Welcome to this week's news review. Same process every edition: we scan the sources on our whitelist — exchange official announcements and fee pages, central bank and government releases, TRON DAO and TronScan, DefiLlama, Tether, blockchain security teams and major industry media — then deduplicate, rank by impact on withdrawal decisions, and summarize each item with a one-line takeaway and a linked source.
This week (October 5 – 11, 2026) the withdrawal risk changed location. For two weeks the story was exchange counterparty risk: a breach, a suspension, a published recovery calendar. This week the losses came from the opposite end of the chain — hardware wallets bought from a compromised reseller in Southeast Asia, with estimates running from $72 million to $94.5 million across more than 300 wallets, most of the value in USDT on TRON. Tether froze about $10 million of it, the attacker swapped other balances into USDD to get out from under that freeze, and investigators traced at least $3.89 million into Binance deposit addresses on TRON. Alongside it: Tether briefly froze four THORChain vaults on TRON and released them two hours later, USDT supply on TRON passed $94.25 billion, and ETF demand flipped hard negative with $681.1 million leaving US spot Bitcoin funds. Thirteen items below, grouped by category.
🔓1. A compromised Ledger reseller drained more than 300 wallets
Oct 9–10. Ledger confirmed it was investigating reports of fund losses among customers in Southeast Asia who bought devices from CryptoBilis, an authorised reseller listed for Malaysia, Indonesia and the Philippines. On-chain investigators counted coordinated drains from hundreds of victim wallets across TRON, Bitcoin, Ethereum, BNB Chain and Polygon, starting October 9. Loss estimates published during the week ranged from $72 million to $94.5 million; MistTrack placed them near $90 million, and one independent estimate reached $92.9 million. Most of the value was USDT on TRON.
The devices are the suspected entry point. According to hardware research by former Mt. Gox chief executive Mark Karpelès, the affected units carried small circuit boards with cellular capability tucked behind the screen — built to capture a user's 24-word recovery phrase and transmit it out. Ledger's own Genuine Check verifies the Secure Element chip, and its documentation acknowledges that a device physically modified elsewhere can still pass.
Individual cases show how fast a cold wallet stops being cold. Lookonchain tracked a Bitcoin address that received 80 BTC about ten days before the balance was swept in a single transaction on the morning of October 9, and a TRON wallet holding 7 million USDT that was emptied after its owner bought a device from the same reseller three weeks earlier.
Why it matters: the withdrawal education on this site has spent two weeks on exchange risk. This is the other side of it: self-custody removes counterparty risk and adds supply-chain risk, and the supply chain is longer than most people audit. I went through the incident, the freeze arithmetic and what device buyers should actually do in this week's deep dive on the reseller drain and what was frozen.
Takeaway: if you bought hardware directly from a manufacturer or a distributor you can trace, nothing here applies to you. If you bought through a marketplace reseller, treat the device as unverified until you have a reason to believe otherwise.
Source: CryptoSlate — Ledger investigation, reseller suspension and loss estimates, 2026-10-09 · Finbold — lookonchain case detail and Q3 hack totals, 2026-10-09
🛑2. Ledger's response: pause the reseller, and a 90-day warning for buyers
Oct 9. Ledger said it had asked CryptoBilis to pause all sales and shipments while the investigation runs, and advised customers who bought from the reseller within the previous 90 days not to initialize devices they had not yet set up. Anyone who had already configured one was told to consider moving assets to a device initialised with a fresh recovery phrase. Ledger stated that its own infrastructure, systems and services were not compromised and that the investigation concerns the reseller channel and affected market.
Binance co-founder Changpeng Zhao described it as looking localised to a supply-chain issue with one vendor, and called for industry cooperation to trace and recover the funds. Karpelès asked the reseller to open unsold stock so the circuit boards could be inspected. Neither a reseller takeover nor an NDA claim circulating on social media has been confirmed.
