A sophisticated attack targeting Ledger hardware wallets, which has already resulted in an estimated $93.4 million in losses from users in Asia, has reportedly extended its reach to Europe. The incident has sent ripples of concern through the cryptocurrency community, highlighting the persistent threat of advanced hardware-based exploits.
User Johannes, a European customer, took to the social media platform X (formerly Twitter) to share photographic evidence of a tampered Ledger device he claims to have purchased approximately two weeks prior from MediaMarkt, a prominent European consumer electronics chain. The images revealed an internal modification that appears to be an earlier iteration of the implant previously identified in devices distributed by CryptoBilis in Asia. Crucially, Johannes reported that no funds had been compromised from his device, leading to speculation about the attackers’ strategy.
"Either the device didn’t work, or they were waiting for a more widespread usage of the compromised devices," Johannes commented, as quoted in the original report. This suggests a potential phased approach to the exploit, with attackers possibly observing the distribution and utilization of the compromised hardware before initiating fund transfers.
Mark Karpeles, the former CEO of Mt. Gox and an individual who has been actively investigating the tampered Asian Ledgers, provided further insight into the potential regional variations of the attack. Karpeles noted that the antenna found within the European device is labeled as the "Eurasian version," indicating that separate implant designs may have been developed and deployed to regions utilizing different mobile frequencies. This detail suggests a level of planning and sophistication in tailoring the exploit to specific geographical markets. However, Ledger has not yet officially confirmed whether the European device reported by Johannes is part of the same attack vector that affected Asian users.
The initial wave of the sophisticated attack surfaced late last week, primarily impacting Ledger devices sold through the official reseller CryptoBilis in Southeast Asia. CryptoBilis, which had recently undergone a change in ownership, became the focal point of the investigation after modified devices were discovered. The modification was reportedly designed to enable attackers to extract seed phrases, the master keys to cryptocurrency wallets, even while the devices appeared to pass standard authenticity checks. This stealthy approach allowed attackers to potentially access funds without raising immediate suspicion.
In response to the unfolding crisis, Ledger urged CryptoBilis to immediately suspend all sales and shipments of its devices as a precautionary measure. The company also issued a public advisory, recommending that customers who had purchased devices from CryptoBilis within the preceding 90 days consider transferring their digital assets to a new, verified Ledger device. In an update, Ledger stated, "The volume of impacted devices is limited," aiming to reassure its user base about the scale of the breach.
CryptoBilis is officially recognized as an authorized Ledger reseller in several Southeast Asian nations, including Indonesia, Malaysia, and the Philippines. While Ledger has not publicly confirmed the total financial losses, the cybersecurity outlet Yfarmx has estimated the damages to be around $93.4 million, affecting an estimated 471 cryptocurrency addresses. This figure remains an estimate and has not been independently verified by Ledger.
The implications of this attack are significant for hardware wallet users, who rely on these devices for the highest level of security in managing their digital assets. The fact that the exploit bypasses authenticity checks and targets the fundamental seed phrase raises critical questions about the supply chain security and the potential for sophisticated hardware-level tampering. The alleged spread to Europe suggests that the threat may be broader than initially anticipated, necessitating increased vigilance from consumers and further investigation from manufacturers.
Security Firm Uncovers XRP Minting Bug, Trillions of XRP Potentially at Risk
In parallel developments within the cryptocurrency ecosystem, a significant security vulnerability was uncovered within the XRP Ledger, a finding that could have had catastrophic consequences. Security firm Veria Labs announced that it had been awarded a $250,000 bug bounty for discovering an overflow bug embedded in XRP’s code, a flaw that had reportedly existed since 2015. The firm claims that under specific conditions, a single transaction could have potentially minted trillions of XRP out of thin air, dramatically devaluing the cryptocurrency.
Fortunately, the vulnerability has since been patched, and there is currently no evidence to suggest that it was ever exploited. This timely discovery prevented a potentially devastating scenario for XRP holders and the broader market.
Cayden Liao, co-founder of Veria Labs, detailed the discovery on X, explaining that their AI agent meticulously analyzed "rippled," the software underpinning the XRP Ledger. While the initial scan identified two low-severity bugs, the team discovered that by chaining these seemingly minor issues together, a far more substantial exploit could be engineered. Liao elaborated that a single fraudulent transaction, leveraging this combined vulnerability, could have generated over 18 trillion XRP, a quantity more than 184 times the total circulating supply of XRP.
"This puts the full $94B at risk, more than 60 times the largest crypto hack on record," Liao stated, referencing the approximate market capitalization of XRP at the time of the report. He further speculated that the obscurity of the vulnerability might stem from the fact that it relies on the confluence of two individually low-severity bugs. The bugs were reported to RippleX on September 22nd, and a patch was implemented just three days later, demonstrating a swift response from the development team.
