Inflation came in hot twice this week. September’s consumer prices rose 3.7%, wholesale prices jumped 6.3% — the biggest leap in four years — and the odds of a rate hike on October 28 doubled in a single day.
Bitcoin finished the week down less than one percent.
This is your weekly crypto brief for the week ending Sunday, October 18, 2026. The reason crypto shrugged at two hot inflation prints is sitting in the detail of those prints, and it is worth understanding. Meanwhile the Ledger story got considerably worse: four retailers across three countries, a forensic estimate of $102 million, and a phishing campaign built on top of the original attack.
What actually moved
A week that looked alarming in the middle and ordinary by the end.
Bitcoin (BTC): opened near $82,100, fell to $80,617 on Thursday after the inflation data, recovered to about $82,325 on Friday, then eased to $81,410 on Saturday. Down roughly 0.9% on the week.
Ethereum (ETH): the week’s underperformer. Dropped to $2,349 on Thursday, a 6.6% daily fall, and sat near $2,407 over the weekend. Bitcoin is down 25.9% over twelve months; Ethereum is down 38.8% over the same period, and that gap has been widening all autumn.
Solana (SOL): $101.85 at Thursday’s low, down 6.0% on the day.
XRP: $1.30 at Thursday’s low, down 5.9%.
Market-wide: total crypto market cap around $2.83 trillion, essentially unchanged on the week. Bitcoin’s market cap is about $1.64 trillion.
Fear and Greed reads 55, still technically greed but easing from 64 last week and 73–74 three weeks ago. The Altcoin Season Index sits at 61 out of 100, which it labels “Bitcoin Season.”
Altcoins again fell harder than Bitcoin on the down days — roughly double, as they did last week.
Two inflation prints, and both were made of petrol
Wednesday brought September’s Consumer Price Index, and the headline was ugly.
| Month on month | Year on year | Forecast | |
|---|---|---|---|
| Headline CPI | +0.6% | +3.7% | 3.6% |
| Core CPI | +0.3% | +2.6% | 2.5% |
| Energy | +5.2% | +20.4% | — |
| Gasoline | +9.1% | +34.2% | — |
| Shelter | +0.4% | +3.2% | — |
| Food | 0.0% | +2.5% | — |
Thursday brought the Producer Price Index, and it was worse: +1.3% on the month and +6.3% on the year against 5.3% expected. The biggest jump in four years, again with energy named as the driver.
Now look at the composition. The BLS release states that gasoline alone accounted for over half of the monthly increase in the all-items index. Airline fares are up 22.4% on the year — also fuel. Food was flat on the month. And core CPI, which strips out food and energy, is running at 2.6% against a headline of 3.7%.
That is a 1.1 point gap between what prices did and what prices did once you remove the stuff being priced by a geopolitical event.
Because that is what this is. Brent crude is above $106, driven by the US–Iran tension this brief covered a fortnight ago. The chain runs: tension, then oil, then petrol at the pump, then both inflation indices, then rate expectations. This week’s inflation story is two weeks ago’s geopolitics story arriving on a delay.
Two honest caveats. Core did beat its forecast, so this is not purely an energy story. And an oil shock is not harmless just because it is narrow — it raises costs for everyone, and no central bank can reliably tell “inflation to look through” from “inflation becoming embedded” in real time.
Still, a market deciding that 3.7% made mostly of petrol differs from 3.7% made of everything is not behaving irrationally. It is reading past the headline.
The Fed, the odds, and an election six days later
Odds of a hike at the October 27–28 meeting went from roughly 22% to 41.5% in a day on the CPI print. That is a doubling.
The analyst consensus still points past October, though. UBS expects a December move. RSM expects 25 basis points in December. Reuters reported the Fed may skip October in favour of December. Polymarket prices 66% odds of exactly two hikes this year, 21.7% for three, 11.5% for one.
And here is the detail almost nobody is leading with. The October 28 decision lands six days before the November 3 midterm elections. The Federal Reserve has raised rates within seven days of an Election Day exactly once since 1990 — on November 2, 2022.