Why it matters: the recommended fix is the uncomfortable part. Moving funds to a new device with a new seed phrase is not a firmware update you can reverse — it is a full re-setup and a transfer of everything, which means a withdrawal-priced transaction per asset and a fresh set of addresses to re-whitelist on every venue.
Takeaway: budget the move like any other withdrawal: a small test transfer first, confirm arrival, then move the balance.
Source: CryptoSlate — Ledger statement, reseller pause, Genuine Check limitation, 2026-10-09
❄️3. Tether froze about $10 million — and the attacker swapped into USDD
Oct 9–10. Tether froze approximately $10 million in USDT linked to addresses associated with the drain, and several affected users contacted tracing teams directly. The attacker's response is the detail worth keeping: rather than waiting, some balances were swapped out of USDT into USDD through SUN.io and the USDD peg stability module — the same freeze-avoidance move we documented in the Bitget case last month, executed this time by an attacker who watched the freeze happen and routed around the issuer in hours.
Other funds went to mixers. Onchain Lens reported 430.2 ETH — roughly $1.07 million — sent to Tornado Cash through four wallets, plus $270,280 deposited at Binance. One report estimated the suspect-linked wallets still held about $70.6 million across ETH, BTC, USDD and USDT at the time of writing.
Why it matters: USDT's freeze power is real, fast and partial. It works on the token Tether controls and on nothing else — not native BTC, not ETH, and not a different stablecoin issued by someone else. A freeze that catches roughly a tenth of a haul is the mechanism working exactly as designed, and the design has a small ceiling.
Takeaway: freeze-ability is a property of the asset, not of the wallet. If your holdings are mostly USDT on TRON, an issuer freeze can help you; if they are mostly BTC, nothing in this incident suggests a recovery path.
Source: Cryptopolitan — Tether freeze, SUN.io/USDD swap, Tornado Cash flows, 2026-10-09 · CryptoSlate — MistTrack freeze confirmation, 2026-10-09
🔎4. Investigators traced $3.89 million into Binance deposit addresses on TRON
Oct 11. PeckShield reported that roughly $3.89 million drained from the compromised wallets had been routed into Binance deposit addresses on TRON — about 3.685 million USDT and 615,000 TRX, moved over a two-day window. Earlier the same day, roughly $10 million in USDT had already been sent to Binance deposit addresses. PeckShield noted a complication: some of the funds passed through intermediary wallets that also handle other clients' money.
An exchange deposit address is the most useful thing in this whole trace. A centralised venue can connect a deposit address to an account holder, which gives investigators and law enforcement a concrete next step that mixers and permissionless bridges do not.
Why it matters: the path is the same one every retail user takes — move USDT to a venue, convert, withdraw on another chain. Tracing does not require exotic tools; it requires the attacker to eventually touch a service that keeps records, which they did within about 48 hours.
Takeaway: this is also why the freeze figure will keep moving while the loss estimate stays put. Recovery arrives in increments through venues, not through the chain.
Source: Crypto Briefing — PeckShield trace of $3.89M into Binance deposit addresses, 2026-10-11
🧊5. Tether froze four THORChain vaults on TRON, then released them two hours later
Oct 9. Tether restricted four THORChain vaults holding about $1.45 million in USDT on TRON, then removed the addresses from the blacklist roughly two hours later — the four left at 15:30 UTC, and THORChain restarted TRON trading, deposits and transaction signing. Nineteen other addresses included in the same enforcement action stayed restricted, so this was a narrow reversal rather than a loosening of policy. THORChain technical co-founder Chad Barraford said the protocol received no advance notice and had to ask Tether what had happened.
Why it matters: the incident separates two claims that are usually run together. Decentralised infrastructure does not remove issuer controls from centrally issued stablecoins — a vault is an address like any other, and the same two-hour window that restored service could just as easily have kept it down for a week with no appeal.
Takeaway: if a service you use routes USDT through protocol-owned addresses, treat the token's issuer as part of that service's operational risk. The $1.45 million is about 0.0015% of TRON's USDT supply — small in dollars, large in operational dependency.
