News linked to both this project and an event.
Odaily News: OneKey founder Yishi posted a statement saying that the recent asset loss incidents involving Ledger users have drawn community attention to the security of hardware wallets. The risk may not come from the secure chip itself, but rather from the gap between the protected chip and the display screen that users trust — the so-called "last centimeter." Hardware wallet security needs to cover the entire process of production, transportation, storage, and distribution. Users are advised to purchase devices through official channels, complete packaging inspections and official verification, as sensitive data may be exposed during transmission.Yishi stated that as of October 10, OneKey has not received any reports of user fund losses caused by this incident. In response to supply chain attack risks, the company plans to make improvements across multiple areas, including packaging, mnemonic phrase display pathways, motherboard communication, reseller authorization, and user verification information. Among these, OneKey will introduce a backup process that does not require displaying the mnemonic phrase on the device screen, and will prioritize strengthening encryption of sensitive internal communication links on the motherboard to reduce the risk of hardware implant attacks obtaining recovery phrases.
The XRP Ledger recently patched a critical security vulnerability traceable to 2015. Discovered by researcher Cayden Liao and Veria AI, the issue was reported internally on September 22. Attackers could exploit a counter overflow flaw in the ledger’s built-in exchange to create massive amounts of XRP from thin air at an extremely low cost by opening hundreds of accounts, then transfer and liquidate them to bypass XRP’s fixed supply cap of 100 billion. RippleX quietly released the patched version xrpld 3.4.1 on September 25, stating that there is currently no evidence of the public network having been exploited.
XRP Ledger 发现并修复了一个始于 2015 年的计价漏洞，若被利用可能导致 XRP 固定供应量规则失效，目前未发现被恶意利用的证据。
According to disclosures by SlowMist Security Team CISO 23pds (@im23pds), researchers have indicated that Ledger hardware wallets may be susceptible to a PCB-level supply chain attack. The attack works by implanting a malicious module on the device’s screen data cable (such as the SPI bus) to passively monitor and record the mnemonic display process. The mnemonics are then forwarded to attackers via LTE/eSIM, allowing them to drain user assets. Since this spy module only performs passive read-only operations and does not interact with the firmware or Secure Element (SE), the device’s power-on self-test cannot detect any anomalies. The actual compromised security boundary is the plaintext bus between the MCU and the screen. To date, Ledger has officially launched an investigation into user fund loss incidents in Southeast Asia. The affected devices are suspected to be connected to Malaysian distributor CryptoBilis; Ledger has ordered it to halt all sales and shipments and has advised users to await official updates on the investigation.
According to on-chain analyst Onchain Lens (@OnchainLens), the hacker associated with the $90 million Ledger reseller incident has cumulatively deposited approximately $270,300 into Binance, including 256.57K USDT and 41.12K TRX (about $13,700), with the majority of funds already transferred to Binance's hot wallet. Previously, the hacker also used four wallets to deposit 430.2 ETH (approximately $1.07 million) into Tornado Cash for mixing, and converted USDT to USDD to evade Tether's fund freeze.
According to monitoring by Galaxy's head of research, in the Ledger CryptoBillis attack incident, approximately $72.9 million remains in addresses controlled by the attacker, involving Bitcoin, Ethereum, and USDT; $3.1 million entered Tornado Cash, while the remaining funds have been bridged across chains, swapped, or layered and transferred through relayers.
According to Odaily, citing Galaxy's head of research, the losses from the Ledger CryptoBillis supply chain attack currently amount to 213.42 BTC, approximately $17.7 million. Of this, 92% of the funds were held for less than 90 days at the time of consolidation, while some funds were held for longer periods. All traced Bitcoin remains unspent and is stored in 3 consolidation addresses.
Odaily News: According to monitoring by Galaxy's head of research, the Bitcoin losses caused by the Ledger cryptocurrency supply chain attack currently amount to 213.42 BTC, valued at $17.7 million. Of this, 92% of the funds were transferred in less than 90 days ago, while some funds were transferred even earlier. All Bitcoin traced so far remains unspent and is held in 3 aggregation addresses.