The existence of such a deep-seated bug, unnoticed for nearly a decade, underscores the inherent complexities and potential hidden dangers within blockchain protocols. While the swift patching mitigates immediate risk, it serves as a stark reminder of the ongoing need for rigorous security audits and bug bounty programs to safeguard the integrity of digital asset networks.
Vitalik Buterin Backs ‘Bunker Mode’ Amid Rapid AI Math Advances
The accelerating pace of artificial intelligence (AI) development has prompted concerns about its potential impact on the fundamental cryptography that secures blockchain networks. Ethereum co-founder Vitalik Buterin has publicly endorsed researcher Justin Drake’s warning that advancements in AI could undermine current cryptographic standards sooner than quantum computing threats. This "bunker mode" advisory suggests a proactive approach to preparing for future cryptographic challenges.
"I don’t recommend anyone scramble to move their funds to new wallets today," Buterin clarified on X, seeking to temper immediate panic. "But we should take the risks to cryptography from AI-accelerated math seriously." His statement acknowledges the potential threat without advocating for hasty, potentially disruptive actions.
Drake had previously urged the industry to prepare for a "bunker mode" scenario following OpenAI’s release of numerous new mathematical findings that had stumped human mathematicians. While these findings were not directly related to cryptography, the underlying concern is that AI agents could develop novel insights into the mathematical structures underpinning cryptographic systems, such as elliptic curve cryptography or lattice-based cryptography, which are crucial for securing blockchains. The core Ethereum team has expressed anxiety over this potential.
However, these concerns have also met with criticism from some projects and analysts, who view them as fear-mongering. Critics argue that current AI capabilities are far from posing a genuine threat to cryptographic integrity. Nevertheless, the rapid, almost unprecedented success of recent AI models in solving previously intractable problems serves as a cautionary tale, suggesting that the speed of AI advancement may be underestimated. The potential for AI to unlock new mathematical breakthroughs, even in areas not directly related to cryptography, warrants serious consideration and preparedness.
Samsung Wallet to Add USDC Transfers for US Galaxy Users in October
In a move to broaden the utility of its mobile payment platform, Samsung has announced plans to integrate USD Coin (USDC) transfer capabilities into its Samsung Wallet application. This new feature is slated to be rolled out to an estimated 82 million eligible US Galaxy users in the final week of October.
The integration will enable users to send USDC to other compatible cryptocurrency wallets internationally. Furthermore, the service will facilitate money transfers to eligible bank accounts in over 60 countries, with recipients able to receive funds in their local currency. To access these services, users will be required to complete an identity verification process, aligning with regulatory Know Your Customer (KYC) requirements.
The infrastructure for these stablecoin accounts and payment processing will be provided by Bastion, a specialized financial technology company. Coinbase is set to serve as a sub-custodian through its Coinbase Prime Vault service, ensuring secure handling of assets. Solana and Sui have also been identified as technical partners in this initiative, indicating a multi-chain approach to stablecoin transfers.
This development signifies a growing trend of mainstream technology companies embracing and integrating cryptocurrency functionalities, particularly stablecoins, into their existing ecosystems. By facilitating seamless cross-border transfers and payments, Samsung aims to enhance the value proposition of its Galaxy devices and tap into the growing demand for digital currency solutions.
Crypto’s Heavy Backing of Republicans Alienated Democrats: Cuomo
Former New York Governor Andrew Cuomo has asserted that the cryptocurrency industry’s significant financial support for Republican candidates in the United States has alienated Democrats, a move that could impede the passage of crucial federal cryptocurrency legislation. Cuomo argued that bipartisan support is essential for navigating the complex regulatory landscape of digital assets.
Prediction markets, such as Kalshi, currently place the probability of Democrats securing control of both chambers of Congress at approximately 61%. Cuomo suggested that a Congress dominated by Democrats could either move to curtail the crypto initiatives of the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC), or conversely, could collaborate with the Trump administration to enact comprehensive legislation like the CLARITY Act.
"You need Democrats to pass the bill. You need Republicans. You have to be more balanced," Cuomo stated, emphasizing the necessity of a more inclusive political strategy for the crypto industry. He acknowledged the perception that Democrats are often viewed as "anti-crypto," but countered that the core tenets of cryptocurrency align well with the Democratic Party’s historical goals and values.
"It’s empowering people who otherwise wouldn’t have access to financial products, and the Democratic Party has been working to do that all its life," Cuomo explained, drawing a parallel between crypto’s democratizing potential and the party’s long-standing commitment to financial inclusion. This perspective suggests a missed opportunity for the crypto industry to build bridges with a political party that, in theory, could champion its goals of financial empowerment.