The Fed states that it does not factor the electoral calendar into policy debates, and that should be taken at face value rather than winked at. But something that has happened once in thirty-six years is worth knowing before you treat a 42% probability as the whole story.
For context: Kevin Warsh has chaired the Fed since May 2026. September’s quarter-point rise to 3.75–4.00% was the first hike in three years and unanimous, which Warsh described as removing “a dose of accommodation.” An October hike would take the range to 4.00–4.25%.
Week two of the Ledger story, and it is now considerably bigger
Last Sunday this brief reported Ledger confirming an unauthorised implant in one device from one Southeast Asian reseller. Seven days later the picture is wider in every direction.
What has been confirmed
On Tuesday, Ledger Donjon — the company’s own security lab — confirmed that signers sold by the reseller CryptoBilis contain unauthorised LTE implants. The implant captures the 24-word recovery phrase as it is displayed during device setup and transmits it using a provisioned eSIM.
In Ledger’s own framing: the implant does not modify the Secure Element or Ledger’s operating system, and does not alter transactions or signatures. It reads the screen. That is the entire attack, and it is enough.
Four retailers, three countries
- CryptoBilis, the authorised reseller in Indonesia, Malaysia and the Philippines where the investigation began.
- MediaMarktSaturn suspended Ledger sales across its European stores and online after a customer in Germany reported an implanted device. No funds were lost in that case.
- A MetaPod outlet at Singapore’s Changi Airport, where Mark Karpelès reported finding an implant in a Ledger Flex.
- Challenger’s VivoCity store in Singapore, linked to another allegedly modified Flex.
Ledger has now asked resellers and distributors across Southeast Asia and Hong Kong to suspend sales and remove products from shelves while the investigation continues. A community-maintained catalogue logs 15 reported devices across nine named sellers, spanning Southeast Asia, Japan and Europe, across the Nano X, Nano S Plus, Flex and Stax.
That catalogue is being quoted as established fact, and it isn’t. It is not verified by Ledger, a seller appearing in it does not establish that the seller knowingly supplied a modified device, and the device count cannot be used to estimate losses.
Ledger inspected retail and distributor stock across Germany, including the named stores, and found no signs of tampering. It says no implant-related losses have been reported in Europe.
The forensics
Ledger has still not confirmed a loss figure. The most detailed independent analysis comes from Bitquery, which traced $102.0 million taken from 335 wallets across six chains:
| Chain | Wallets | Taken |
|---|---|---|
| TRON | 151 | $79.3M — almost all USDT |
| Bitcoin | 122 | $16.8M (203.8 BTC) |
| Ethereum | 33 | $3.7M |
| BNB Chain | 27 | $1.45M |
| Polygon | 13 | $0.58M |
| Solana | 4 | $0.25M |
Look at that top row. Roughly 78% of everything stolen was Tether on TRON. The victims were overwhelmingly people holding stablecoins, not people holding Bitcoin — and the Bitcoin that was taken, all 203.8 of it, had not moved as of the last check while the stablecoins were gone within hours.
On the laundering: Tether froze $10 million of USDT across 20 wallets. The attacker responded by swapping about $23.7 million into USDD, which Tether cannot freeze, then into ETH via THORChain. Roughly 7,700 ETH went through Tornado Cash between October 9 and 16, with most of it coming out and moving on through Zcash. As of Friday, about $81 million was still traceable on-chain.
And now there is a scam built on top of the scam
This was predictable and it has happened. On Friday, SlowMist warned of a phishing campaign impersonating an official Ledger firmware update, using the CryptoBilis incident as the lure.
The fake pages copy Ledger’s real flow closely — including a counterfeit “Genuine Check” page, a device selection screen and an “Update Now” button. The entire purpose is to get you to type your 24-word recovery phrase into a website.
So, plainly:
- Ledger does not email you asking you to update your firmware. Nobody does.
