Not another hardware wallet hack

In partnership with

Blu Dot surpasses 2,000% ROAS with self-serve CTV ads

Home furniture brand Blu Dot blew up on CTV with help from Roku Ads Manager. Here’s how:

After a test campaign reached 211,000 households and achieved 1,010% ROAS, the brand went all in to promote its annual sales event. It removed age and income constraints to expand reach and shifted budget to custom audiences and retargeting, where intent was strongest.

The results speak for themselves. As Blu Dot increased their investment by 10x, ROAS jumped to 2,308% and more page-view conversions surpassed 50,000.

“For CTV campaigns, Roku has been a top performer,” said Claire Folkestad, Paid Media Strategist, Blu Dot. “Comping to our other platforms, we have seen really strong ROAS… and highly efficient CPMs, lower than any other CTV partner we've worked with.”

Using Roku Ads Manager, the campaign moved from a pilot to a permanent performance engine for the brand.

Learn More

Another week, another hardware wallet headline.

Ledger asked a reseller in Southeast Asia to stop selling its devices after buyers reported drained wallets. An on-chain investigator estimated the losses at over $86 million.

Meanwhile, we will also cover two blockchains that recently shut down and explain, in plain English, how a blockchain can run out of money.

📝 The Translation

A hardware wallet maker paused a reseller’s sales after reports of drained funds 🔐

What happened: Ledger asked CryptoBilis, a Malaysia-based reseller that also operates in Indonesia and the Philippines, to pause all sales and shipments of Ledger devices while it investigates. 

Ledger told anyone who bought a device from that shop in the past 90 days not to set it up. Anyone who already did was told to move their funds to a different device with a brand-new seed phrase. 

An on-chain investigator who goes by Specter traced suspected losses above $86 million across Ethereum, TRON and Bitcoin wallets.

Why it matters: Ledger confirmed within 48 hours that one affected user’s device contained an unauthorized hardware implant, a physical modification added before the device reached the buyer.

The reseller confirmed it has stopped selling all hardware wallet inventory until the investigation concludes. 

The Compass take: This is a different failure from the Coldcard bug we covered in August. That was a flaw in the maker’s own firmware. This is tampering that happened after the factory, between the maker and the buyer.

Industry figures are weighing in 🧐

What happened: Binance founder Changpeng Zhao said on X that the losses look like a localized supply chain attack tied to a single vendor, and that devices were likely tampered with or swapped for counterfeits before reaching buyers.

Mark Karpelès, the former Mt. Gox CEO, publicly asked CryptoBilis to open its in-stock inventory so units can be inspected for hardware implants.

Why it matters: Zhao’s description is an informed guess, not a finding. Karpelès is asking for the right test, since physically inspecting unsold units would show whether devices were altered.

The Compass take: This is how a story should move, from claim to confirmation, and it is worth noticing which parts have made the jump. The tampering theory is confirmed now. However, the $86 million figure does not yet. 

⚠️ Beyond Bitcoin — Layer 2s are shutting down, and one is trying to leave Ethereum entirely

Two Ethereum layer 2 networks recently announced shutdowns, and a third made headlines for a very different reason. Each one teaches something about how blockchains survive or do not.

Blast Announces It Will Shut Down

Blast, a network built by the founder of the NFT marketplace Blur, announced on October 2 that it will wind down because its fees no longer cover its running costs. 

It once held more than $2 billion in deposits, drawn in by yield from outside protocols. 

Users have until October 26 to withdraw through the standard interface. After that, withdrawals require interacting directly with a smart contract, which is much less beginner-friendly.

Abstract Becomes the Second to Close

Abstract, the network behind the Pudgy Penguins brand, will close on December 15 after its parent company says it lost “tens of millions of dollars” funding it. 

In a recent 24-hour window, the chain itself earned roughly $3,900 in fees, while the apps running on it earned about $39,000. 

The apps were doing fine. The chain underneath them was not. Users have until December 15 to move their assets, or the funds become inaccessible.

Starknet Floats Leaving Ethereum Entirely

Starknet’s founder floated the idea of becoming an independent blockchain by 2027, pitching it as a way to get ahead of future cryptographic threats.

