Weekly Research Stack 3: Ledger Users Hit by Suspected $86M Theft as Another Ethereum L2 Shuts Down

Ledger Investigates Suspected $86M Theft as User Loses $7M Weeks After Buying Wallet

On Friday, October 9, reports of a major wallet drain spread across Crypto Twitter after onchain investigators flagged suspected losses exceeding $86 million.

Among the victims was a user identified by Lookonchain who reportedly lost 7 million USDT just three weeks after purchasing a Ledger hardware wallet.

Ledger subsequently opened an investigation involving customers who had purchased devices through CryptoBilis, a reseller operating in Southeast Asia. Investigators later discovered an unauthorized hardware implant in one affected device, raising concerns about possible tampering before the wallet reached its owner.

With CryptoBilis in the spotlight, reports emerged that the reseller changed ownership earlier in 2026. However, no evidence has established a link between the ownership change and the suspected theft.

For years, hardware wallets have been widely promoted as a safer way to store crypto by keeping private keys isolated from internet-connected devices. Ledger's investigation, however, raises another potential point of failure: what happens if a device is compromised before it reaches its owner? Even users who follow recommended security practices may be exposed if the hardware itself has been tampered with.

Ledger has yet to confirm the full extent of the losses, although blockchain analytics firm Bitquery estimated that $92.9 million was drained from 311 wallets across TRON, Bitcoin, Ethereum, BNB Chain and Polygon, exceeding initial estimates of $86 million.

Beyond the financial losses, the investigation highlights how self-custody security extends beyond keeping private keys offline. Trust also depends on hardware integrity and the distribution channels through which users buy devices.

Securitize Launches Fully Backed Tokenized Stocks On Solana

As competition in the tokenized asset market intensifies, Securitize has established itself as a major player in bringing traditional financial assets onchain, including BlackRock's BUIDL fund and other tokenized investment products. In July, the company expanded into equities by tokenizing its own publicly listed shares, SECZ, on Solana and Avalanche.

Despite the growing accessibility of tokenized stocks, a key gap remains between owning a token that tracks a stock's price and holding one that carries enforceable rights linked to the underlying shares, leaving investors exposed to different legal and custodial arrangements by product.

Recent regulatory developments have brought renewed attention to these distinctions. Against this backdrop, Securitize launched Securitize Stocks on October 8, introducing 12 tokenized U.S. equities on Solana, including Apple, Nvidia, Microsoft, Tesla, Meta and Amazon.

Unlike products that offer only synthetic exposure to stock prices, Securitize Stocks use a Convertible Entitlement Token (CET) structure, with each token backed 1:1 by underlying shares held through Securitize Markets' regulated brokerage infrastructure.

However, holding a CET does not automatically make an investor a directly registered shareholder of Apple, Nvidia, or Microsoft. Investors instead hold legally recognized entitlements to shares maintained through a securities intermediary.

If the underlying company later adopts issuer-sponsored tokenization, the CET structure could provide a pathway to convert those entitlements into shares recorded directly by the issuer's transfer agent, subject to the necessary arrangements.

Early onchain trading activity has been modest. Analytic Sages' analysis of transactions across the 12 newly launched Securitize Stocks identified 43 executed trades totaling approximately $5,724 between October 8 and 10, involving 19 unique trading wallets.

An October 11 snapshot also identified 38 addresses holding nonzero token balances, including market-making inventory accounts with highly concentrated trading, as one wallet accounts for 86.52% of recorded volume.

Igloo Inc. Winds Down Abstract to Refocus on Pudgy Penguins

Abstract, the consumer-focused Ethereum Layer-2 developed by Igloo Inc., the company behind Pudgy Penguins, has announced plans to shut down on December 15, less than two years after its highly anticipated launch.

Users have been advised to migrate their assets before the deadline or risk losing access to funds remaining on the network.

When Abstract launched in January 2025, expectations were high.

Backed by Pudgy Penguins' established community and an $11 million funding round led by Founders Fund, the network promised to make crypto accessible to everyday users through simplified onboarding, games, and consumer applications.

Launch-day activity reached about 711,000 transactions, but attracting meaningful liquidity proved difficult from the start, with just $33 million in assets secured in its first few days. Over time, Abstract attracted hundreds of thousands of users and processed more than 325 million transactions.

Yet this activity failed to translate into a sustainable business for Abstract. Around the shutdown announcement, the network generated approximately $3,900 in daily chain fees, equivalent to a monthly run rate of just $117,000, while applications operating on Abstract earned revenue at an estimated monthly pace of $1.17 million.

Igloo CEO Luca Netz said the company had spent tens of millions of dollars supporting the network over 18 months without finding product-market fit, citing insufficient liquidity, a limited DeFi ecosystem, and high operating costs.

News of the shutdown also sparked disappointment among parts of Abstract's community, particularly users who had spent months participating in its XP rewards program in anticipation of a potential token airdrop. With no Abstract token planned, some questioned what would become of the time and money invested in accumulating rewards. Others supported the decision not to launch a token simply to keep an economically struggling network alive.

Disclaimer

This research is provided for informational and educational purposes only and should not be considered financial, investment, legal, tax, or trading advice.

Analytic Sages makes reasonable efforts to ensure that the information, data, and analysis presented are accurate at the time of publication. However, markets, protocols, regulations, and onchain data can change quickly, and third-party information may be incomplete, delayed, or subject to revision.

Any views, interpretations, or conclusions expressed are based on the available data and research methodology at the time of publication and should not be treated as guarantees of future performance or outcomes.

References to tokens, protocols, companies, funds, or financial products do not constitute an endorsement or recommendation to buy, sell, or hold any asset. Readers should conduct their own research and, where appropriate, consult qualified professional advisers before making financial or investment decisions.

Past performance is not indicative of future results.