- Real updates happen inside the Ledger Wallet app, with every step confirmed on the device’s own screen.
- Never type your recovery phrase into a website, a form, a support chat, a “genuine check” tool or a photo-check tool. There is no legitimate version of that request.
If you have lost funds, coordinate with law enforcement before opening the device — opening it destroys evidence.
The competitors are shrinking their distribution
- Trezor found no evidence its own devices were compromised, and is ending authorisation for selected resellers anyway, effective January 1, 2027. Purely preventive.
- OneKey reported no customer losses, revoked CryptoBilis’s authorisation, and is offering free replacements for devices bought through it between March 1 and October 13.
Two manufacturers voluntarily cutting their own distribution networks inside a week tells you more about how the industry reads supply-chain risk than any of the loss estimates do.
Ledger launched a product in the middle of it
At its Paris event on Thursday, Ledger unveiled Atom — an Android device running alongside Ledger OS on an EAL6+ secure element, with an FPGA-isolated secure mode, a physical switch that cuts power to the camera and microphone, tamper detection on the screen and enclosure, a back cover paired to the specific device, and tamper sensors that run on their own battery when the device is off. Ledger says its “Core Protection” feature would block exactly this kind of screen-reading implant.
The numbers: $849 for a Founder’s Edition, $899 afterwards, delivery expected summer 2027. Ledger’s current range runs $69 to $399.
The engineering may well be the right long-term answer. It is worth being clear that a device arriving in roughly twenty months at twice the price of the current line does nothing whatsoever for someone who bought a wallet in September.
The counterpoint: a decade-old bug, found and fixed properly
This is the most useful story of the week, because it is the mirror image of everything above.
What it was: an arithmetic overflow in the XRP Ledger’s payment engine, dating back to 2015. When a payment consumed multiple order-book offers, the engine added up the amounts owed using a 64-bit integer and never checked whether the total overflowed. It wrapped around to a small number — so sellers were credited in full while the buyer was charged a fraction, and the difference would have been newly created XRP. Two safeguards failed alongside it.
Ordinary payments could not trigger it. It needed deliberately constructed transactions far outside normal trading.
What happened next: it was reported on September 22 through the XRPL bug bounty programme by researcher Cayden Liao of Veria Labs, who says an AI security agent helped connect the weaknesses. RippleX engineers reproduced it and raised the severity from Major to Critical. On September 25 it was patched in xrpld 3.4.1, and more than 80% of default validators upgraded that day — the fix taking effect on upgrade rather than waiting out the usual two-week amendment process. Veria received the maximum $250,000 bounty.
It was never exploited. No evidence of exploitation was found on any public network, and the XRPL Foundation’s monitoring found no unauthorised issuance. No XRP was created. The supply is intact.
About the “18 trillion XRP” headlines: Veria’s proof of concept could have created roughly 18.45 trillion in a single transaction, about 184 times the entire supply. That is a demonstration of what the flaw permitted in a test environment, not tokens that exist.
Why this belongs in the same brief as the Ledger story. For six weeks this brief has argued that the cryptography and the protocols are not where crypto’s failures are happening. This week a genuinely critical protocol flaw turned up in a top-five chain, and the process worked exactly as it should: a bounty programme, a researcher who disclosed responsibly, three days to a patch, same-day adoption by most of the network, nobody harmed.
And the uncomfortable half of it: nobody noticed for ten years. “Handled well” and “reassuring” are not the same sentence.
MSCI is removing Bitcoin treasury companies from its indices
On Thursday evening, MSCI decided to go ahead with classifying “non-operating companies” as ineligible for its GIMI indexes. Strategy and Metaplanet were on the provisional removal list.
The dates: the final removal list arrives November 11, and exclusions take effect at the close of trading on November 30.
