'Be Your Own Bank' Sometimes Calls for an Audit

Contribution by Erik

If you've ever peeled the plastic off a hardware wallet, you may have heard a little voice in the back of your head: “I assume nobody has tampered with this, but how do I know for sure?” As we reported last week, an estimated $90 million or so has been siphoned out of newly set-up Ledgers that had been tampered with. The compromised Ledgers were mainly, but not exclusively, delivered to customers by the reseller Cryptobilis in Southeast Asia.

The affair is yet another painful reminder that every weak link in the security chain will sooner or later be exploited by bad actors. In this case, a component added by the hackers read the freshly generated seed phrase straight off the screen. It's not unlike the way ATMs get skimmed.

Last week we mentioned in passing that the incident might not have stayed confined to Southeast Asia. Since then, a number of Ledgers have turned up outside that region, including one bought at a MediaMarkt in Germany. Ledger itself says its inspections in Germany turned up no compromised wallets.

Mark Karpelès maintains a list that, as of October 18, included fifteen devices from nine named sellers, with purchase channels in Southeast Asia, Japan and Europe, including Nano Xs from MediaMarkt in Germany and via Russia's Ozon. Still, the spill appears to be fairly contained. No large numbers of affected Ledgers have yet been found in Europe. The MediaMarkt group has pulled Ledgers from its shelves. 

Rival Trezor said it is reducing its number of authorized resellers so it can keep a closer eye on those that remain. Purely as a precaution, the company stresses.

If you've bought a Ledger in recent months from anywhere other than Ledger itself, it's wise not to use it. If there are already funds on it, move them to another wallet or exchange (it's theoretically possible that even a tampered Ledger hasn't been drained yet, and that this will still happen once the balance grows larger). Opening up the Ledger will give you a definitive answer, but not everyone is keen to do that.

Being your own bank: easier said than done

We all know about climate change, but it's only when a flood hits a few towns over that reality truly sinks in: do you actually want to live here? And if so, have you taken enough precautions?

Over the past few months, the crypto community has been hit by a few ‘natural disasters’. Although the scale of the damage was smaller than, say, the Bybit hack of 2025, the sense of insecurity runs deeper. It strikes at the very heart of the security chain.

So where do we stand now, after the Coldcard bug and the Ledger affair? Our conclusion is not that hardware wallets can no longer be trusted. But it has once again been driven home that the odds are not zero that all the crypto on one of your hardware wallets could vanish overnight. Sure, victims of these hacks could have protected themselves with a passphrase, with multisig… but as we know, those solutions introduce new risks of their own, centered on your own mistakes. You're not an infallible system either.

With the risk of ruin fresh in our minds again, now is not a bad time to take another look at how your portfolio is allocated and how it's set up. Have you built in optionality? Is it true that no single incident can lead to total loss? Start top-down. What share of your wealth do you put into crypto compared with other assets like stocks, savings and real estate? Physical gold in a vault has nothing to fear from a banking crisis. Your savings have nothing to fear from a Ledger hack, and so on. Think carefully about that balance.

Then there's the implementation. For each asset, how do you make sure it isn't exposed to the risk of ruin? Zooming in on your bitcoin, you might consider spreading your holdings across multiple hardware wallet brands, but also across exchanges or ETFs. 

Listen to Bart's in-depth reflections on this in the latest episode of Satoshi Radio (from the 45-minute mark).

More Alpha

Are you a Plus member? Then read on for the following topics:

1. Agent micropayments are taking off
2. Strategy at risk of being dropped from the MSCI index

After that come the news snacks, a handy roundup of the news that really mattered this past week.

1️⃣ Agent micropayments are taking off

Contribution by Erik

A Chainalysis report on crypto adoption in North America includes a section on payments made by AI agents. It zooms in on x402, the payment protocol for AI agents that has processed more than 138 million transactions on Base alone, Coinbase's layer-2 network on Ethereum. And the spending patterns are showing signs of maturity.

2026 North America Crypto Adoption: $3.02T, Agentic Rails

Chainalysis explains how the US dominates agentic commerce and how Canada’s immigration trends shape stablecoin adoption.

ChainalysisChainalysis Team

As you read this, somewhere an AI agent that has written some code – say, a smart contract for Ethereum – wants to have it checked for vulnerabilities. Another AI agent quotes a price: 89 cents, payable in USDC. The first agent's wallet pays, the transaction settles within seconds, and a few minutes later a security report is ready. No human ever clicked 'approve'.

This isn't a vision of the future but a service that already exists: AgentLISA, an auditing service that itself runs on a language model and is named in the report. Until now, agentic commerce has largely been a story of aggregate figures. In its annual report, Chainalysis looks beneath the surface for the first time.

From experiment to habit

The share of wallets topped up again within thirty days rose from 71% for the Q3 2025 cohort to 89% for the Q2 2026 cohort.

Even more telling is how much faster wallets become active. At the end of 2025, when the protocol was still new, the median time between a wallet being funded and its first x402 payment was 73 days. By Q3 2026, that gap had shrunk to 18 minutes. Wallets are being created for a task that's already lined up, with money that needs to move from A to B right away.

x402 transactions on Base

x402 is the payment system, launched by Coinbase in 2025, that lets software pay per usage event in stablecoins. On Base, still the largest chain for agent payments on a cumulative basis, it accounted for more than 138 million transactions. Almost all of them were tiny: more than 87% fell between a hundredth of a cent and ten cents, with the bulk between 1 and 10 cents per transaction. Chainalysis doesn't give a total amount. External trackers put cumulative x402 volume across all networks combined at a few tens of millions of dollars.

