News linked to both this project and an event.
Odaily reports: Singapore police stated that at least two cases involving tampered Ledger hardware wallets have been reported since September 10, with combined losses of approximately S$3.5 million, equivalent to about $2.7 million. Preliminary investigations found that some Ledger wallets purchased at retail stores in Singapore contained malicious hardware components.Singapore police are in contact with Ledger, which is reviewing the affected cases, and the police investigation is ongoing. On October 13, Ledger asked retailers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales of its devices. (Cointelegraph)
XRP Ledger developers are testing a new feature that would allow the creation of blockchain accounts with a zero initial balance, with existing accounts covering the reserve requirement for new accounts, in order to lower the funding barrier for payment applications and automated software to create wallets at scale.The proposal was submitted on October 15 as the SponsoredAccountCreate transaction proposal. Under current XRP Ledger rules, each account must hold at least 1 XRP as a reserve, meaning that creating 100,000 separate accounts would require locking up 100,000 XRP. The new proposal would have a sponsoring account cover this reserve requirement, and a broader fee-sponsorship mechanism in the future could also allow applications to pay transaction fees on behalf of users, though the network's overall reserve requirement would not be eliminated as a result.The feature is expected to lower the barrier to use for scenarios such as embedded wallets, RLUSD stablecoin payments, and automated payments by AI agents. However, the relevant code is still under review, and the sponsorship mechanism it relies on has not yet launched on mainnet. As of October 19, the mechanism had received only 11 of the 35 required validator votes, still short of the 29 votes needed for approval. (CoinDesk)
According to a press release published on Ripple's official website, Aviva Investors and Ripple have announced the launch of a tokenized share class for a British pound (GBP) liquidity fund on the XRP Ledger (XRPL). This marks the company's second existing fund to undergo tokenization, following the launch of a tokenized share class for its US dollar liquidity fund in July 2026. The GBP liquidity fund is Aviva Investors' largest fund, with approximately £22 billion in assets under management, and is registered in Ireland as a UCITS money market fund. Aviva itself has invested £50 million (approximately $66 million) into the new share class. Combined investments across both tokenized share classes exceed £86 million (approximately $116 million), making Aviva Investors one of Europe's largest providers of tokenized money market funds. The fund utilizes a "digital twin" model, representing investor holdings on-chain while preserving the off-chain fund structure. The tokenized shares carry the same investment objectives, risk characteristics, liquidity, and regulatory protections as traditional shares. The new shares are available to eligible investors holding digital wallets, and are powered by Komainu and Licuido, with assets remaining custodied by BNY Mellon.
According to FX News Group, the UK digital bank Revolut’s new entity, Revolut Global Digital Assets Limited (RGDAL), has obtained a Distributed Ledger Technology (DLT) service provider license from the Gibraltar Financial Services Commission (GFSC). Revolut stated that this license will be used to support its international crypto business in key expansion markets. The company currently provides crypto services in the UK through Revolut Ltd and conducts related operations in the European Economic Area under MiCA via Revolut Digital Assets Europe Ltd.
Odaily News: French hardware wallet manufacturer Ledger received multiple reports of malicious implants months before its latest security crisis occurred. Former Mt. Gox CEO Mark Karpelès stated that at least two people had contacted Ledger since December 2025 to report tampered devices, but no public warning was found to have been issued.Security researcher Joe Grand stated that on March 4, 2026, he reported a malicious implant to Ledger. The implant was found in a Nano X purchased through Lazada in Thailand in August 2025. Ledger confirmed the findings and said it would launch an internal investigation, but did not proactively alert customers.Mark Karpelès believes that the increase in the number of reports and the growing sophistication of the techniques used should prompt Ledger to take action and at least remind customers to remain cautious. Ledger declined to comment on how it handled Joe Grand's disclosure, only directing people to view its public statement on X.The Ledger security crisis became public on October 9, involving the loss of crypto assets from wallets sold by Southeast Asian authorized reseller CryptoBilis; Ledger confirmed that one affected device contained an unauthorized implant. Trezor had also previously received reports involving devices tampered with by unauthorized sellers. (Cointelegraph)
Ledger has released an update on its investigation into the hardware wallet implant attack. According to its disclosure, an organized criminal group spent months purchasing genuine Ledger devices, disassembling them, and implanting custom hardware specifically designed to steal seed phrases, before reintroducing them to the market through distribution channels in Southeast Asia. The group also built a supporting infrastructure for seed phrase collection, asset theft, and money laundering. Ledger stated that the operation involved millions of dollars in investment.Ledger emphasized that this incident was a localized distribution channel attack, and that its chips, operating system, and servers were not compromised. The company has instructed authorized dealers and distributors in Southeast Asia and Hong Kong to suspend sales and has implemented new security rules, including prohibiting devices from being placed on shelves or display areas, and prohibiting the resale of returned devices.