Bitcoin News posted on X platform stating that corporate records for Malaysian hardware wallet distributor CryptoBilis show that, as of August 3, an individual named Jiaming, with a registered address in Heilongjiang Province, China, holds 100% of the company's shares. The company's former co-founder confirmed that CryptoBilis completed its acquisition in March, with the original owner withdrawing from all operational, managerial, and administrative roles. The founder has been unable to learn about the company's operations since the handover but still assists with event coordination. This information emerged during an investigation into a suspected supply chain attack on Ledger hardware wallets, where affected devices were implanted with hidden components that could steal seed phrases; there is currently no conclusive evidence linking the change in CryptoBilis ownership to the compromised wallets.
According to Onchain Lens monitoring, the suspected hacker behind the reported $90 million Ledger reseller incident has deposited 430.2 ETH, worth $1.07 million, into Tornado Cash through 4 wallets. After Tether froze the related funds, the hacker swapped USDT for USDD through SUN.io and USDD's PSM, with some funds also flowing into Binance hot wallets.The hacker's wallet tracked by Arkham currently holds a total of $70.6 million in assets, including 11,406 ETH worth $28.35 million; 213.371 BTC worth $17.65 million; 13.646 million USDD worth $13.65 million; and 10.909 million USDT worth $10.91 million. Onchain Lens is calling on Binance to investigate these transfers and freeze accounts associated with the stolen funds as soon as possible.
Odaily News — According to monitoring by Bitcoin News, former Mt. Gox CEO Mark Karpelès may have inadvertently triggered a coordinated transfer of funds across multiple wallets after publicly disclosing physical tampering with Ledger devices equipped with hidden surveillance implants. On October 8, Karpelès warned that counterfeit or tampered Ledger devices with hidden SIM cards were being sold on the market, and these SIM cards were capable of transmitting stolen seed phrases. The implants were reportedly able to intercept data sent to the device screen, thereby capturing the recovery phrases displayed to users during wallet setup. Such devices could allegedly still pass Ledger's official genuine product verification, because the original secure element remained intact and the verification process was unable to detect unauthorized physical modifications. One emerging speculation is that attackers collected seed phrases from affected devices and waited to simultaneously transfer funds from multiple wallets. Karpelès's warning reportedly received approximately 90,000 views, which may have made the attackers aware that their operation had been exposed and prompted them to move the stolen funds. Karpelès stated that one affected Ledger device he examined came from Malaysia, was packaged in intact shrink wrap, and had an implant hidden beneath the screen. The suspected attack path is currently a compromised hardware supply chain rather than a vulnerability in cryptographic algorithms. The connection between Karpelès's warning and the subsequent wallet fund transfers has not yet been confirmed, nor has it been verified whether the same batch of implants was responsible. If the relevant circumstances are confirmed, the incident would demonstrate that even if a device is certified by the manufacturer, compromised hardware can still undermine users' self-custody security.
Odaily News: Bitcoin fell to $80,350 on Thursday before rebounding, climbing back above $83,000 at the Friday U.S. stock market open and subsequently fluctuating around $82,500. The rolling 24-hour cryptocurrency liquidation amount had previously exceeded $1 billion. Despite news circulating that Ledger hardware wallet users' funds were stolen, the crypto market has not yet shown significant selling pressure.Analysts suggest that before the U.S. CPI data is released on October 14, Bitcoin may remain range-bound, with the main trading range between $81,300 and $86,500, and could repeatedly test $84,000. The market is also watching whether Bitcoin can hold the key level of $82,500 before the weekly close. (Cointelegraph)
According to MistTrack monitoring, Odaily reports that Tether has frozen a large amount of USDT on addresses related to the Ledger user fund theft incident. The losses from this incident have approached $90 million, and some affected users have contacted MistTrack for assistance, with the team currently following up. Previously, Ledger stated it was investigating the theft of user funds related to Southeast Asian distributor CryptoBillis.
