afford to lose, spread keys across vendors and locations so that a single tampered device or buggy random number generator is a scare rather than a loss, and for institutions, use custody controls that assume any one device or vendor can fail.
A rough quarter for bitcoin's conservative infrastructure. Ledger closes out roughly ten weeks in which the "boring," bitcoin-native corner of the industry took hit after hit. On July 30, Coinkite disclosed that Coldcard firmware had been generating weak seeds since 2021; by our count more than 1,830 BTC (about $150 million at today's prices) has since been swept from more than 9,000 addresses. On Sept. 6, a bug in Liquid's Elements software let an attacker mint about 3,998 unbacked L-BTC and peg them out for real bitcoin, roughly $320 million at the time; the attackers, who styled themselves white hats, returned 3,400 BTC once Blockstream patched the bridge and kept about 600 BTC as a self-awarded fee. Bitget lost $387.5 million on Sept. 24 to a compromised third-party security product in an attack it attributes to North Korea, and NEAR Intents was hit for $3.8 million days after blocking the Bitget launderers. Third-quarter tallies from CertiK and Hacken land between $1.1 billion and $1.3 billion, and the Ledger theft arrived in the first week of the fourth quarter. What stands out is the profile of the targets. These were not unaudited DeFi contracts. Coldcard and Ledger are the two most trusted names in hardware self-custody, and Liquid is the most conservative sidechain in bitcoin, operated by a federation of long-standing bitcoin companies. In every case the cryptography held; the failure was in implementation, supply chain or operations. The response is the silver lining: within hours there were onchain tallies, Tether froze funds, NEAR Intents blocked flows, and the Liquid attackers negotiated onchain and returned 85%, a long way from the Mt. Gox era. But the lesson of the quarter is uncomfortable for anyone who assumed the bitcoin-native stack was the safe part.
Bitcoin's math had a great quarter. Everything wrapped around it did not. – Alex Thorn
Papertrade Pays You to Lose
WHAT HAPPENED
Papertrade opened trading on HyperEVM on Oct. 10, an ominous anniversary for the crypto industry, but the protocol is off to a promising start ... for now.
It is a fully onchain application that allows up to 1,000x leverage on BTC and ETH perpetuals with no funding rates and no slippage. Trades are effectively swaps against a single protocol-owned USDC pool, the “Martingaler LP,” which started at $0 and is funded only by trader losses. Prices are the Hyperliquid BBO (best bid and offer) midpoint read onchain via precompiles (something HyperEVM uniquely enables).
Losing trades mint PAPER, which is currently non-transferable and can be staked. PAPER stakers receive a share of realized PnL and fees while the LP fills toward a ~$5m soft cap, and essentially all surplus above it.
The ability to take 1,000x leveraged positions is attractive for crypto degens, and it’s also enticing that you get “rewarded” for losing in the form of PAPER tokens. Many traders have been purposely getting liquidated to farm PAPER in the hopes that these tokens will make back their losses.
This has been a hyped-up launch for a while, particularly because of the background of the founders, Jez (@izebel_eth) and Blurr. Watch this interview for a more in-depth explanation of the protocol and its backstory.
As of Oct. 15, the venue has processed ~$1.11t in total volume and total trader PnL is -$54.1m. Total PAPER staking rewards stood at $45.6m and total PAPER supply at 8.07b tokens. To see live metrics, check out this dashboard.
OUR TAKE
One interesting development was the emergence of a “manipulator” on the day of Papertrade’s launch. This address (0x2025137a136bea7446deba681cbfc7cf1970840e) was moving the underlying Hyperliquid ETH reference price while holding synthetic exposure on Papertrade. The trader was taking advantage of a weakness in the design that was explicitly acknowledged in the risks section of the project’s docs. Essentially, the strategy goes as follows: take large amounts of synthetic exposure on Papertrade, nudge the HL mid by a few basis points, close Papertrade position, flip opposite direction, and move HL mid the other way, repeat. The team responded by tightening open-interest caps both onchain and at the relayer level.
The protocol’s revenue is absurd. DefiLlama data shows cumulative revenue at $43m after five days, or roughly $8 million to $9 million per day. This has put Papertrade behind only the major stablecoin issuers and ahead of Hyperliquid and Pump.fun.
