News linked to both this project and an event.
Trader Killa posted that despite the market facing multiple bearish factors—including the Fed's hawkish decision, rising oil prices, hotter-than-expected CPI data, surging global bond yields, a stronger dollar, the Ledger wallet hack, and market concerns over Strategy (MSTR)'s delisting risk and its pivot to AI—Bitcoin has still maintained range-bound trading. Given the current macroeconomic pressures and negative news, Bitcoin should have fallen below $70,000, but its resilience is noteworthy. The market may be gradually forming a significant interim bottom, and its ability to hold the price range amid bearish shocks indicates that it is absorbing negative news, which is also a typical characteristic of a bull market.
According to CoinDesk, the XRP Ledger’s validator support temporarily fell to 26/35, re-triggering the two-week countdown for its vulnerability fix and delaying patch activation to November. Validator support has since rebounded to 31, but due to the reset mechanism, the fix has missed its originally scheduled final activation window.
According to Onchain Lens monitoring, following the Railway security breach, a suspected attacker wallet has transferred at least $369,300 to HitBTC and other addresses. The wallet had also previously received funds from an address associated with CryptoBillis Ledger Drainer, though its connection to the Railway security breach has not yet been confirmed.
Former Mt. Gox CEO Mark Karpelès (@MagicalTux) posted that Ledger Support (@Ledger_Support) stated on August 20 that the Secure Element chip can detect physical tampering; if extra hardware intercepts signals, the device will refuse to execute unsigned code or fail the Genuine Check. Karpelès pointed out that Ledger's own technical documentation explicitly states: if the original Secure Element is intact, the Genuine Check cannot detect unauthorized physical hardware modifications such as spy implants. The two statements contradict each other. He also noted that recent reports show over $90 million in assets were stolen precisely through this method of "extra hardware intercepting signals." Furthermore, in a March 2026 Ledger Academy article, Ledger had already published photos of spy implants installed inside multiple Ledger devices, including mass-produced complex PCBs, indicating they were long aware of this threat. Karpelès believes this conduct constitutes misleading promotion and cited that French law has specific regulations regarding misleading advertising.
Odaily reports: Bitcoin News posted on X platform that former Mt. Gox CEO Mark Karpelès accused Ledger of failing to adequately alert customers to sophisticated hardware implants after learning of the relevant threat as early as March 2026, and of burying related warnings in Ledger Academy articles. Karpelès stated that evidence of mass-produced, self-aligning implants should have triggered a highest-level alarm response. After Ledger CEO Pascal Gauthier responded by referencing his Mt. Gox experience, Karpelès fired back, saying he had trusted Ledger to learn from his failures and do better than he did. Karpelès also criticized Ledger for continuing to downplay the incident and questioned its communication with affected customers.
Odaily Report: According to on-chain detective Specter's monitoring, after ZachXBT disclosed that the Bitget attacker used Zcash (ZEC) to obscure stolen funds, other stolen funds have also begun flowing into ZEC, including funds from the Cryptobills Ledger incident and the $12 million Triple-A hack. Threat actors are using ZEC to move stolen funds.
Odaily News: Former Mt. Gox CEO Mark Karpelès stated that hardware wallet manufacturer Ledger received warnings about possible tampering with its hardware wallets as early as December 2025, but did not take sufficient measures to alert customers before the recent security incident occurred.Karpelès believes that Ledger should have disclosed the relevant risks to users earlier and strengthened security warnings. Currently, the above claims are Karpelès's personal allegations, and it cannot yet be confirmed on this basis that Ledger devices have a large-scale security vulnerability. (Cointelegraph)
According to CoinDesk, blockchain analytics firm Chainalysis disclosed on Thursday on X that a cryptocurrency scammer who profited from a "task scam" (luring victims with paid review boosting or order brushing, then demanding account top-ups under the guise of a "negative balance") transferred the illicit proceeds to three Ledger hardware wallet addresses. These addresses were subsequently drained by attackers, resulting in a total loss of 60 BTC valued at over $4.9 million, making it one of the biggest victims in this Ledger device intrusion incident.
Odaily reports: SlowMist has issued a warning that a fake "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to conduct attacks. The phishing page is highly convincing, including a fake "Genuine check" page, a device selection interface, and an "Update Now" button. SlowMist reminds users never to update Ledger devices through website links and never to enter their Recovery Phrase anywhere.
— In the theft incident involving crypto hardware wallet manufacturer Ledger, one of the biggest victims was also a scammer, who lost over 60 BTC worth approximately $4.8 million. The funds in question came from a task scam: participants were hired to fake sales and reviews for real products. A "negative balance" then appeared, and participants were told they had to put in their own funds in order to get paid. On September 22, the operator behind the scam transferred the proceeds to 3 separate Ledger addresses. On October 9, thieves emptied these 3 addresses, each transferring funds to the same wallet via a single transaction. The receiving wallet has been reported as being involved with stolen funds.
Odaily News: According to Bitcoin News monitoring, in the Ledger supply chain attack, attackers do not need to immediately steal users' Bitcoin. @MagicalTux explained that the implanted program can transmit users' seed phrases to the attacker, who can then wait for users to accumulate more Bitcoin before emptying their wallets.
