The Long Game: Don't Trust, Verify

The Long Game is the Hashpoint's essay series: the ideas that play out over decades, not days. Bitcoin Hashpoint, October 15, 2026

Ronald Reagan liked an old Russian proverb: trust, but verify. Bitcoin's users shortened it years ago to a rule with no room in it. Don't trust, verify. This week showed why the shorter version matters.

On October 9, buyers of Ledger hardware wallets started watching their coins leave. The thief emptied wallets on six blockchains within 47 minutes. By October 12, the tracing firm Bitquery counted $102.0 million gone from 324 wallets, valued at October 9 prices, including $16.8 million from 122 bitcoin wallets. Other investigators put the total between $72 million and $102 million, and most reports settled near $93 million. Every confirmed case traces to devices that one reseller, CryptoBilis, sold in Indonesia, Malaysia and the Philippines over the prior three months.

The devices carried a passenger. Behind the screen sat a small microcontroller, a cellular radio and an eSIM, wired into the display's data lines. When a new owner set up the wallet, the device showed the 24 recovery words, and the implant read them off the screen and sent them home over the mobile network. The man who opened the first device and found the extra board was Mark Karpelès, who ran Mt. Gox until it collapsed in 2014. The history of this industry has a sense of humor.

Ledger's own authenticity check passed the tampered devices, because the original secure chip inside still worked exactly as designed. The chip did its job. The box lied.

A popular answer to weeks like this one says to skip the hardware, put a wallet app on an iPhone, and let Apple be the insurance. Apple has a large pile of cash, the reasoning goes, so Apple will make it right if something goes wrong. It is worth testing that idea against the record, and then testing the alternative.

Checkpoint one: the box

The Ledger theft did not break cryptography. It broke a supply chain. Ledger says its own systems and direct sales channels stayed clean, and that every confirmed case involved the one reseller. On October 13, the German electronics chain MediaMarkt Saturn pulled Ledger devices from its stores and website after a customer in Germany reported an implant, though no loss of funds came with that report.

The lesson costs nothing to follow. A hardware wallet earns its trust from the factory to your desk, and every extra pair of hands in between is a place for a passenger to climb aboard. Researchers said tampered units sold for close to half the normal price. A discount on a security device is a warning label.

Checkpoint two: the app

Now test the Apple theory. In 2025, an app posing as Sparrow Wallet sat in Apple's App Store. Sparrow is a respected bitcoin wallet, and it has no iPhone version at all. Three iPhone users downloaded the fake, typed in their recovery words when it asked, and lost about $1.835 million in bitcoin between them. One of them says he reported the app to Apple on July 25, 2025. Another says he found it still listed nine days later.

Those three users did not get a check from Apple's cash pile. They filed a lawsuit on July 24, 2026, in federal court in Northern California, asking a judge to make Apple pay. Apple's public answer to fake wallet apps has been to remove them and to cite its fraud numbers: more than 2 million problem submissions rejected and more than $2.2 billion in fraudulent transactions stopped in 2025.

This was not the first time. In early 2021, a fake Trezor app stayed in the App Store from January 22 to February 3, drew about 1,000 downloads, and took 17.1 bitcoin, then about $600,000, from one man. The app carried close to five stars from 155 reviews.

So the App Store makes a fine filter and a poor insurer. Apple stands behind its own products. Nothing in the record shows it standing behind the coins inside someone else's app.

Checkpoint three: the signature

The largest theft in the industry's history happened to people who used hardware wallets. On February 21, 2025, the exchange Bybit lost more than 400,000 ether, almost $1.5 billion at the time. The FBI attributed it to a North Korean state group.

The attackers never touched Bybit's devices. They broke into a developer's machine at Safe, the company whose web page Bybit used to manage its multisig wallet, and planted code in that page. When Bybit's signers went to approve a routine transfer, the web page showed them the routine transfer, while their devices received a different instruction that handed control of the wallet to the attackers. The hardware wallets displayed the instruction only as a long string of characters that no person could check by eye. The signers trusted the web page.

A device screen only protects you if you read it, and only if it shows something readable. The rule that comes out of Bybit is short. Read the address and the amount on the device itself. If the device cannot show you what you are signing, do not sign.

Checkpoint four: the custodian

The fairest version of the Apple argument points to companies that did pay. Coinbase disclosed on May 15, 2025, that criminals had bribed overseas support agents to copy customer records, including names, addresses, balances and images of government IDs, for up to about 1 percent of its customers. Coinbase refused a $20 million ransom, estimated its costs at $180 million to $400 million, and said it would reimburse retail customers whom impostors tricked into sending funds.

That deserves credit, and it shows what custody really sells. A custodian offers a promise, and a promise is only as good as the company's balance sheet, its policy that year and its reading of your case. FTX made promises too.

The Coinbase leak also explains one of the most common attacks on ordinary holders today. The thief already knows your name, your address and roughly what you own. He calls as support and urges you to move your coins to a "safe wallet." No company that holds your coins, and no maker of your wallet, will ever ask for your recovery words.