Bitcoin News posted on X that Mark Karpeles has launched a webpage to document reported cases of Ledger hardware implants, compiling cases he has reviewed and verified through public reports and images shared on X. The database also allows users to submit new cases to track the potential scope of the ongoing Ledger supply chain security incidents.
Ledger's security team Donjon has released an update on its investigation via the X platform, stating that in response to a German user's report of a potentially tampered device, the team has inspected devices in retail and distributor inventory across multiple locations in Germany, including the store mentioned by the user involved, and found no signs of tampering.Ledger stated that no reports of financial losses related to implanted malicious devices have been received within Europe so far. Regarding the suspicious devices displayed online, the security team has not yet obtained the physical units for testing, and has invited the device holders to send them to Ledger's security team for further analysis and public disclosure of the investigation results.
Odaily News: According to monitoring by Bitcoin News, German Ledger user @jayr_crypto reports receiving another forged letter this week. The letter impersonates Ledger, claiming that new regulations require users to register a Bitcoin wallet through a service called ZenLedger by October 31. The letter uses Ledger's official branding elements, references German financial regulators, and includes a QR code that directs users to a so-called mandatory registration process. The user believes that addresses exposed in a previous data breach are being used to conduct targeted attacks against Ledger users. In the same week, Ledger coordinated with MediaMarktSaturn to suspend sales of its hardware wallets across a European retail network spanning 11 countries and more than 1,000 stores. It was previously reported that Ledger devices purchased from European retailers were found to contain malicious spy implants. Ledger separately confirmed that compromised devices sold by a distributor in Southeast Asia contained implants capable of stealing recovery phrases and transmitting them via cellular networks. Ledger has not yet confirmed that European devices were compromised. Ledger users are currently facing physical supply chain tampering and targeted phishing attacks exploiting home addresses. Do not scan suspicious QR codes or enter recovery phrases.
According to official sources, hardware wallet manufacturer Ledger has requested distributors and retailers in Southeast Asia and Hong Kong, China to suspend sales of Ledger devices during the investigation and fully remove related products from sale. The affected countries and regions include Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong, China.
Odaily News: Bitcoin News posted on X that OneKey has terminated its partnership with reseller CryptoBilis and is offering free replacements after Ledger confirmed that devices sold through this reseller contained unauthorized hardware implants. Blockchain investigator Specter estimates related losses exceed $86 million. Ledger has not yet confirmed the total losses and stated that confirmed cases involve only CryptoBilis inventory, not its own channels. OneKey CEO Yishi Wang said no users have reported losses so far, but user asset security cannot rely on luck.
Odaily News: According to monitoring by Bitcoin News, well-known hardware security researcher and computer engineer Joe Grand (social media account @joegrand, also known as "Kingpin") stated that in August 2025, a man in Thailand contacted him, claiming to have discovered a compromised Ledger Nano X. The man had previously purchased a cheap Ledger device online to replace the battery in his existing device. After taking the device apart, he found that it contained a smaller battery, unauthorized circuitry, extra wiring, and an antenna. After the man posted his findings on Reddit, he reportedly did not receive much attention from local police, and subsequently contacted Grand to launch an investigation. This discovery came more than a year before the Ledger supply chain attack sparked major public controversy this week; according to reports, nearly $100 million in cryptocurrency was stolen this week.
Odaily reports: Hardware wallet manufacturer Ledger posted on X platform stating that it has coordinated with German electronics retailer MediaMarktSaturn Retail Group to suspend sales of Ledger devices in its stores and online channels starting October 13, in order to investigate a device tampering incident previously reported by a German user.Ledger stated that no user fund losses have been found resulting from this incident, and there is no evidence that Ledger's infrastructure, systems, or services have been compromised. The company's customer service team is reviewing user feedback, and its cybersecurity team Donjon will conduct further inspection of suspicious devices received.Ledger also stated that some related claims and loss data circulating online have not been verified, and users should only obtain follow-up information through official Ledger and MediaMarkt Saturn channels. Previously, the market had reported that some Ledger devices were suspected of supply chain tampering, which raised concerns about hardware wallet security.