Where the money goes

What is the money being spent on? Not memecoins, but information-oriented services: code reviews, financial intelligence, search APIs and, above all, paying for LLM output. Chainalysis calls that last category, model inference, one of the largest, though the report doesn't give a hard percentage. It does show how sharply the division of labor follows national borders. Of all traceable model inference transactions, 88% came from US wallets and just 0.1% from Chinese ones. Conversely, roughly nine out of ten payments for security and code analysis came from China-linked wallets, almost all of them going to a single address: AgentLISA.

Conclusion

The takeaway remains modest. A few tens of millions in volume doesn't move the needle on a global scale. Still, for the first time we can see that behind those cents lies a pattern of genuine economic activity.

2️⃣ Strategy at risk of being dropped from the MSCI index

Contribution by Erik

Index provider MSCI has adopted a methodology that may mean bitcoin company Strategy no longer qualifies for its index. The reason: it is deemed a 'non-operating company'. The likely removal takes effect on December 1. A setback for Strategy, but not a knockout blow. Granted, it loses the steady 'bid' from passive index funds. But those currently own only about 3% of the shares.

MSCI has concluded that companies without substantial operating activities do not belong in the MSCI Global Investable Market Indexes. Strategy, which started out as MicroStrategy and still has its original software business, has in recent years become predominantly an assortment of bitcoin-related investment products. 

Other treasury firms hit too

Based on an initial screening, MSCI identified three companies: Strategy, Japan's Metaplanet and Yellow Cake, a UK company that holds physical uranium. The latter shows that the new rule isn't aimed solely at crypto, but at structures where a stock listing mainly serves as a wrapper for a single asset. 

Even so, many Strategy fans will see that mostly as a pretext to stick it to Michael Saylor. Saylor himself responded to the news fairly nonchalantly. Speaking to Bloomberg, he called the rules biased against digital assets. He did add, however, that the bear market appears to be over and that good times lie ahead for the company, which holds more than 800,000 BTC on its balance sheet.

10% share price drop

Index funds tracking MSCI hold, according to JPMorgan, around 13 million shares, worth roughly $1.8 billion at Friday's closing price. That sounds like a hefty sum, but MSTR is one of the most heavily traded stocks on Nasdaq. The market is expected to absorb that amount within a few trading days – and there are still six weeks to go. MSTR's share price fell nearly 10% on Friday.

There is a lasting downside, though. Being part of the index means that a fixed small slice of every dollar flowing into a global index fund ends up with that company. That flow now stops. From here on, Strategy has to win over every one of its buyers. In bull markets, mind you, that's not hard. Strategy is the only company offering its buyers a whole range of bitcoin-related financial products. That's so distinctive that the vast majority of buyers will come from outside the ranks of passive investors anyway.

Strategy isn't in the S&P 500, but it is in the Nasdaq-100. Nasdaq has no comparable rule under consultation.

🍟 Snacks

To wrap up, a few quick snacks:

• Qivalis takes a big step toward a European euro stablecoin. The consortium consists of 37 banks from fifteen countries, including ING, Rabobank and ABN AMRO. On Wednesday, it received an electronic money institution license from DNB, clearing a major hurdle under MiCA. According to Spanish media, Qivalis is aiming for a November launch on Ethereum. The ambition: European digital money for payments, crypto trading and onchain securities.
• Operation Choke Point 2.0 was real, the OCC confirms. According to the US regulator, banks systematically excluded entire sectors, including crypto, from banking services. That finally gives years of suspicions official backing. Although the OCC considers this dynamic highly undesirable, the underlying problem is likely to persist: banks are expected to act as police officers, and their risk policies shift with the political winds.
• Trump's White House crypto team has largely departed. This week it emerged that the head of the presidential council, Patrick Witt, is stepping down. The reason is procedural: his temporary appointment has expired. Bo Hines, David Sacks and Harry Jung had already left their posts. The reasons vary, but the exodus is striking given the deadlock over the Clarity Act. For now, it's unclear who will take the lead in the stalled negotiations.
• Whatever AI leads to, bitcoin wins, argues Bitwise CIO Matt Hougan. Strong productivity growth is good for scarce assets, Hougan writes. But even if AI growth turns out to be a bubble, and that bubble bursts, bitcoin still comes out ahead. In that scenario, Hougan expects bailouts and liquidity injections that will push bitcoin higher. And if it all comes down to moderate growth? Then further adoption and ETF inflows will supply the necessary momentum. In his letter to Bitwise investors, Hougan nails his colors to the mast: he's optimistic.

Thank you for reading!

To stay informed about the latest market developments and insights, follow our team members on X:

• Bart Mol (@Bart_Mol)
• Peter Slagter (@pesla)
• Bert Slagter (@bslagter)
• Mike Lelieveld (@mlelieveld)

We appreciate your continued support and look forward to bringing you more comprehensive analysis in our next edition.

Until then!