Retail Buyers & a Reseller Probe

Bitcoin traded at $82,621 at 04:59 UTC on October 10, 2026, 34.51% below its all-time high of $126,156 and 1.98% below its 20-day average of completed daily closes. Across 30 screened large-cap tokens, 25 rose versus October 9, led by NEAR at +4.46% and Cardano at +3.34%. Bitcoin also still holds 74.87% of a fixed basket of BTC, ETH, SOL, BNB and XRP and 60% total BTC dominance.

River Financial report showed individuals switching to net buying in the third quarter while corporate demand rested on two companies. Separately, Ledger opened an investigation into losses tied to a third-party wallet reseller.

Bitcoin Buyers Shift: Individuals Return, Corporate Bid Narrows

Fund flows turned positive for one day after a week of FBTC-led selling, while a River Financial report showed which holders bought and sold Bitcoin across 2026. Bitcoin ETF flows through October 9, across the four tracked funds:

• Flows turned positive for a day: The four tracked funds took in a net $18.8M on October 9.

• FBTC carried the week’s selling: Across the five trading days from October 5 to 9, the four funds lost $633.9M, an average of $126.78M per trading day. FBTC accounted for $380.3M, or 60.0% of that total, while IBIT finished the window slightly positive at $1.1M. Ether ETFs lost $56.1M on October 9. One positive day does not establish a trend.

• Individuals switched sides in Q3: River’s October 8 report, as reported by Crypto Briefing, shows individuals net sold about 140,000 BTC in the first half of 2026, then net accumulated 107,000 BTC in the third quarter. Across the full year to date, individuals remain net sellers of 93,000 BTC.

• The corporate bid rests on two firms: Businesses added 193,000 BTC in 2026, but Strategy and Strive together added 197,000 BTC, more than all net business buying. On those figures, the rest of the business group was a small net seller as a whole. Business inflows of $15.7B sit about two-thirds below the same point in 2025, per River.

• Miners sat on the other side: River counts miners as net sellers of 32,800 BTC in 2026, selling to fund AI infrastructure. Lookonchain data cited by CoinDesk showed MARA moving about 996 BTC ($81.13M) to a Galaxy Digital address on October 9, though CoinDesk notes a transfer alone does not confirm a sale. MARA’s holdings fell from 53,822 BTC on February 26 to 35,577 BTC by August 7.

• The rebound added little new leverage: CoinDesk reported Bitcoin futures open interest down 1.9% to $27.1B on October 9 and barely changed since the October 8 flush, while funding rates stayed positive near 5% annualized.

Interpretation: Demand looks different depending on which holders are counted. Individuals and two companies absorbed coins in the third quarter while miners sold and most other corporations stood aside. Fund flows turned positive for one day, but the five-day total still shows FBTC-led selling. River’s quarterly figures and daily ETF flows measure different groups and cannot be added together.

Ledger Reseller Probe: A Wallet’s Route to the Buyer Matters

Customers in Southeast Asia reported losing funds from hundreds of wallets after buying Ledger devices through a third-party reseller, and Ledger opened an investigation on October 9, 2026:

• What Ledger said: Ledger acknowledged reports of missing funds from customers who bought devices through reseller CryptoBilis, and asked the reseller to pause all sales and shipments while it investigates, per CoinDesk. Ledger has not confirmed the loss amount or identified a cause.

• Guidance to recent buyers: Ledger advised anyone who bought from CryptoBilis in the past 90 days not to begin setting up the device. Anyone who has already activated a wallet should consider moving funds to a new Ledger device with a newly generated recovery phrase.

• The scale is reported, not confirmed: Pseudonymous investigator Specter traced more than $86M in suspected thefts across Bitcoin, Ethereum and Tron after reports from Ledger users on X and Reddit. Arkham data shared by Specter shows nearly $87M at the flagged addresses, including about $17.6M in BTC, per Decrypt. Other on-chain trackers put the total between roughly $72M and $93M, and none of the estimates is confirmed.