What it actually means, because it is being overstated nearly everywhere. Exclusion is not delisting — Strategy stays listed and tradable. Funds tracking MSCI World and MSCI USA would need to adjust by the November 30 close, while other index families follow their own rules. Strategy estimates only 3–4% of its shares sit in MSCI-based funds and its CEO expects no material price effect. Bitcoin did not move on the announcement; Strategy’s shares fell about 1.5% after hours.
And the $2.8 billion JPMorgan “passive selling” figure being quoted everywhere refers to the earlier proposal, not the rule MSCI adopted. If you see that number this week, it is attached to the wrong document.
The part that might apply to you: plenty of people hold a global index fund without realising it carries indirect Bitcoin exposure through a treasury company. For some, that disappears on November 30. Search your fund’s holdings list for “MSTR” or “Strategy Inc” — noting a list dated before the reshuffle will not show the change.
ETF flows: Ethereum outflows overtook Bitcoin
US crypto ETFs across five categories lost $610.7 million over the week — down about 52.5% from the previous week’s $1.29 billion.
| Category | Net flow |
|---|---|
| Ethereum | −$320.1M |
| Bitcoin | −$228.4M |
| Solana | −$25.5M |
| Zcash | −$19.2M |
| Hyperliquid | −$17.5M |
Ethereum outflows exceeding Bitcoin’s is the notable part, and it came almost entirely from one fund: BlackRock’s ETHA at −$299 million, roughly 93% of the category total. On the Bitcoin side, IBIT lost $165.4 million and Fidelity’s FBTC $60.2 million. Wednesday — CPI day — was heaviest at −$393.4 million, and Tuesday was the only net inflow session. Daily figures are at Farside Investors.
Keep last week’s framing in mind. Nearly half of all 2026 trading days have been net negative and the year is still positive overall. A week at half the previous week’s outflow is not a story — it only looks like one reported a day at a time.
Three more exploits, and the numbers behind the pattern
Beyond Ledger and XRPL: Autheo (THEO) lost roughly $1.7 million to a Hyperlane bridge exploit on Base and the token fell 92%. Demex is shutting down permanently after a $192,000 bridge exploit in September, with the team covering the shortfall. The gambling platform Gamdom lost about $4.3 million after an unauthorised connection to an automation server.
The one that deserved more coverage than it got: Pirate Chain (ARRR) had its transparent layer exploited through the “Ironwood” turnstile that tracks supply as funds move between layers, potentially corrupting supply records. Developers rolled the chain back to its October 14 state, exchanges paused deposits and withdrawals, and users were told not to use their wallets.
The figures that put six weeks of this into proportion, via DeFiLlama and TRM Labs: about $1.195 billion lost to hacks in 2026, and 207 hacks in the first half of the year against 85 in the first half of 2025. Of those, smart contract exploits accounted for 125 incidents — but compromised keys, custody systems and signing infrastructure drove most of the value actually stolen.
That split is worth stating precisely, because this brief has been making a looser version of the point for weeks. Code bugs are the most numerous failures. Credential and infrastructure compromise causes most of the losses. Both are true and they are not the same claim.
Regulation: one deadline closed, one lands Tuesday
The CFTC’s Advanced Notice has been published in the Federal Register, and comments close December 14 — the one date last week’s brief could not give. The substance is unchanged: Regulation CTX defining when federal oversight attaches, Regulation CAM creating an optional registration for exchanges offering retail leverage, and “actual delivery” tied to the customer holding their own keys.
The nearer one: the SEC’s Regulation Crypto Assets comment period closes on Tuesday, October 20. Also new, Australia’s ASIC proposed standards for digital asset and tokenised custody platforms, with feedback due November 27.
Elsewhere this week
Deutsche Bank is weeks from launching crypto custody. Chainalysis projects Bitcoin inflows to the US turning positive in 2026. Cross River clients can now use Ripple’s RLUSD for round-the-clock international settlement over the XRP Ledger in selected US states, and Ripple Prime launched real-world-asset perpetual swaps for institutions across 100+ reference markets.