Winners and Losers
The cryptocurrency market experienced a mixed week, with major assets seeing declines. At the close of the week, Bitcoin (BTC) was down 2.8% to trade at $83,435. Ethereum (ETH) saw a more significant drop of 6.5%, trading at $2,562. XRP (XRP) also declined, falling 7% to $1.40. The total cryptocurrency market capitalization stood at $2.82 trillion, according to CoinMarketCap.
Among the top 100 cryptocurrencies, several altcoins demonstrated impressive gains. StarkNet (STRK) emerged as a significant winner, with a 91% surge following its announcement of a transition to a post-quantum Layer 1 blockchain. Binance Life (BNB) also saw a substantial increase of 25.4%, while Celestia (TIA) gained 20.8%.
Conversely, several altcoins experienced notable losses. Venice Token (VVV) was down 18.5%, Sky (SKY) fell 16.2%, and Uniswap (UNI) recorded a 15.4% decrease over the week.
Prediction of the Week
Tom Lee, Chair of Bitmine, shared an optimistic outlook for Ethereum during Token2049 on Friday. Lee predicted that ETH could reach $5,000 by the end of the current year and projected that by the conclusion of the current market cycle, Ethereum’s price could "easily be $25,000 or $50,000 per token."
Lee also disclosed that Bitmine is nearing its accumulation target of 5% of Ethereum’s total supply. The firm has already acquired approximately 6 million Ether and requires an additional 100,000 ETH to reach its hard cap. "That’s a hard cap. We’re not gonna be accumulating past 5%," Lee stated, emphasizing a commitment to not exceeding this self-imposed ownership limit. This indicates a strategic long-term investment approach by Bitmine in the Ethereum ecosystem.
Top FUD of the Week
Coldcard Investigates Phishing Link on X Account
Bitcoin-only hardware wallet provider Coldcard reported that an unauthorized phishing link appeared on its official X account on Sunday, despite the company employing offline two-factor authentication for account security. The compromised post has since been deleted, and Coldcard reiterated that its sole official website remains https://coldcard.com. This incident highlights the persistent challenges in securing social media accounts, even for entities that prioritize robust security measures. The DefiLlama hack tracker estimated losses associated with a previous Coldcard exploit in July at $115 million, underscoring the potential financial impact of such security breaches.
THORChain Dev Accuses Tether of Temporarily Freezing USDT Vaults
Chad Barraford, technical co-founder of THORChain, publicly accused stablecoin issuer Tether of blacklisting the network’s USDt (USDT) vaults without providing an explanation, only to unfreeze them several hours later. Barraford detailed in an X post that Tether had blacklisted THORChain vault addresses, effectively freezing approximately 1.45 million USDT across four wallets. He later reported that trading would resume after Tether unfroze the addresses, suggesting a temporary, unexplained operational disruption.
New York Permanently Bars Celsius Founder Mashinsky in $35M Fraud Settlement
Former Celsius CEO Alex Mashinsky has been permanently barred from participating in the cryptocurrency, securities, and commodities industries as part of a settlement with New York Attorney General Letitia James. The settlement includes conditional payments totaling up to $35 million. This agreement resolves a civil lawsuit filed in 2023, which accused Mashinsky of defrauding hundreds of thousands of investors by misrepresenting the safety of Celsius before its collapse in 2022. Mashinsky is currently serving a 12-year federal prison sentence for fraud and was separately ordered to forfeit over $48 million.
Top Magazine Features of the Week
France is World’s Most Dangerous Place for Bitcoiners: 90 Attacks in 7 Months
An in-depth investigation revealed that France has become a significant hotspot for crypto-related crime, with French authorities recording 90 cases involving kidnapping, extortion, threats, and violent theft targeting cryptocurrency users within a seven-month period. The article delves into the factors contributing to this alarming trend, examining the vulnerabilities and risks faced by Bitcoiners in the country.
Crypto Lending Rises Again… But Have They Solved the Risks?
The crypto lending sector has witnessed a notable resurgence, with a 55% increase in activity since July. However, this growth is occurring amidst evolving threats, including AI-assisted hacks and the potential for cascading failures through interconnected protocols. This feature explores the current state of crypto lending and provides insights into how users can navigate the associated risks to stay safe.
Capital Starting to Rotate Back to Crypto from AI: Raoul Pal
Raoul Pal, founder of Real Vision, suggests that a potential pause in the AI stock rally could create an opportunity for cryptocurrencies to attract renewed investment capital. Pal further predicts that AI agents are likely to drive increased adoption of Ethereum and Solana, indicating a potential shift in investment focus and technological integration.