But “revenue” here just means trader losses, and the losers are the shareholders. It’s mandatory that every staker is a prior loser because it’s not possible to acquire PAPER in any other way.
That makes valuing PAPER unusually tricky. Many traders have lofty targets for the token, but it’s hard to know this early what will happen with a protocol. The math many people are posting on X will hold only if volume does, and much of the volume is farming that makes sense only while PAPER is worth more than the loss it takes to mint it.
Once PAPER becomes transferable, the market price will determine how much farming happens, and that, in turn, will determine long-term revenue. Over 99% of supply is staked today because there’s nowhere else for it to go. – Will Owens
OCC Debanking Report Shows ‘Choke Point 2.0’ Was No Fever Dream
WHAT HAPPENED
The U.S. regulator for national banks pulled back the curtain on Operation Choke Point 2.0 this week, releasing its final report on debanking at the nation’s nine largest national banks.
Following an August 2025 executive order from President Trump, the Office of the Comptroller of the Currency (OCC) combed through nearly 100,000 complaints, hundreds of individual account decisions, and roughly 420,000 pages of internal documents from 2020 through September 2025. The OCC’s stark findings have Nic Carter, the crypto VC who has been on the forefront of OCP muckraking, doing a victory lap.
Banks relied on “reputational risk” policies with no clear or measurable standards, and those policies were used to cut off customers over their political, religious, and social views, the OCC’s review confirmed. Examples range from a JPMorgan-owned payments processor closing a merchant’s account for selling MAGA gear, to a Capital One business line turning away partisan groups on both sides of the aisle. Industry-wide (unofficial) restrictions on firearms, coal, Arctic drilling, private prisons, tobacco, and digital assets hit small and midsized firms hardest, while lucrative clients often got exceptions. The OCC also warns that some banks are simply rebranding reputation risk as “franchise” or “brand” risk, and notes that no bank has publicly acknowledged its past debanking decisions.
For crypto, it’s vindication, but does this mean we are protected going forward?
OUR TAKE
The regulatory landscape around banks has evolved drastically since I entered the workforce. I went through college at the beginning of the Great Financial Crisis, then worked on Deutsche Bank’s structured credit desk, focusing on CLOs and CDOs.
After the crisis, the banks were absorbed into the regulatory apparatus of the U.S. government. The Dodd-Frank Act and enhanced capital requirements for global systemically important banks (GSIBs) became an effective way for the government to regulate the broader financial system.
This face turn of banks from foes to friends of the regulators can be seen most clearly in the turnaround of the commentary from the Elizabeth Warren camp. To that crowd, banks used to be the enemies of Main Street; now they are central to making sure regulations are enforced and the will of the government enacted.
Toward the end of my career at Deutsche Bank, after Jan. 6, there was a stressful week or two on the trading desk. Desk heads and business managers were pulled in to decide whether to keep banking Donald Trump. The question being contemplated was reputational risk; would the profits from having Trump as a client be more than offset by the losses from upset clients taking business elsewhere? It was the first high-profile debanking driven by reputational risk, and we later saw the same thing happen to the artist Ye (formerly Kanye West), for his…colorful commentary.
Banks also worked the other side of the reputational ledger, polishing their image through ESG (environmental, social, and governance) investing, “socially responsible investing,” and other flavors of “stakeholder capitalism.” Having read plenty of ESG prospectuses during my time on the desk, I can tell you most simply didn't invest in certain categories (sin stocks, firearms, etc.). They also didn’t invest in anything actually productive on the E, S, or G front.
The ESG fad eventually faded. The pruning of “toxic” clients from the Rolodex did not.
Publicly, debanking was used sparingly. There were few explicit cases, the Canadian truckers during COVID being the notable one. The real activity was happening behind closed doors in Washington, under what critics referred to as Operation Choke Point 2.0.
The regulators took the lever that the banks had been using: the right to refuse business. Legally, banks don’t have to give anyone an account, they have the right to refuse or cease doing business with law-abiding people and businesses, and reputational risk was a convenient rationale to do so. With post-2008 regulation in place, the government had far more control over the banks than before. It could use that lever to target legal industries an administration disfavored: firearms, oil and gas, and, most relevant here, crypto.