Odaily News: Crypto hardware manufacturer Ledger SAS is reviewing its consumer-facing device sales policies and processes. This follows reports that some hardware wallets were implanted with spyware, leading to the theft of approximately $90 million in cryptocurrency. Ledger Chief Technology Officer Charles Guillemet said on Tuesday that the company is also evaluating tamper-proof protections for its devices. He reminded users who suspect their devices have been tampered with to consult Ledger's published security guidelines before disassembling their hardware wallets themselves, and to send any suspicious devices to Ledger for further inspection.
According to Cointelegraph, European electronics retailer MediaMarktSaturn has completely removed all Ledger products from its physical stores and online platforms, stating that it is in contact with the manufacturer and "taking this incident very seriously." Previously, users reported discovering unauthorized cables and cellular modules inside Ledger wallets purchased from multiple MediaMarkt locations, which could be used to steal user mnemonic phrases via cellular networks. The issue initially stemmed from Ledger's investigation into Southeast Asian distributor CryptoBilis and has since expanded to Europe and Singapore.
Odaily News: European electronics retailer MediaMarkt's parent company MediaMarktSaturn has removed all Ledger products from its stores and online platform, stating that it is in contact with the manufacturer. The company said it takes this matter very seriously.X user Johannes claims that two Ledger wallets purchased from two different MediaMarkt stores both contained unauthorized cables and cellular modules. Ledger stated that the implants in question can transmit users' recovery phrases via cellular networks and is investigating reports beyond CryptoBilis.Former Mt. Gox CEO Mark Karpelès said that a Ledger Flex he purchased at Singapore Changi Airport contained a spy implant. Ledger responded by saying users should refer to the latest CryptoBilis investigation update, but did not directly address the Singapore case, nor did it confirm whether tampered devices exist in Europe. (Cointelegraph)
According to official disclosures from Ledger, its security team, Ledger Donjon, is investigating Ledger signing devices (hardware wallets) sold by the Southeast Asian distributor CryptoBilis. It has been confirmed that the affected devices contain unauthorized hardware implants. All confirmed financial losses are linked to devices sold through CryptoBilis, with no evidence yet of theft from devices purchased through other channels. CryptoBilis has now suspended sales of Ledger devices. Investigative analysis reveals that the implant is located inside the device casing and is designed to read data displayed on the screen. During the user initialization setup, the implant decodes the 24-word mnemonic phrase displayed on the screen via a microcontroller and transmits it externally using a pre-configured eSIM card over an LTE network. The implant operates as an independent component and does not tamper with the Secure Element or the Ledger operating system, nor does it alter transactions or signatures.
A crypto KOL (@rrealist) posted on social media that their residence in the UK was targeted in a home invasion at knifepoint, resulting in the loss of assets worth approximately $800,000. The KOL reported that the assailant threatened them with a knife, forcibly drained $40,000 from their primary wallet and $720,000 from their Ledger hardware wallet, while also stealing a Rolex watch and smashing their phone. The victim stated they sustained only minor scratches and no serious physical injuries. Local police have launched an investigation into the incident.
Odaily News: According to Bitcoin News monitoring, the attacker behind the Ledger supply chain theft has moved nearly 3,000 ETH through Tornado Cash in three separate transactions, and transferred the funds into the Zcash privacy pool before converting them to USDC. Investigator @YFarmX stated that despite the use of privacy tools, they have traced 108 transactions completed through Zcash by exact value matching. An estimated $2.85 million in stolen USDC is still held in 3 wallets, and Circle may be able to freeze the related funds. Meanwhile, Tether is reported to have frozen $10 million in stolen USDT; wallets associated with the attacker still hold approximately $38.6 million in ETH and $16.9 million in BTC.
multiple blockchain analytics firms estimate attackers stole as much as $94.5 million in assets from hundreds of wallets tied to Ledger devices sold by authorized reseller CryptoBilis. Ledger has not yet confirmed this total.Hardware wallet company Ledger discovered that at least one affected device had unauthorized hardware implanted inside it; stablecoin issuer Tether has frozen $10 million in USDT linked to the theft, and investigators are still tracing the flow of funds.Ledger advises CryptoBilis customers not to set up devices they have not yet used; customers already using affected devices should move their assets to new devices and generate new recovery phrases. (CoinDesk)