The ledger itself

Every checkpoint so far protects your keys. The last one protects something larger: the count.

On August 15, 2010, someone mined block 74,638 and used a bug to create 184,467,440,737 bitcoin out of nothing. Users spotted the strange block that day. A patched version of the software went out within five hours, and by block 74,691 the next day the honest chain had overtaken the bad one. The extra coins vanished from the record, because thousands of independent copies of the rules refused to accept them.

In September 2018, a developer reported a bug in Bitcoin Core that would have let a miner spend the same coins twice and inflate the supply. Fixes went out within hours, and nobody ever exploited it on the real network. The safety net in both cases was the same: people running nodes that check every block against the rules.

The Hashpoint runs one. We named it Hal, after Hal Finney, who received the first bitcoin transaction. Hal lives on a palm-sized mini PC with 16 gigabytes of memory, takes 25.8 gigabytes of disk in pruned mode, and finished its first sync in about 27 hours. On October 13 it counted every unspent coin in existence: 164,940,659 separate pieces, 20,097,179.25 bitcoin in all, at block 971,170. The count took about 12 minutes.

The schedule written into the rules allowed about 80 more coins than that at that height. The shortfall is real, and it runs in the honest direction: over the years miners left some rewards unclaimed, and users destroyed a few coins on purpose. Nobody told Hal any of this. Hal checked.

No bank, fund or government offers anything like this. No one outside a central bank can count the dollars, and no private citizen can walk into Fort Knox and weigh the gold. With bitcoin, any person with a small computer can audit the entire money supply before lunch.

The case for trust

The other side has real arguments, and they deserve a fair hearing.

Self-custody moves every risk onto the owner. A lost recovery sheet, a fire or a forgotten passphrase destroys coins as surely as any thief, and no help desk can bring them back. For many people, a regulated custodian with a reimbursement policy really is the lower-risk choice, at least while they learn.

Verification costs time and attention. Most people will never read a transaction's raw data, and a security model that demands expert habits will fail ordinary users. The industry's better answer may be wallets that make the right action the easy one, rather than lectures.

And the hardware held. Ledger's secure chip did what it promised, and Ledger says no buyer who purchased directly from it lost anything in this incident. Some will read this week as a reseller scandal rather than a crack in self-custody, and the evidence so far supports that reading.

The verifier's checklist

Bitcoin asks its holders to keep a few simple habits. These cover the four checkpoints.

1. Buy a hardware wallet only from the maker's own store. Never secondhand, never at a discount, never from a marketplace seller.
2. If the packaging, the seals or the device look wrong, do not set it up. Contact the maker.
3. Let the device create the recovery words, and write them on paper or metal. Never type them into a phone, a computer or a website.
4. Get wallet apps from the link on the developer's own website, and first confirm the app exists for your phone at all.
5. Before you approve any send, read the address and the amount on the device's own screen. If it shows only a string of characters you cannot check, stop.
6. Keep spending money on the phone and savings off it.
7. Treat any call, text or email about your recovery words as an attack, whoever it claims to come from.
8. Run a node, and point your wallet at it, so your own copy of the rules checks your own coins.

The Hashpoint read

This week's thefts took nothing from bitcoin itself. The rules held, the chain held, and the cryptography held. What failed every time was a trusted middle: a reseller, an app store listing, a web page, a support desk.

That pattern runs the other way from the usual worry. The safer bitcoin gets at its core, the more attackers move to the edges, where people still take things on faith. The defense against that shift is not a richer guarantor. It is the habit the system rewards by design: check the box, check the app, check the screen, check the count.

Apple can protect an iPhone. Only the owner can protect the keys. Don't trust. Verify.

Data: Bitquery wallet tracing through October 12, 2026, valued at October 9 prices ($102.0 million, 324 wallets, six chains; $16.8 million from 122 bitcoin wallets), and the $72 million to $102 million investigator range, via Genfinity, October 13, 2026; Ledger statements of October 9, 10 and 11, 2026; BleepingComputer, Help Net Security, CoinDesk and Tom's Hardware reporting on the implant, October 12 and 13, 2026; MediaMarkt Saturn's withdrawal of Ledger devices, October 13, 2026; Ramirez, Ellis and Delgado v. Apple, U.S. District Court for the Northern District of California, filed July 24, 2026, as reported by iGeeksBlog, BleepingComputer and Cointelegraph; Apple's 2025 App Store fraud prevention figures as cited there; Malwarebytes on the fake Trezor app, April 2021; a16z crypto, "Learning from crypto's largest heist," March 7, 2025, and the FBI public service announcement of February 26, 2025, on the Bybit theft; BleepingComputer and Coinbase's SEC filing on the Coinbase data breach, May 15, 2025; Bitcoin Wiki, CVE-2010-5139 (value overflow incident); Bitcoin Optech, CVE-2018-17144; Bitcoin Hashpoint node Hal, supply audit (gettxoutsetinfo) at block 971,170 on October 13, 2026, and node profile. Structural reads, not forecasts. Nothing here is investment advice.