News linked to both this project and an event.
Odaily reports: Bitcoin News posted on X platform that former Mt. Gox CEO Mark Karpelès accused Ledger of failing to adequately alert customers to sophisticated hardware implants after learning of the relevant threat as early as March 2026, and of burying related warnings in Ledger Academy articles. Karpelès stated that evidence of mass-produced, self-aligning implants should have triggered a highest-level alarm response. After Ledger CEO Pascal Gauthier responded by referencing his Mt. Gox experience, Karpelès fired back, saying he had trusted Ledger to learn from his failures and do better than he did. Karpelès also criticized Ledger for continuing to downplay the incident and questioned its communication with affected customers.
Odaily News: Former Mt. Gox CEO Mark Karpelès stated that hardware wallet manufacturer Ledger received warnings about possible tampering with its hardware wallets as early as December 2025, but did not take sufficient measures to alert customers before the recent security incident occurred.Karpelès believes that Ledger should have disclosed the relevant risks to users earlier and strengthened security warnings. Currently, the above claims are Karpelès's personal allegations, and it cannot yet be confirmed on this basis that Ledger devices have a large-scale security vulnerability. (Cointelegraph)
Odaily News: Crypto hardware wallet company Ledger will launch the Atom in mid-2027. The device supports running apps such as WhatsApp and Instagram, and can switch between smartphone functionality and a protected digital asset management mode.The Atom will feature a tamper-resistant casing, sensors, and specialized packaging, which can help prevent supply chain attacks like the recent CryptoBilis vulnerability even when the device is powered off.Ledger initially plans to sell the Atom exclusively through its official website to reduce third-party distribution risks, but will not offer trade-in services for customers affected by the vulnerability. (CoinDesk)
Odaily News: According to Bitcoin News monitoring, Bitcoin News released a podcast in which former Mt. Gox CEO Mark Karpelès and Foundation CEO Zach Herbert discussed the largest supply chain attack in crypto industry history. Mark Karpelès stated that he discovered the spy implant 3 weeks before the funds were stolen and contacted Ledger, but received no response. The implant had a built-in hidden cellular modem that could directly read the seed phrase on the screen and passed Ledger's own checks; even setting a passphrase could not prevent the seed phrase from being stolen. Mark Karpelès said that with $5 million, he could create an implant that would only be detectable through X-ray. The episode also discussed the hardware wallet reseller model, the Malaysian reseller behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The episode timeline shows that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.
Odaily News: According to monitoring by Bitcoin News, German Ledger user @jayr_crypto reports receiving another forged letter this week. The letter impersonates Ledger, claiming that new regulations require users to register a Bitcoin wallet through a service called ZenLedger by October 31. The letter uses Ledger's official branding elements, references German financial regulators, and includes a QR code that directs users to a so-called mandatory registration process. The user believes that addresses exposed in a previous data breach are being used to conduct targeted attacks against Ledger users. In the same week, Ledger coordinated with MediaMarktSaturn to suspend sales of its hardware wallets across a European retail network spanning 11 countries and more than 1,000 stores. It was previously reported that Ledger devices purchased from European retailers were found to contain malicious spy implants. Ledger separately confirmed that compromised devices sold by a distributor in Southeast Asia contained implants capable of stealing recovery phrases and transmitting them via cellular networks. Ledger has not yet confirmed that European devices were compromised. Ledger users are currently facing physical supply chain tampering and targeted phishing attacks exploiting home addresses. Do not scan suspicious QR codes or enter recovery phrases.
According to official announcements, Payy has initiated a claims process for affected users following the cross-chain bridge contract hack on September 24, with a 30-day window for claim submissions. Eligible claims will be compensated in USDC on the Ethereum network. Meanwhile, Payy Wallet is currently suspended and will be completely shut down after the claims period concludes.