Source: Blockonomi — THORChain vault freeze and reversal, Barraford comments, 2026-10-09
⚡6. USDT supply on TRON passed $94.25 billion, up 24.7% in a year
Oct 10. Lookonchain data showed USDT supply on TRON at $94.25 billion, an increase of $18.67 billion — about 24.7% — over twelve months. TRON's own network page listed more than 408 million accounts, about $28.16 billion in total value locked and more than 15.8 billion cumulative transactions at the end of the week, with TRX holding accounts near 246 million.
Separately, the Q3 stablecoin report from the RWA Foundation and Token Terminal (data as of October 1) put TRON's stablecoin market capitalisation at $93.9 billion, up $5.0 billion over the quarter — roughly 60% of the $8.4 billion added by the top ten chains, against a $4.9 billion decline on Ethereum — with Ethereum at 54.2% of stablecoin supply and TRON at 31.2%.
Why it matters: this is the number that decides whether a TRC20 transfer is cheap. Settlement depth is what keeps the peg-to-venue experience smooth, and every quarter of the last year has added to it. It is also why incidents involving TRON addresses — this week's drain, the Bitget laundering leg — keep showing up in tracing reports.
Takeaway: the rail that carries most of this site's subject matter got bigger again this week, and the cost of using it did not move.
Source: Lookonchain data via Blockonomi — USDT on TRON $94.25B, +24.7% YoY, 2026-10-10 · TRON network data — account, TVL and transaction counters, 2026-10-11 · RWA Foundation / Token Terminal Q3 stablecoin report, 2026-10-01
🎰7. ETF demand flipped negative: $681.1 million left Bitcoin funds
Oct 5–9, published Oct 11. US spot Bitcoin ETFs recorded -$681.1 million for the week, ending three straight weeks of inflows and reversing the prior week's +$241.1 million. The daily sequence: -$89.9M Monday, +$118.86M Tuesday, -$487.07M Wednesday, -$244.13M Thursday, +$21.13M Friday. Fidelity's FBTC led the outflows at -$380.36 million, followed by Ark & 21Shares' ARKB at -$207.21 million.
Ethereum funds were worse in relative terms: -$542.07 million, with outflows every session and BlackRock's ETHA accounting for $477.04 million of it — the segment's largest weekly outflow since January and its second-largest of 2026. Solana ETFs lost $24.81 million, ending a 14-week inflow streak. XRP funds added $11.31 million for a 13th straight positive week, and NEAR ETFs took in $35.99 million. TRX, DOGE, HBAR and DOT ETFs saw no net movement at all.
Fund assets fell from $110.77 billion on October 5 to $105.84 billion on October 9 — mostly price, since net outflows over the span were $591 million — with BlackRock's IBIT alone holding $66.3 billion, about 63% of the total.
Why it matters: the marginal institutional buyer went from adding $2.39 billion in the last week of September to pulling $1.22 billion across Bitcoin and Ethereum this week. Withdrawal fees do not read ETF flows; the liquidity that fills large exits does.
Takeaway: the week's signal was flows, not price. We keep the full week in the weekly fee and data report, which prices the same $1,000 withdrawal on four networks and tables the flows next to it.
Source: SoSoValue weekly flows via Hodl.Press — BTC -$681.1M, ETH -$542.07M, daily sequence, 2026-10-11
📤8. 24,073 BTC left exchanges on October 5 — the biggest single-day exit in seven months
Oct 5 (reported Oct 6). Santiment measured a net 24,073 BTC leaving exchanges in a single day — the largest one-day net outflow since March 1 — bringing exchange reserves to about 6.50% of circulating supply. The analytics firm framed persistent withdrawals as coins moving into long-term custody rather than inventory being prepared for sale, while noting that outflows alone do not make a price trend.
CryptoQuant's data pointed the same direction from a different angle. The seven-day average of medium-sized inflows to Binance fell from 4,155 BTC on August 16 to 2,648 BTC on October 7, a drop of more than 36%. Coinbase Prime's median inflows fell from 1,620 to 1,370 BTC. Coinbase Advanced moved the other way, with median inflows rising from 2,520 to 4,760 BTC.
