Core Lightning warned Bitcoin Lightning Network node operators to immediately upgrade nodes running version 26.06.7 or earlier due to reports of active attacks targeting unpatched nodes

Overview Debates Related claims Topics Sources

Coinbase published technical priorities on October 13, 2026, outlining options for Bitcoin's post-quantum migration, including staged wallet upgrades and freezing vulnerable dormant coins

A June 2026 study estimated that approximately 2.3 million Bitcoin held in lost, dormant, or early addresses cannot be moved to quantum-resistant addresses

Google Quantum AI white papers estimated in March 2026 that breaking Bitcoin's elliptic curve cryptography would require 1,200 to 1,450 logical qubits or under 500,000 physical qubits

Approximately 6.04 million to 6.26 million Bitcoin, representing over 30% of all mined Bitcoin, sit in quantum-vulnerable public key addresses

Ledger confirmed a hardware implant was discovered inside at least one Ledger device sold by reseller CryptoBilis

An estimated 6 million Bitcoin, representing over 30% of the total Bitcoin supply, is quantum-exposed at rest due to reliance on elliptic-curve signatures.

Six security firms participated in audit work covering Babylon's Aave V4 integration components, including Coinspect, Sherlock, Zellic, ABDK, ZK Security, and Runtime Verification

The theft of private keys from a Bitcoin wallet cannot be reversed due to the irreversibility of Bitcoin transactions

Ledger Donjon reported that hardware implants found in CryptoBilis-sold Ledger devices use a microcontroller to decode screen data during setup, capturing 24-word recovery phrases and transmitting them over LTE using a provisioned eSIM

MediaMarktSaturn suspended sales of all Ledger hardware wallets across online platforms and over 1,000 physical stores in 11 countries on October 13, 2026, following customer reports of hardware tampering.

Trezor stated that its setup checks catch modified firmware, whereas the hardware implant found in rival Ledger devices sold through CryptoBilis reads screen display data directly without altering firmware or internal operating systems

Blockchain security analysts estimated total crypto theft losses linked to tampered Ledger wallets sold through reseller CryptoBilis between $72 million and $93 million

Trezor announced on October 13, 2026 that it is reducing its authorized reseller network starting January 1, 2027 as a preventive security measure.

European retailer MediaMarktSaturn suspended physical and online sales of Ledger products across Europe after a report of a tampered Ledger device purchased in Germany.

The hardware implant found in CryptoBilis-sold Ledger wallets decoded recovery phrases from the device screen and transmitted them over cellular networks using an embedded eSIM.

Rival hardware wallet maker Ledger confirmed that devices sold through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant that intercepted 24-word recovery phrases.

A third-party ShipMonk data breach disclosed by Trezor in 2026 exposed order and contact details for nearly 81,000 Trezor customers.

Trezor stated on October 13, 2026 that there is no evidence that any Trezor devices have been compromised or tampered with in the supply chain.

Southeast Asian reseller CryptoBilis was removed from Trezor's authorized reseller list following security incidents involving rival hardware wallet brand Ledger.

Trezor announced that authorized resellers remaining in its network will be subject to stricter legal frameworks and tighter compliance checks regarding device sourcing, storage, and handling.