You’re not taking into account that the digit can occur in any of the six positions. There are $10\cdot36^5$ passwords that begin with a digit. There are also $10\cdot36^5$ passwords that end with a digit; some of these also begin with a digit and have already been counted, but some do not, so your figure of $10\cdot36^5$ is necessarily too small.
The easiest way to count the acceptable passwords is to note that there are $36^6$ six-character strings made up of upper-case letters and digits, and $26^6$ of them are made up entirely of letters, so there are $36^6-26^6$ that include at least one digit.
It is possible to count them directly, but the counting is more complicated. For each of the $6$ positions in the password there are $10\cdot36^5$ passwords having a digit in that position, so to a first approximation there are $6\cdot10\cdot36^5$ acceptable passwords. However, as noted in the first paragraph, this counts some passwords more than once. For each pair of positions in the password there are $10^2\cdot36^4$ passwords having digits in both of those positions, and all of these passwords have been counted twice. Since there are $\binom62$ pairs of positions, we must subtract $\binom62\cdot10^2\cdot36^4$ to get rid of the double-counting. Unfortunately, this overcompensates, and there are further corrections to be made. The net result, given by the inclusion-exclusion principle, is
$$\sum_{k=1}^6(-1)^{k+1}\binom6k10^k36^{6-k}\;.$$
Either way, the result is $1,867,866,560$.
Best Answer
There are $63$ ($26 + 26 + 10 +1$) allowed characters. Only one is forbidden on the first place (hyphen).
So there are 62 passwords of length 1.
There are $62 \times 63$ passwords of length 2.
There are $62 \times 63 \times 63$ passwords of length 3, etc.
Now sum up to and including length 8 (and use a formula for a finite sum of this type, if you know it).
To expand on the last bit: note that for $a \neq 1$: $1 + a + a^2 + \ldots + a^k = \frac{a^{k+1}-1}{a-1}$ (proof: multiply both sides by $a-1$). In the sum, get the 62 out, and use this result to see we can write is directly as $63^8 - 1$.
The latter suggests a direct proof of that fact. Consider all sequences of all 63 allowed characters of length 8. Remove all consecutive hyphens from the start onwards. This gives all allowed passwords exactly once. The only problem is the all hyphen word, which would result in the empty password (which I assume is not allowed). Hence $63^8 - 1$.