The token jumped roughly 26% in a day, but the coverage points out the rally was driven mostly by leveraged derivatives traders, and no formal governance proposal exists yet.

The idea rode in on a wave of concern after a prominent Ethereum researcher warned that advances in AI could eventually weaken the elliptic-curve signatures that protect both Ethereum and Bitcoin wallets, and urged people to move funds to fresh addresses. 

That is one researcher’s warning, not a consensus view, and nothing has been demonstrated. We covered quantum-resistance work a few issues back, and we will cover this directly if it turns into something you need to act on.

For your Bitcoin, none of this changes anything today. The takeaway is about how to read crypto news: shutdowns, big price jumps, and scary warnings all deserve a pause before you react, and the strongest signal in each story was in the details, not the headline.

👌 Beginner’s Corner — What a Layer 2 is, and why one can shut down

You just read about three layer 2 networks. Here is what the term means.

Ethereum, like Bitcoin, can only process so many transactions at once, and each one costs a fee. A layer 2 is a separate network built on top of Ethereum that handles transactions faster and cheaper, then sends batches of them back to Ethereum for final verification.

Picture a shopping mall with one slow, crowded main entrance. A layer 2 is a side entrance with its own staff. People move through faster, but the mall still has to pay that staff, keep the lights on and send daily reports to the main office.

Running a layer 2 costs real money.

Someone pays for the servers, and someone pays Ethereum to store the batched data. The layer 2 earns that money back through small transaction fees.

That is how Abstract ran into trouble. Its apps earned about ten times what the chain itself did. The side entrance was busy, but it didn't charge enough to pay its own staff. Blast pulled in money with high yield. When the yield faded, the money left, and the fees weren't enough to cover the bills.

Neither shutdown means Ethereum itself has a problem. Individual layer 2s are businesses, and businesses can close.

If you ever hold crypto on a smaller network, ask what keeps it running, and watch for shutdown announcements, because withdrawal deadlines can be short.

You now know: a layer 2 is a cheaper side lane built on top of a bigger blockchain, and it survives only if the fees it collects cover what it costs to run.

🔭 The Long View

Now, back to the main topic. Hardware wallets have had a rough six months. 

In April, a researcher found fake Ledger units on a Chinese marketplace that sent PINs and seed phrases to attackers.

In August, the Coldcard firmware flaw we covered cost holders about $116 million. Now this. 

The causes differ each time: counterfeits, a software bug and a possible supply chain problem. 

Since 2017, we have watched people lose crypto at the handoffs, meaning who made it, who sold it and who touched it before you.

Self-custody is still the stronger setup. It just asks you to care where your device came from.

🧐 Reader’s Question

You may be asking: “Is it safer to buy a hardware wallet from a big marketplace or a local store than from the maker?”

Buy directly from the maker’s official website. We said this a few months ago. Every extra hand between the factory and you is another chance for someone to swap or alter a device. 

Marketplaces and resellers can be fine, but you cannot easily tell the good ones from the bad ones, and the maker’s own site removes the question. 

If a device arrives with a PIN already set or a seed phrase already written for you, stop and do not use it.

📌 One Thing To Do

Find the order confirmation for your hardware wallet today and check where you bought it. 

If it was the maker’s official site, you are done. If you bought it from a reseller or marketplace, contact the maker’s official support and ask how to verify your device.

If it was CryptoBilis, follow Ledger’s instructions through official Ledger channels only.

👋🏻 The Close

A week like this makes it easy to feel that nothing is safe. 

It’s okay to feel that way for a minute. Ledger has confirmed a tampered device from one reseller, and its warning still covers only buyers from that reseller. 

If you bought straight from the maker, nothing Ledger has said points at you. Take a breath, check where your device came from, and let the investigation fill in the rest.

— The Bitcoin Compass
UseTheBitcoin.com · Trusted since 2017

SOC 2 Ready in 14 days. Three sessions from you.

Enterprise buyers will not put your product near their customer data without a SOC 2 report. Sprinto gets you audit ready in 14 days, across three working sessions. AI agents do the collecting, you approve. Your auditor signs off.

Book a Demo and get $1,000 off