Why it matters: exchange reserves are the withdrawal story viewed from the other end. When the float on venues shrinks, every exit competes for a thinner book — and the operational mechanics of getting coins back onto a venue to sell them become part of the trade, not an afterthought.
Takeaway: one day does not make a regime, and the same week produced $681 million of ETF outflows in the opposite direction. Treat it as a data point, not a thesis.
📄9. FOMC minutes: most officials still expect one more hike this year
Oct 7, 14:00 ET. The minutes of the September 15–16 meeting — the one that raised the funds rate a quarter point to 3.75–4.00% — showed that most participants judged another increase would likely be appropriate by year-end. Several described the current policy rate as not restrictive, or only mildly restrictive. Inflation risks were characterised as skewed to the upside, with energy prices named as the main concern, some participants pointing to AI buildout spending as an additional cost pressure, and several naming further tariff increases. Fed staff projected inflation returning to the 2% target only in 2029.
The market read it as a near-term pause rather than a green light. The implied probability of at least a 25 basis point hike in October fell to about 20.5% from 51% a week earlier, while December pricing held near 84.5%. Stocks were already lower before the release and the S&P 500 closed down 0.22% at 7,801.77.
Why it matters: withdrawal fees do not react to macro, but the dollar cost of holding and moving crypto does — through stablecoin issuance, exchange liquidity and the risk appetite that decides whether people are moving funds at all.
Takeaway: the decision dates to plan around are September CPI on October 14, PPI and retail sales on October 15, and the FOMC decision on October 28.
Source: Federal Reserve — minutes of the September 15–16 FOMC meeting, released 2026-10-07 · CME FedWatch odds via Argaam, 2026-10-07
📉10. Bitcoin fell 3.9% while US stocks set records
Oct 5–11. Bitcoin closed the week at about $83,090, down roughly 3.9% from $86,480 on October 4 — with the damage concentrated on October 7 and 8, when it fell from $83,276 to an intraday low near $80,336 before recovering. Ethereum closed near $2,500, down about 8% on the week.
Equities did the opposite. The S&P 500 set a record close of 7,818.93 during the week and finished Friday at 7,811.54. The 10-year Treasury yield closed at 5.24%, after touching its highest level since 2002, and Freddie Mac's 30-year mortgage rate rose for a seventh straight week to 7.40%. The crypto Fear and Greed reading sat at 39 — fear.
Why it matters: a week where equities rally and crypto sells off is a de-correlation signal, and it changes who is withdrawing. In a risk-off week flows usually leave crypto for dollars; this week they left Bitcoin funds for the record-high equity market instead.
Takeaway: the week's range — roughly $80,300 to $86,700 — was wide enough that when you moved funds mattered more than which venue you moved them from.
Source: Yahoo Finance — BTC-USD, S&P 500 and 10-year Treasury daily history, 2026-10-04 – 10-11 · Freddie Mac Primary Mortgage Market Survey — 30-year fixed at 7.40%, seventh straight weekly increase, 2026-10-08
⏳11. Mt. Gox's October 31 deadline arrives with 34,500 BTC still undistributed
Oct 5–11. The rehabilitation trustee's third extension sets October 31, 2026 (Japan time) as the date by which base, early lump-sum and intermediate repayments should be completed. As of October 5, about 34,500 BTC — roughly $2.9 billion at the week's prices, and about a quarter of the original 142,000 BTC allocation — was still held by the estate, with roughly 4,500 of about 24,000 recognised claims unresolved. Because of the time-zone gap and the end of European daylight saving on October 25, the effective deadline for European creditors falls at 16:00 CET on October 30.
The deadline is a completion date for the trustee's transactions, not a payment promise to each creditor: intermediaries can add weeks. Distributions since July 2024 have been paced deliberately through venues and OTC, and the 34,500 BTC remaining represent less than two weeks of spot volume at current liquidity.