Odaily reports, according to monitoring by Bitcoin News, @0xJohannes stated that a Ledger hardware wallet purchased from an official European reseller several weeks ago was found to contain an unauthorized spy implant device. Suspicious wiring not present in genuine Ledger hardware was discovered inside the device, indicating it may have been physically tampered with before being sold. The implant appears to be an older version, as newer versions typically conceal the components behind the screen. Funds in the affected device have not been stolen thus far. Suspected cases have currently been reported in Asia, South America, and Europe. If the original secure element remains intact, Ledger's Genuine Check software cannot detect unauthorized physical modifications.
according to Lookonchain monitoring, an old wallet address had been operating securely for 8 years. After more than 4 years of dormancy, the address transferred funds to a new wallet one month ago, and subsequently CryptoBillis Ledger Drainer stole all 59 ETH from that wallet, worth $146,800.
Odaily News — According to monitoring by Bitcoin News, former Mt. Gox CEO Mark Karpelès may have inadvertently triggered a coordinated transfer of funds across multiple wallets after publicly disclosing physical tampering with Ledger devices equipped with hidden surveillance implants. On October 8, Karpelès warned that counterfeit or tampered Ledger devices with hidden SIM cards were being sold on the market, and these SIM cards were capable of transmitting stolen seed phrases. The implants were reportedly able to intercept data sent to the device screen, thereby capturing the recovery phrases displayed to users during wallet setup. Such devices could allegedly still pass Ledger's official genuine product verification, because the original secure element remained intact and the verification process was unable to detect unauthorized physical modifications. One emerging speculation is that attackers collected seed phrases from affected devices and waited to simultaneously transfer funds from multiple wallets. Karpelès's warning reportedly received approximately 90,000 views, which may have made the attackers aware that their operation had been exposed and prompted them to move the stolen funds. Karpelès stated that one affected Ledger device he examined came from Malaysia, was packaged in intact shrink wrap, and had an implant hidden beneath the screen. The suspected attack path is currently a compromised hardware supply chain rather than a vulnerability in cryptographic algorithms. The connection between Karpelès's warning and the subsequent wallet fund transfers has not yet been confirmed, nor has it been verified whether the same batch of implants was responsible. If the relevant circumstances are confirmed, the incident would demonstrate that even if a device is certified by the manufacturer, compromised hardware can still undermine users' self-custody security.
Odaily News: According to PeckShield monitoring, the attacker behind 79AU's operational hot wallet 79thVault has returned 15,000 BNB, worth approximately $11 million, to a wallet address designated by the project team. Additionally, the attacker had previously deposited 30 BNB into KuCoin. The disposition of the remaining funds is currently unclear. Earlier, 79thVault on BNB Chain suffered losses of approximately $12.5 million, possibly due to a private key leak. The team's operational hot wallet typically only makes small transfers to the reward pool, but recently the address transferred 2.01 million 79AU from trading pairs to external addresses in 7 transactions, with amounts of 10,000, 100,000, 100,000, 300,000, 500,000, 500,000, and 500,000 tokens respectively.
According to Lookonchain monitoring, a wallet (0xf15d...bddf) suspected to belong to a gambler or hacker sold 262.78 ETH 40 minutes ago, obtained $643,000 USDC and deposited it into Hyperliquid, then opened a 40x leveraged short position on 305.51 BTC, with a notional value of $25.4 million and a liquidation price of $84,086.03.
Odaily News: According to on-chain detective Specter, multiple reports of Ledger user wallet thefts have appeared on X and Reddit. After tracing the theft addresses, it was found that the related addresses received inflows of funds from hundreds of victim wallets across multiple major blockchains including Ethereum, TRON, and Bitcoin, with total losses exceeding $86 million. The related addresses include: bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl, TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C, TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9, TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW, 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841, 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a, 0x83aeac166f6832ae3500000a24510a95a052a599, bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9, bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26n, TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a.
