A tampered Ledger hardware wallet reportedly linked to earlier losses in Southeast Asia is said to have surfaced in Europe, raising fresh questions about how widely the compromised devices may have been distributed. The development follows an incident that—according to a cybersecurity estimate—already resulted in about $93.4 million in stolen funds from Asian customers.
Separately, the week also brought security-related updates across the wider crypto ecosystem, including a bug bounty paid for an XRP Ledger overflow issue dating back to 2015, and fresh “bunker mode” warnings from Ethereum co-founder Vitalik Buterin about AI-accelerated breakthroughs in cryptography.
Key takeaways
- A new report claims a modified Ledger device was purchased in Europe from MediaMarkt, though no stolen funds have been reported from that unit so far.
- Ledger previously asked customers who bought from the Southeast Asian reseller CryptoBilis within 90 days to consider moving their assets; Ledger has not confirmed the European device is part of the same scheme.
- Veria Labs says it was paid a $250,000 bug bounty for an overflow bug in XRP code that was patched quickly and is not believed to have been exploited.
- Vitalik Buterin endorsed researcher Justin Drake’s call for industry preparation as AI systems could accelerate mathematical discoveries relevant to blockchain security.
- Other ecosystem security incidents mentioned this week include a phishing link appearing on Coldcard’s X account and allegations that Tether temporarily froze funds tied to THORChain vaults.
Ledger tampering appears beyond Asia, but Ledger has not confirmed scope
The Ledger story centers on devices modified with an apparent “implant” designed to compromise recovery seed access. Earlier coverage linked the tampering to specific hardware sold through an Asian authorized reseller—CryptoBilis—after those devices were found modified in a way that could allow attackers to read seed phrases even while the device appeared to pass authenticity checks.
According to a European X user identified as Johannes, he presented photographs of a tampered Ledger he said he bought about two weeks ago from MediaMarkt, a consumer electronics retailer in Europe. Johannes claimed the implant appears to be an earlier version of the one previously associated with compromised Ledger shipments in Asia.
Johannes suggested the device he purchased may not have been active or may have been held back for later broader use, noting that either the compromised device failed or the attackers were waiting for a wider rollout. He also emphasized that, in his reported case, no funds had been taken.
Former Mt. Gox CEO Mark Karpeles added further context by pointing to what he said was visible on the device’s antenna, describing it as an “Eurasian version.” The implication is that separate implant variants may exist for different regions due to differences in mobile network frequencies. However, Ledger has not confirmed that the European unit is part of the same broader attack chain.
Ledger’s response to the Southeast Asia incident included asking CryptoBilis to pause sales and shipments as a precaution. Ledger also advised customers who purchased from CryptoBilis within the previous 90 days to consider transferring assets to a new Ledger device. Ledger stated that the volume of impacted devices is limited, while acknowledging the incident through an update posted on its official channels.
While a cybersecurity outlet, Yfarmx, estimated total losses at $93.4 million across 471 addresses, that figure has not been independently confirmed by Ledger. The appearance of a separate report from Europe—without confirmed linkage—means investors and users should treat the incident as an evolving risk rather than a concluded regional event.
What to watch: authenticity checks weren’t enough
One of the most consequential aspects of the Ledger compromise described in earlier reporting is that the tampered devices reportedly appeared to pass authenticity checks while still enabling theft. That detail matters because it changes how users might think about “safe” purchasing channels and the reliability of device verification alone.
Ledger’s guidance after the CryptoBilis-linked issue—moving assets for buyers within a defined window—was designed to reduce exposure even when devices may not show obvious signs. If the European report ultimately proves to be linked to the same implant family or distribution method, it could expand the practical impact of the earlier guidance beyond Southeast Asia.
At this stage, however, readers should distinguish between what is claimed (a tampered device purchased in Europe) and what is confirmed (Ledger has not validated that the European unit is tied to the earlier Asia-linked campaign). Until Ledger provides confirmation, the safest interpretation is that the risk profile may extend geographically, but the exact scope remains uncertain.
XRP Ledger bug bounty: overflow issue patched, no evidence of exploitation
Security firm Veria Labs announced it was awarded a $250,000 bug bounty after identifying an overflow bug hidden in XRP’s code since 2015. Veria Labs claimed that—if left unpatched—an attacker could have crafted a transaction that printed an extreme number of XRP “out of thin air.”
According to Veria Labs, the vulnerability has been patched and there is “no evidence” it was ever exploited. The company’s co-founder, Cayden Liao, wrote on X that its AI agent reviewed rippled (the software that runs the XRP Ledger) and found two low-severity bugs. Liao said the two issues could be chained together to create a much larger exploit than either bug would allow on its own.
In the description provided by Liao, a single crafted exploit transaction could have produced more than 18 trillion XRP, which would be far above the asset’s total supply. He framed the severity as a function of how bugs interact rather than how any single issue behaves in isolation. Veria Labs also stated that the bugs were reported on September 22, with RippleX patching them three days later.
For XRP holders, the practical takeaway is that rapid remediation and the reported absence of exploitation are meaningful safeguards. For the broader market, the incident reinforces that “low severity” bugs can still become critical when they combine in unexpected ways—especially under conditions where adversaries test edge-case behavior.
AI “bunker mode” gets backing from Vitalik Buterin
Ethereum co-founder Vitalik Buterin weighed in on a warning from researcher Justin Drake about the pace at which AI could accelerate mathematical progress relevant to blockchain cryptography. Buterin said he does not recommend moving funds immediately, but that the industry should “take the risks to cryptography from AI-accelerated math seriously.”
Drake had urged the ecosystem to prepare for “bunker mode” as OpenAI reportedly released hundreds of new mathematical findings that humans struggled to solve. Drake’s concern was not that cryptography was already broken, but that AI systems might help uncover structural weaknesses in elliptic curve cryptography or lattice-based cryptography over time.
Other projects and analysts have criticized the warnings as fear mongering, arguing there is currently no evidence AI agents are close to breaking cryptography. Still, Buterin’s response suggests Ethereum’s leadership sees enough plausibility in the scenario to encourage more proactive research and planning.
Even without imminent threats, this stance matters to long-term users and developers because cryptographic migration tends to be slow, complex, and expensive—making early preparation valuable even when timelines remain speculative.
Other security signals mentioned this week
Coldcard, a Bitcoin-only hardware wallet, said it was investigating an unauthorized phishing link that appeared on its official X account despite using offline two-factor authentication. The post was deleted, and the company said its only official website is coldcard.com.
Separately, THORChain technical co-founder Chad Barraford accused Tether of temporarily freezing USDt (USDT) vaults tied to THORChain. Barraford claimed Tether blacklisted specific vault addresses, then unfroze them hours later as trading resumed.
Finally, New York permanently barred former Celsius CEO Alex Mashinsky from the crypto industry, securities and commodities sectors as part of a settlement with New York Attorney General Letitia James, which included up to $35 million in conditional payments. The case stemmed from allegations that Mashinsky misled hundreds of thousands of investors about Celsius before its collapse.
As these stories develop, readers should watch for primary confirmation from Ledger regarding the suspected European device, and for additional security advisories that clarify whether the XRP Ledger bug has broader implications beyond the patched issue; meanwhile, “bunker mode” planning remains an open question for the industry as AI-driven research continues to advance.
Be the first to comment