Why it matters: a decade-old bankruptcy obligation is still the largest single scheduled withdrawal from a custodial estate, and it is the cleanest example of the rule that a deadline comes before the money, not after it. If you are waiting on any distressed platform, I wrote up the triage sequence to run when a withdrawal is pending and the platform has stopped answering.
Takeaway: verify your claim status, payout consent and account details now. Corrections filed in the final week are not guaranteed to be processed.
Source: Arkham on-chain data via Crypto Briefing — 34,387 BTC still held, October 31 deadline, payout progress, 2026-10-08 · Mt. Gox estate holdings as of 2026-10-05, unresolved claims and deadline time zone, 2026-10-08
🔐12. TRON: post-quantum signatures tested, Tron Inc. buying again, JST on Uphold
Oct 6–8. TRON DAO was title sponsor at TOKEN2049 Singapore and Blockworks' DAS Asia, where Justin Sun said end-to-end post-quantum signature support has been deployed on the Nile testnet and that mainnet activation requires governance approval, targeted for the end of 2026 — later than the original Q3 goal. The signatures follow NIST standards and may increase transaction size. Sun also repeated the “AI agents will become crypto's biggest use case within five years” line.
On the treasury side, Tron Inc. (Nasdaq: TRON) disclosed another purchase — 147,789 TRX at an average $0.3383 — taking its holdings above 717.6 million TRX. JST became available to trade on Uphold, and JustLend DAO reported ecosystem total value locked of $12.25 billion, 43.92% of TRON DeFi, with $4.11 billion supplied and $208.67 million borrowed. GasFree closed September with more than $14.87 billion in transfer volume across 479,000 users.
Why it matters: none of this touches a fee parameter, and none of it was expected to. The institutional track matters to withdrawal users only through the thing it buys: a rail that keeps its place in regulated distribution and keeps settlement costs where they are.
Takeaway: post-quantum signing on mainnet is a governance vote away, not a shipped feature — worth watching in Q4, not worth acting on this week.
Source: TRON DAO press release on TOKEN2049 and DAS Asia participation and Nile testnet post-quantum support, via KCEX News, 2026-10-10 · TRON DAO news — September ecosystem recap and institutional items, 2026-10-06/07
🔧13. Scheduled maintenance and one hard deadline for the week ahead
Oct 7–12. Routine network and wallet work dominated the availability column, which is what a normal week looks like. Bitget suspended AXS withdrawals on BNB Smart Chain from October 7, 04:25 UTC+8 for wallet maintenance, and has since reopened the network. MEXC suspended SEI deposits and withdrawals from October 8, 23:00 UTC+8 ahead of the Sei network upgrade and confirmed trading on SEI was unaffected. Bybit scheduled BTC wallet maintenance for October 12, 06:00 UTC, suspending deposits and withdrawals for about an hour. BitMEX announced that withdrawals would be paused from October 12, 04:00 UTC for approximately 48 hours during an account-infrastructure upgrade, with balances viewable throughout.
The deadline worth diarising is not a maintenance window. The perpetual futures platform Extended is migrating settlement to Arc, Circle's layer-1, in the week of October 19, and users with more than $1 in USDT or wBTC in sub-accounts must convert or withdraw those assets by October 21, 12:00 UTC — assets that exceed the threshold and are left behind trigger an account restriction during processing, with affected positions liquidated at the mark price. Deposits and withdrawals are expected to pause for no more than about two hours during the switch.
Why it matters: this is the third platform in six weeks to give users a dated exit from a product that is going away, after CoinEx and Blast. The pattern is consistent enough to plan around: convert or leave early, because the fallback after the deadline is always worse than the interface before it.
Source: BitMEX official notice — withdrawals paused from 2026-10-12 04:00 UTC for ~48 hours · Bybit notice — BTC deposit/withdrawal maintenance, 2026-10-12 · Bitget support — AXS (BSC) withdrawal suspension from 2026-10-07 · Extended official documentation — Arc settlement migration and October 21 conversion deadline, 2026-10-09