• Supply-chain tampering is one possible explanation: CoinDesk describes a scenario in which a device is tampered with before it reaches the customer. The device arrives with a recovery phrase the attacker already knows, so the attacker can empty the wallet once funds are deposited. No tampering or pre-generated phrase has been confirmed as the cause.

• Ledger’s own systems are not implicated so far: The investigation concerns devices sold through a third party, and CoinDesk reports no confirmed evidence that Ledger’s systems or wallet technology were compromised.

Interpretation: The people who lost savings here had followed the standard advice to move coins off exchanges, and reported losses may run into the tens of millions. A hardware wallet keeps keys offline, but it cannot protect a recovery phrase that someone else knew before the box was opened. Coinjuice’s research on whether a hardware wallet can generate a weak Bitcoin seed examines Ledger in detail and finds that hardware wallets do not eliminate trust, they relocate it. Its companion piece on Bitkey’s seedless trust model traces the same question in a wallet with no seed phrase. 

Buying direct from the manufacturer and generating a fresh phrase on setup closes the gap a reseller opens. Coinjuice’s guide to self-custody security layers sets out which setup addresses which risk. Individuals turned Bitcoin buyers in Q3, and a reseller probe flagged where custody can break.

Coinjuice Lens: Bitcoin Ownership

River’s third-quarter figures and the Ledger probe sit on the same ownership question: how much Bitcoin ordinary holders accumulate, and how safely they keep it once bought. Coinjuice’s research on what percentage of Bitcoin retail owns tracks addresses holding 1 million to 10 million satoshis. That group grew from 850,678 addresses in 2015 to 8.3 million by June 2026 and held 1.40% of supply. Address counts and River’s holder categories measure different things, so both describe direction rather than an exact headcount. Individuals turned Bitcoin buyers in Q3, and a reseller probe flagged where custody can break.

Readers looking to buy Bitcoin without a liquidation price can start with the Coinjuice ebook, Bitcoin Trading Without Leverage, or go deeper with a Coinjuice subscription, where we start and complete trades and you will learn to snipe them independently in our private group.

News Behind Today’s Read

• Businesses add 193,000 Bitcoin in 2026 while individuals sell 93,000 (Crypto Briefing). Source for River’s Q3 individual accumulation, the year-to-date net selling, the Strategy and Strive concentration and miner selling.

• Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen (CoinDesk). Source for Ledger’s investigation, the 90-day guidance, the supply-chain explanation and the absence of evidence against Ledger’s own systems.

• Ledger Probes Potential Theft of $87M in User Funds Tied to Crypto Wallet Reseller (Decrypt). Source for the Arkham breakdown of funds at the flagged addresses, including the BTC share.

• MARA transfers $81.1 million in bitcoin to Galaxy Digital as strategy pivots to AI (CoinDesk). Source for the 996 BTC transfer, the no-sale caveat and MARA’s treasury decline.

• Bitcoin steadies near $82,500 after Trump rules out Iran strike before midterms (CoinDesk). Source for the open interest and funding rate figures behind the low-leverage rebound.

Continue the read: Oct. 9 · Oct. 8 · Oct. 7

Market Snapshot

BTC, ETH, ETH/BTC, DeFi TVL, stablecoin market cap and the token screen are as of 04:59 UTC, October 10, 2026, and figures have moved since. Source: DefiLlama. ETF flows are DefiLlama-tracked, with the most recent reporting date October 9, and may be revised. The table covers the four listed funds, and the Oct 5–9 column spans five trading days. The +21.1M,-484.9M and −$244.1M figures are all-fund totals. River Financial figures are as of River’s October 8 report, reported via Crypto Briefing, and are not independently verified against on-chain data. Loss estimates for the Ledger incident come from independent trackers and are unconfirmed by Ledger. Stablecoin market cap measures tokens issued, not usage or DeFi deposits.

This article was developed with the support of artificial intelligence tools as part of Coinjuice’s editorial process and reviewed by our editorial team before publication.

Disclaimer

The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.