Odaily reports: Second, a project built on Ark Protocol, disclosed that its server was exploited in an attack on Monday, resulting in the loss of 0.75 BTC of its own funds, worth approximately $62,300. The team stated that user funds were not affected and that the issue was fixed within hours.The attacker subsequently continued attempting to withdraw more funds from the project and launched a denial-of-service attack. On Tuesday, Second said the attack may have degraded the ability of Bark-based wallets to receive Lightning Network transfers.Second stated that the vulnerability was in the Ark server's boarding process, where an attacker could register and exit the relevant boards using only their own signature, while simultaneously spending the same batch of VTXOs in the node via the Lightning Network. The attacker also attempted to use bitcoin linked to the Blink Wallet security breach on September 19, but was unsuccessful. (Bitcoin.com News)
Odaily News — According to on-chain analyst Yu Jin's monitoring, trader @frogmanhaha's wallet (0x14...5794, 9wMS...ov8z) was suspected of being hacked approximately 5 hours ago, with 9 types of assets worth about $4 million transferred, sold, and swapped into ETH, BNB, and SOL, then dispersed through tools such as Privacy Cash and Chainflip. The stolen assets mainly include 1.43 million BP, worth approximately $1.77 million; 13.96 million MarsCoin, worth approximately $1.55 million; and 3.7 million Cash Cat, worth approximately $510,000.
MetaMask announced it is exiting the affected validator nodes in its non-custodial staking service, and there are currently no signs that wallets or customer funds have been compromised.
MetaMask stated that some infrastructure was affected by a security incident, but no direct threat to MetaMask wallets has been identified to date, and it has voluntarily exited the affected validator nodes.
Odaily reports: Bitget stated on X platform that an investigation by Google Cloud's Mandiant into Bitget's September 24 security incident found that attackers gained unauthorized access to certain third-party security devices, then laterally moved into Bitget's exchange wallet environment and obtained access to both warm and hot wallets. The investigation findings are consistent with the attack path previously disclosed by Bitget.
OKX founder Star posted on X platform regarding the Bitget hack incident, stating that THORChain is a "very unique" part of the crypto industry. After Bitget was attacked, both the OKX exchange and OKX Wallet immediately took action and stood ready to assist in identifying and tracing the flow of stolen funds, and to block the transfer of stolen funds where possible. Star stated that resilience is an important quality that every crypto company should possess; when security incidents occur, the industry needs to respond quickly, share information, and cooperate to protect users and prevent similar attacks from happening again. He emphasized: "Security is not a competition, but a shared responsibility."
Bitget CEO Gracy Chen 发布安全事件最新进展称，平台正与独立第三方安全团队 Mandiant 和慢雾合作，对此次事件展开全面调查。 Gracy Chen 表示，目前用户账户余额保持完整，此次平台层面安全事件造成的影响将由 Bitget 用户保护基金覆盖；Bitget Wallet 采用自托管模式，其基础设施与 Bitget Exchange 相互独立，因此未受到此次事件影响。 目前 Bitget Exchange 的充值、交易及奖励等功能继续运行，但提币仍暂时暂停，平台正在进行额外安全核查，确认安全后将恢复。Bitget 官方公告也显示，提币服务目前仍处于暂停状态，充值和交易正常运行。 Bitget 表示，后续调查进展及安全事件相关信息将通过官方渠道持续公布。
Bitget CEO Gracy Chen posted a 12-hour progress report on the security incident on X, including:1. Affected assets include ETH, XRP (largest single-chain loss), BNB, AVAX, USDT, USDC, and other tokens. Affected chains include: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. All on-chain cold wallets have been confirmed secure and unaffected.2. All foundations of the affected chains have been contacted, and some foundations have confirmed the freezing of the hacker's wallet addresses.3. Based on IP behavioral characteristics and on-chain analysis, the attack methodology is highly consistent with known patterns of North Korean hacker groups. Relevant authorities have been notified, and full cooperation is being provided for a global investigation.4. Bitget Wallet (decentralized wallet) operates completely independently from Bitget exchange infrastructure, and this incident has no impact on it. Bitget Wallet assets are completely safe.5. Transparent disclosure regarding the platform's financial status: In addition to over $464 million in protection funds (all held in publicly verifiable wallet addresses), Bitget's own assets exceed $1 billion. User funds are covered at a 1:1 ratio, and all data can be verified on-chain.6. Regarding withdrawal recovery timing: The goal is to achieve full recovery as soon as possible. Once a specific time window is confirmed, an announcement will be made immediately. No commitment will be made to timelines that cannot be fulfilled.