Now the pendulum has swung back. The OCC report is welcome, and it proves that, hey, we in crypto were not crazy these past years. The crypto industry was being targeted by the government in an unfair manner. The facts support the good actors in the industry who were swept up in an opaque dragnet and what they have been striving toward. But the crypto industry, along with some of the affected banks, had the money to push back and the resources to investigate.
OCP 2.0’s targets have power and weight in the economy. The everyday Americans who are unbanked for similar reasons have no such voice. Plenty of studies show minorities remain underbanked in the U.S. So I’d welcome a push for greater fairness in banking, not just for sin stocks and crypto, but for everyone who is underbanked.
This all kind of comes together into one question: whose freedom is most paramount? Banks are businesses, and businesses typically aren’t compelled to serve people they don’t want to. “No shirt, no shoes, no service.” The executive branch and federal regulators are now challenging that assumption. If banks can’t refuse customers over perceived reputational risk, and given how much falls under the umbrella of “reputation,” do Americans have a right to banking services? And to be fair, high regulatory barriers to entry limit competition in banking, so it’s not as if spurned customers can just start their own bank.
It’s a laudable ideal that access to finance should be fair regardless of one’s politics. Because it flows from constitutional protections for opinion and speech, it starts to sound almost like a right. But that’s a big claim when you don’t even have a right to drive; that’s a privilege. (Ask a “sovereign citizen” what “travel” means and you may get a different answer.)
As a proponent of individual freedom, I am torn. I don’t like telling businesses they have to serve people they don’t want to, though The Civil Rights Act sets an appropriate precedent for addressing real harms. And I believe in your right to spend your money as you want. If Citizens United says money is speech, and banks can’t restrict your access based on your speech, does that mean you have a right to put your money in the banking system and use it?
Crypto has pursued going bankless as an ethos for years. OCP 2.0 was a U.S. operation, but groups worldwide have been cut off from financial services for their opinions. Crypto is facts-based and doesn’t judge on merit, unlike the traditional trust-based system, which is a machine made of man, and man has biases. I work in crypto because I don’t believe that system is fair. I want to help build one so intrinsically fair that the option to transact freely always exists, no matter what the current administration says.
Operation Choke Point 2.0 was real. Industries were systematically debanked amid government and regulatory pressure. There were no laws and no publications, just a back-door squashing of industries the administration of the day didn’t approve of. It can happen under any administration. We need a way to make sure nobody is targeted, no matter who’s in office. That could be a right guaranteed by law, or maybe, just maybe, a transition, driven by economic reality, to an open, blockchain-based financial system.
From that point of view, this report is a useful accounting. Maybe we will get a right to financial access. If we don’t, I’m still in the right place to push it forward. – Thad Pinakiewicz
Other News
🏰 Citadel Securities, BNY enter first tokenized Treasury repo deal
🏫 Balaji’s Network School acquires onchain social network Farcaster
🥼 Google claims to break open a bottleneck in quantum computing
💰 Binance.US said to seek $100m at $1b valuation (WLFI reportedly passed) ...
⛏️☁️ ... as Binance plans to shut down mining pool, cloud mining, related services
🚨🇺🇸 B of A fined >$1.2b for AML/sanctions lapses; crypto peripherally involved
⏱️ Solana sets Oct. 21 for Alpenglow upgrade, targeting 150ms finality
🦑🇱🇹🇪🇺 Kraken parent Payward to buy Lithuanian bank, gaining EU footprint
🇯🇵 Anthropic to build first data center in Japan
🤦♂️🇩🇰 '123456' password linked to Denmark data breach affecting 8.8m people
Chart of the Week: DAT’s a Lot of Bitcoin
As of writing, bitcoin digital asset treasury (DAT) companies hold at least 1.073m BTC, most of which is held by Michael Saylor’s Strategy with 848,500 BTC. Metaplanet, Twenty One, and Strive add another ~120,000 BTC.
Got feedback on this newsletter? Email [email protected]. We’d love to hear from you.
