A sophisticated supply chain attack on Ledger hardware wallets has spread beyond Asia to Europe, according to reports this week. A European user purchasing from electronics retailer MediaMarkt found a tampered device with an implant, similar to compromised units discovered in Asia but reportedly an earlier version.
The Asian attack resulted in an estimated $93.4 million in losses across 471 addresses, according to cybersecurity outlet Yfarmx, though Ledger has not confirmed this figure. Compromised devices were shipped through CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia, and the Philippines. The implants were engineered to read seed phrases and steal funds while still passing authenticity checks.
Ledger has asked CryptoBilis to suspend sales and advised customers who purchased devices within the past 90 days to transfer assets to new wallets. The company stated the volume of impacted devices is limited.
Former Mt Gox CEO Mark Karpeles, who helped expose the Asian attack, noted that the European device's antenna indicates it is the "Eurasian version," suggesting attackers developed region-specific implant versions to account for different mobile frequencies.
XRP Security Firm Discovers Patched Minting Bug
Security firm Veria Labs received a $250,000 bug bounty for uncovering an overflow vulnerability in XRP's code that has existed since 2015. The firm's AI agent identified two low-severity bugs that, when chained together, could have enabled a single transaction to create more than 18 trillion XRP—184 times the total supply.
The bugs were reported on September 22 and patched by RippleX three days later. There is no evidence the vulnerability was ever exploited. Veria Labs co-founder Cayden Liao noted that the bugs' low individual severity likely contributed to the vulnerability remaining undiscovered for nine years.
Ethereum Leadership Addresses AI Cryptography Risks
Ethereum co-founder Vitalik Buterin has backed warnings from researcher Justin Drake that artificial intelligence advances could threaten current blockchain cryptography before quantum computers pose a threat. Buterin advised against immediate panic but said the industry should take cryptographic risks from AI-accelerated mathematics seriously.
Drake called for "bunker mode" preparation following OpenAI's release of hundreds of new mathematical findings previously unsolved by humans. While none directly relate to cryptography, the potential for AI agents to uncover insights into elliptic curve or lattice-based cryptography concerns Ethereum's core team.
Some projects and analysts have criticized these concerns as fear mongering, noting no evidence that AI agents are close to breaking current cryptography.
Market Movements and Stablecoin Expansion
Bitcoin declined 2.8% to $83,435, Ethereum fell 6.5% to $2,562, and XRP dropped 7% to $1.40. The total cryptocurrency market cap stands at $2.82 trillion. Among the top 100 cryptocurrencies, StarkNet led gains with 91% growth after announcing a post-quantum Layer 1 upgrade.
Samsung plans to introduce USDC transfers to its wallet app for 82 million eligible US Galaxy users by late October, enabling international transfers and deposits to bank accounts in over 60 countries. Bastion will provide stablecoin infrastructure, with Coinbase serving as sub-custodian through Coinbase Prime Vault.
Regulatory and Security Developments
Coldcard hardware wallet discovered an unauthorized phishing link posted on its official X account despite using offline two-factor authentication. The post was deleted and the company confirmed its only official website is coldcard.com.
THORChain's technical co-founder reported that Tether temporarily froze approximately 1.45 million USDT across four of the network's vault addresses without explanation, then unfroze them hours later.
Former Celsius CEO Alex Mashinsky was permanently barred from the cryptocurrency, securities, and commodities industries in a settlement with New York Attorney General Letitia James involving up to $35 million in conditional payments. The settlement addresses a 2023 lawsuit over misleading statements regarding Celsius safety before the company's 2022 collapse. Mashinsky is serving a 12-year federal prison sentence for fraud and was separately ordered to forfeit over $48 million.