Odaily News: Crypto hardware wallet company Ledger will launch the Atom in mid-2027. The device supports running apps such as WhatsApp and Instagram, and can switch between smartphone functionality and a protected digital asset management mode.The Atom will feature a tamper-resistant casing, sensors, and specialized packaging, which can help prevent supply chain attacks like the recent CryptoBilis vulnerability even when the device is powered off.Ledger initially plans to sell the Atom exclusively through its official website to reduce third-party distribution risks, but will not offer trade-in services for customers affected by the vulnerability. (CoinDesk)
Ledger has released an update on its investigation into the hardware wallet implant attack. According to its disclosure, an organized criminal group spent months purchasing genuine Ledger devices, disassembling them, and implanting custom hardware specifically designed to steal seed phrases, before reintroducing them to the market through distribution channels in Southeast Asia. The group also built a supporting infrastructure for seed phrase collection, asset theft, and money laundering. Ledger stated that the operation involved millions of dollars in investment.Ledger emphasized that this incident was a localized distribution channel attack, and that its chips, operating system, and servers were not compromised. The company has instructed authorized dealers and distributors in Southeast Asia and Hong Kong to suspend sales and has implemented new security rules, including prohibiting devices from being placed on shelves or display areas, and prohibiting the resale of returned devices.
Bitcoin News posted on X that Mark Karpeles has launched a webpage to document reported cases of Ledger hardware implants, compiling cases he has reviewed and verified through public reports and images shared on X. The database also allows users to submit new cases to track the potential scope of the ongoing Ledger supply chain security incidents.
Odaily News: According to Bitcoin News monitoring, Bitcoin News released a podcast in which former Mt. Gox CEO Mark Karpelès and Foundation CEO Zach Herbert discussed the largest supply chain attack in crypto industry history. Mark Karpelès stated that he discovered the spy implant 3 weeks before the funds were stolen and contacted Ledger, but received no response. The implant had a built-in hidden cellular modem that could directly read the seed phrase on the screen and passed Ledger's own checks; even setting a passphrase could not prevent the seed phrase from being stolen. Mark Karpelès said that with $5 million, he could create an implant that would only be detectable through X-ray. The episode also discussed the hardware wallet reseller model, the Malaysian reseller behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The episode timeline shows that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.
Odaily News: According to monitoring by Bitcoin News, German Ledger user @jayr_crypto reports receiving another forged letter this week. The letter impersonates Ledger, claiming that new regulations require users to register a Bitcoin wallet through a service called ZenLedger by October 31. The letter uses Ledger's official branding elements, references German financial regulators, and includes a QR code that directs users to a so-called mandatory registration process. The user believes that addresses exposed in a previous data breach are being used to conduct targeted attacks against Ledger users. In the same week, Ledger coordinated with MediaMarktSaturn to suspend sales of its hardware wallets across a European retail network spanning 11 countries and more than 1,000 stores. It was previously reported that Ledger devices purchased from European retailers were found to contain malicious spy implants. Ledger separately confirmed that compromised devices sold by a distributor in Southeast Asia contained implants capable of stealing recovery phrases and transmitting them via cellular networks. Ledger has not yet confirmed that European devices were compromised. Ledger users are currently facing physical supply chain tampering and targeted phishing attacks exploiting home addresses. Do not scan suspicious QR codes or enter recovery phrases.
According to monitoring by CryptoQuant analyst nocoffeenobrain, coins with a holding age of 1–3 years and over 3 years began showing signs of activity as early as late September, coinciding with BTC prices rising from the mid-$70,000 range to the mid-$80,000 range. Following the recent Ledger hack, which prompted numerous users to migrate assets to new signing devices and replace their seed phrases, the 7-day moving average is expected to climb further over the next few days. The analyst noted that a similar pattern occurred previously: during January to February this year, when BTC dropped from $90,000 to the mid-$60,000 range, and between July and August while BTC consolidated around the mid-$60,000 range, both of these holding age cohorts exhibited synchronized activity.
Odaily News: According to monitoring by Bitcoin News, well-known hardware security researcher and computer engineer Joe Grand (social media account @joegrand, also known as "Kingpin") stated that in August 2025, a man in Thailand contacted him, claiming to have discovered a compromised Ledger Nano X. The man had previously purchased a cheap Ledger device online to replace the battery in his existing device. After taking the device apart, he found that it contained a smaller battery, unauthorized circuitry, extra wiring, and an antenna. After the man posted his findings on Reddit, he reportedly did not receive much attention from local police, and subsequently contacted Grand to launch an investigation. This discovery came more than a year before the Ledger supply chain attack sparked major public controversy this week; according to reports, nearly $100 million in cryptocurrency was stolen this week.
Odaily News: Crypto hardware manufacturer Ledger SAS is reviewing its consumer-facing device sales policies and processes. This follows reports that some hardware wallets were implanted with spyware, leading to the theft of approximately $90 million in cryptocurrency. Ledger Chief Technology Officer Charles Guillemet said on Tuesday that the company is also evaluating tamper-proof protections for its devices. He reminded users who suspect their devices have been tampered with to consult Ledger's published security guidelines before disassembling their hardware wallets themselves, and to send any suspicious devices to Ledger for further inspection.
former Mt. Gox CEO Mark Karpelès has publicly confirmed that a Ledger Flex purchased at Metapod in Singapore Changi Airport had a spy module implanted inside it. The device was bought by user Ben Yorke this summer and had never been used before being sent in for teardown due to suspicious scratches on its casing. Photos and videos of the teardown released by Karpelès show an additional circuit board and wiring hidden at the bottom of the device. It is a relatively new version of the implant, capable of eavesdropping on screen communications and other methods to steal users' seed phrases during setup. Previously, Ledger devices purchased through the Malaysian distributor CryptoBilis were also found to have been implanted, leading to the theft of over $86 million in assets. Devices purchased from official European distributors and in the Philippines have also been gradually discovered to show similar signs of implantation. The implants have progressively evolved from early hand-soldered modifications to more covert mass-produced circuit boards.