Legal Disclosure:
This document, and the information contained herein, has been provided to you by Galaxy Digital Inc. and its affiliates (“Galaxy Digital”) solely for informational purposes. This document may not be reproduced or redistributed in whole or in part, in any format, without the express written approval of Galaxy Digital. Neither the information, nor any opinion contained in this document, constitutes an offer to buy or sell, or a solicitation of an offer to buy or sell, any advisory services, securities, futures, options or other financial instruments or to participate in any advisory services or trading strategy. Nothing contained in this document constitutes investment, legal or tax advice or is an endorsement of any of the stablecoins mentioned herein. You should make your own investigations and evaluations of the information herein. Any decisions based on information contained in this document are the sole responsibility of the reader. Readers should consult with their own advisors and rely on their independent judgement when making financial or investment decisions.
Participants, along with Galaxy Digital, may hold financial interests in certain assets referenced in this content. Galaxy Digital regularly engages in buying and selling financial instruments, including through hedging transactions, for its own proprietary accounts and on behalf of its counterparties. Galaxy Digital also provides services to vehicles that invest in various asset classes. If the value of such assets increases, those vehicles may benefit, and Galaxy Digital’s service fees may increase accordingly. The information and analysis in this communication are based on technical, fundamental, and market considerations and do not represent a formal valuation. For more information, please refer to Galaxy’s public filings and statements. Certain asset classes discussed, including digital assets, may be volatile and involve risk, and actual market outcomes may differ materially from perspectives expressed here.
For additional risks related to digital assets, please refer to the risk factors contained in filings Galaxy Digital Inc. makes with the Securities and Exchange Commission (the “SEC”) from time to time, including in its Quarterly Report on Form 10-Q for the quarter ended September 30, 2025, filed with the SEC on November 10, 2025, available at www.sec.gov.
Certain statements in this document reflect Galaxy Digital’s views, estimates, opinions or predictions (which may be based on proprietary models and assumptions, including, in particular, Galaxy Digital’s views on the current and future market for certain digital assets), and there is no guarantee that these views, estimates, opinions or predictions are currently accurate or that they will be ultimately realized. To the extent these assumptions or models are not correct or circumstances change, the actual performance may vary substantially from, and be less than, the estimates included herein. None of Galaxy Digital nor any of its affiliates, shareholders, partners, members, directors, officers, management, employees or representatives makes any representation or warranty, express or implied, as to the accuracy or completeness of any of the information or any other information (whether communicated in written or oral form) transmitted or made available to you. Each of the aforementioned parties expressly disclaims any and all liability relating to or resulting from the use of this information. Certain information contained herein (including financial information) has been obtained from published and non-published sources. Such information has not been independently verified by Galaxy Digital and, Galaxy Digital, does not assume responsibility for the accuracy of such information. Affiliates of Galaxy Digital may have owned, hedged and sold or may own, hedge and sell investments in some of the digital assets, protocols, equities, or other financial instruments discussed in this document. Affiliates of Galaxy Digital may also lend to some of the protocols discussed in this document, the underlying collateral of which could be the native token subject to liquidation in the event of a margin call or closeout. The economic result of closing out the protocol loan could directly conflict with other Galaxy affiliates that hold investments in, and support, such token. Except where otherwise indicated, the information in this document is based on matters as they exist as of the date of preparation and not as of any future date, and will not be updated or otherwise revised to reflect information that subsequently becomes available, or circumstances existing or changes occurring after the date hereof. This document provides links to other Websites that we think might be of interest to you. Please note that when you click on one of these links, you may be moving to a provider’s website that is not associated with Galaxy Digital. These linked sites and their providers are not controlled by us, and we are not responsible for the contents or the proper operation of any linked site. The inclusion of any link does not imply our endorsement or our adoption of the statements therein. We encourage you to read the terms of use and privacy statements of these linked sites as their policies may differ from ours. The foregoing does not constitute a “research report” as defined by FINRA Rule 2241 or a “debt research report” as defined by FINRA Rule 2242 and was not prepared by Galaxy Digital Partners LLC. Similarly, the foregoing does not constitute a “research report” as defined by CFTC Regulation 23.605(a)(9) and was not prepared by Galaxy Derivatives LLC. For all inquiries, please email [email protected].
©Copyright Galaxy Digital Inc. 2026. All rights reserved.