CZ posted a warning urging Ledger hardware wallet users to be more vigilant, especially those who recently purchased devices. He stated that based on currently available information, the incident appears to be related to a supply chain attack involving a certain vendor, and a small number of users may have purchased counterfeit or tampered Ledger devices.CZ said that Ledger is one of the most established and secure hardware wallets in the industry, having long withstood market tests, but similar incidents can still occur. He expressed hope and belief that BNB ecosystem participants and the entire crypto industry will assist in tracking and recovering the related funds.
Ledger Support posted on X platform stating that it is currently investigating a theft of assets involving Southeast Asian users, who had purchased devices through reseller CryptoBilis. Ledger has asked CryptoBilis to suspend sales and shipments, and recommends that users who purchased devices through this reseller within the past 90 days refrain from initializing their devices; users who have already completed setup should create a new Ledger signing device using a new mnemonic phrase and transfer their assets to a new wallet.On-chain investigator Specter previously estimated that this incident has led to the theft of hundreds of wallets across Bitcoin, Ethereum, and Tron networks, with losses exceeding $86 million. Security researcher tanuki42 previously estimated losses had exceeded $72 million and stated that the amount is still increasing. Currently, the specific cause of the incident and whether the affected devices have security vulnerabilities remain to be investigated and confirmed.
Odaily News: According to on-chain detective Specter, multiple reports of Ledger user wallet thefts have appeared on X and Reddit. After tracing the theft addresses, it was found that the related addresses received inflows of funds from hundreds of victim wallets across multiple major blockchains including Ethereum, TRON, and Bitcoin, with total losses exceeding $86 million. The related addresses include: bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl, TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C, TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9, TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW, 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841, 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a, 0x83aeac166f6832ae3500000a24510a95a052a599, bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9, bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26n, TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a.
Ripple与XRP Ledger基金会（XRPLF）联合成立新组织XRP Asia，旨在推动亚太地区XRP Ledger（XRPL）生态发展，总部位于新加坡，由前Hedera基金会亚太及金融科技/支付业务负责人Sabrina Tachdjian领导，该组织将支持开发者培训、黑客松、合作伙伴计划、创业支持以及生态活动，并对接基础设施服务商、孵化及资助项目，以及连接投资者和生态合作伙伴。
The XRP Ledger batch transaction upgrade countdown was reset due to insufficient validator support, delaying activation from September 29 to October 9. This marks the second attempt following a fix for a signature vulnerability.
Bitget CEO Gracy Chen posted a 12-hour progress report on the security incident on X, including:1. Affected assets include ETH, XRP (largest single-chain loss), BNB, AVAX, USDT, USDC, and other tokens. Affected chains include: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. All on-chain cold wallets have been confirmed secure and unaffected.2. All foundations of the affected chains have been contacted, and some foundations have confirmed the freezing of the hacker's wallet addresses.3. Based on IP behavioral characteristics and on-chain analysis, the attack methodology is highly consistent with known patterns of North Korean hacker groups. Relevant authorities have been notified, and full cooperation is being provided for a global investigation.4. Bitget Wallet (decentralized wallet) operates completely independently from Bitget exchange infrastructure, and this incident has no impact on it. Bitget Wallet assets are completely safe.5. Transparent disclosure regarding the platform's financial status: In addition to over $464 million in protection funds (all held in publicly verifiable wallet addresses), Bitget's own assets exceed $1 billion. User funds are covered at a 1:1 ratio, and all data can be verified on-chain.6. Regarding withdrawal recovery timing: The goal is to achieve full recovery as soon as possible. Once a specific time window is confirmed, an announcement will be made immediately. No commitment will be made to timelines that cannot be fulfilled.
According to Bloomberg, crypto hardware wallet manufacturer Ledger SAS has announced the hiring of Oded Blatman as Chief Information Officer (CIO) and Chief Security Officer (CSO), consolidating internal technology systems and security functions under a single executive lead. Previously with blockchain company Fireblocks, Blatman will oversee network and infrastructure security, product security, physical and workplace safety, internal IT, and enterprise risk management.