Lido enabled direct ETH staking from Arbitrum, Base, Linea and Optimism via Chainlink’s cross-chain protocol. Starknet opened a non-binding holder poll on researching a move to an independent, quantum-resistant Layer 1. Tether Capital invested in AI-agent payments firm AIsa.
What to watch
Tuesday October 20: the SEC’s Regulation Crypto Assets comment period closes.
October 27–28: the FOMC meeting, with hike odds around 42% — six days before the midterms.
November 3: US midterm elections.
November 11: MSCI publishes its final removal list. November 30: exclusions take effect at the close.
December 9: the FOMC meeting with updated projections, which most analysts still see as the likelier hike. December 14: CFTC comments close.
Ongoing: the Ledger investigation — a confirmed loss total, a confirmed cause, whether more retailers are implicated, and whether there is any compensation.
Price levels: Thursday’s $80,617 low sits within $200 of last week’s $80,427. Two consecutive weekly lows that close together is itself worth watching. Above, the broken $83,000–$87,000 range still caps.
The bigger picture
For two months this brief ran on a simple premise: rates up, crypto down. Three weeks ago it stopped explaining the weeks.
Hike odds collapsed and crypto went nowhere. Then minutes read hawkish about December and crypto fell. This week inflation ran hot twice, October hike odds doubled, and crypto finished down less than a percent.
What connects all three is that the headline number is rarely the thing doing the work. Two weeks ago it was whale selling into a technical ceiling. Last week it was a billion dollars of leveraged longs beneath a range. This week it is that 3.7% made mostly of petrol is not the same event as 3.7% made of everything, and enough people worked that out. The useful question is never “what was the number” but “what was it made of, and who was positioned for it.”
On security, the week delivered both halves of the argument at once. A hardware supply chain was compromised across four retailers in three countries and $102 million left 335 wallets. And a critical protocol flaw dating to 2015 was found, disclosed, patched in three days and never exploited. The code is not the weak point. The boxes, the vendors, the warehouses and the people are — and that is exactly the part you cannot audit from your sofa.
Next Sunday’s weekly crypto brief will cover the October 28 FOMC, the SEC comment deadline’s outcome, and wherever the Ledger investigation has got to.
Where to go next:
- New here? Start with our beginner path, or dollar-cost averaging crypto — the approach that does not require you to interpret an inflation print correctly.
- This week’s lead story is about hardware wallets and recovery phrases. How crypto wallets work explains what a recovery phrase actually is, and why a chip reading one off a screen is enough to take everything.
- Buying a device or your first coins? How to buy crypto safely — and buy hardware direct from the manufacturer.
- Why do the smaller coins always fall harder on a bad day? Why do crypto prices move together.
- Why does forced selling move price further than the selling itself? What is liquidity in crypto.
- Down 32% from the record high but above the long-term averages — bull market or bear? Crypto market cycles.
- New to the major chains? What is Bitcoin, What is Ethereum, What is Solana, What is XRP, What is Cardano.
See you next Sunday.
A note on financial advice
This brief is for education, not investment advice.
The single most useful thing in this week’s brief costs nothing and takes a second to learn: no legitimate service will ever ask you to type your 24-word recovery phrase into a website, a form, a support chat or a “check if you are affected” tool. Not Ledger, not Trezor, not an exchange, not a support agent. A phishing campaign impersonating a Ledger firmware update went live on Friday, complete with a fake “genuine check” page. If you only remember one thing from this week, remember that one.
The second is quieter. Of the $102 million taken in the Ledger attack, roughly 78% was Tether on TRON, and the stolen Bitcoin still had not moved days later while the stablecoins were gone within hours. Stablecoins feel safe because the price does not change. That is a different property from being hard to steal, and the two get conflated constantly.
On the market: a 42% probability is not a prediction and not a reason to act — it means the people pricing it do not know either. And Fear and Greed has now spent roughly a month between 50 and 74, which is historically a worse environment for large decisions than a reading of 25, even though it feels considerably more pleasant.
Only invest what you can afford to lose entirely, and make your own decisions based on your own situation.