The XRP Ledger Foundation has added Flare to its recommended validator list and removed Anodos Finance at its own request, with the foundation and Ripple now publishing matching sets of 35 validator keys. XRP Ledger Foundation said in its announcement…
Zcash has introduced Zillions, an Anoma-powered browser wallet whose launch features include transparent and shielded transfers, multiple-account management, and Ledger hardware-wallet support. Zcash’s official account promoted the new wallet on Oct. 27, inviting users to explore its features and share…
Ripple’s Swell conference is scheduled for October 27–29 in New York, combining its institutional event with the Apex developer gathering. Ahead of the opening, the useful question is which announcements will connect a commercial promise to a working product and a clear implementation path.
TL;DR
The official schedule places Swell in New York on October 27–29.
The combined event brings financial and developer audiences together.
A partnership, a pilot and a live service provide different levels of evidence.
The combined programme puts implementation beside the pitch
The official event site lists payments, tokenization, stablecoins, settlement, privacy and XRP utility among its themes. It describes this as the first unified Swell-and-Apex event. This is a preview of the scheduled programme, not a report that any forthcoming product has launched.
Bringing the two audiences together can make some questions harder to avoid. A financial institution may want to know who holds customer assets and how disputes are resolved. A developer may want to know which transaction types, interfaces and network features are actually available.
A credible announcement needs both sets of answers. A demonstration can establish that a workflow is technically possible without proving that customers are using it at scale. A commercial agreement can establish intent without showing that integration has finished.
The distinction is relevant to Ripple Prime’s institutional clearing work. The financial relationship and the technical settlement process deserve to be understood on their own terms.
Network activation is a separate milestone from a stage announcement
For features that alter XRP Ledger transaction processing, the amendment process matters. The documentation describes validator voting and a sustained support threshold before an amendment becomes active. Including code in software does not itself mean that the network has enabled the feature.
That gives readers a practical way to assess a conference claim. Is a feature an idea, a specification, released software, an amendment awaiting approval or something already usable on the intended network? Each stage can represent progress, but they are different stages.
The same care is needed with tokenization figures. The activity examined in NewsBTC’s tokenized-equity coverage concerns assets and their uses. A newly announced distribution partnership would not immediately establish comparable balances or transaction volume.
Nor does business expansion automatically translate into demand for one particular token. Payment principal, collateral, transaction fees and reserves can be denominated in different assets. The mechanics of the announced service determine the connection.
When Swell begins, the strongest evidence will be named counterparties, specific customer availability, published terms and verifiable network milestones. The combined format creates a useful opportunity to connect those details. Until then, anticipated announcements remain anticipated.
Written by the News Desk and edited by Samuel Rae.
An XRP Ledger maintenance amendment is running on a new activation clock after losing the validator majority behind its earlier countdown. The fixCleanup3_4_0 amendment regained majority support on October 21, moving its earliest possible activation window to November 4, subject to that support continuing.
TL;DR: The amendment regained validator majority on October 21 after its first countdown failed. A fresh two-week window points to November 4 at the earliest, if support holds.
At the XRPL Dashboard’s October 24, 07:09 UTC snapshot, 32 of 35 trusted validators supported the amendment, or 91.43%. The tracker showed a new majority timestamp of October 21 at 14:46:22 UTC. Those figures are a dated observation; validators can change their positions.
XRPL Win’s amendment history separately records the earlier attempt beginning October 9 and losing majority on October 21. The interrupted run lasted more than 12 days. It did not satisfy the uninterrupted period required for activation, so the earlier October 23 expectation no longer applies.
The Clock Requires Continuous Support
The ledger’s official amendment documentation requires support from more than 80% of trusted validators for two weeks. If support falls below the requirement, the waiting period starts again when the amendment regains majority.
Network processing also means the end of the two-week period should not be treated as an exact appointment. Amendment decisions are handled through designated ledger checkpoints. November 4 is therefore a conditional earliest window, rather than a guaranteed switch at precisely 14:46 UTC.
This is a consensus process among validators on the blockchain. Holding XRP does not itself constitute an amendment vote. The visible count matters because it shows whether the required network support is being maintained throughout the waiting period.
A Collection Of Technical Fixes
The official amendment description groups fixes affecting vaults, lending, automated market makers, permissioned exchange functions, trust lines, NFTs and other ledger features. Examples include more precise vault rounding and changes to when a loan can be treated as in default.
Another change concerns delegated payment permissions. The documentation says an account with a delegated PaymentBurn permission should also need PaymentMint permission to cross a zero balance into minting. That concerns issued tokens and multi-purpose tokens, which can represent tokenized assets; it should not be described as permission to mint native XRP.
The package also separates signing prefixes used for sponsor and counterparty signatures. These are changes to the handling of transactions and permissions, rather than evidence that a new lending service has launched.
Separate lending amendments still have their own voting status. Users tracking the wider DeFi roadmap should therefore distinguish the cleanup package from activation of those features. The next decisive development for this amendment will be sustained majority through the full window, followed by the ledger recording it as enabled.
Written by the News Desk and edited by Samuel Rae.
October 2026 brought a clear demonstration that hardware wallets, while far safer than software alternatives, are not immune to sophisticated physical attacks.
Beginning on 9 October, hundreds of users who had purchased Ledger devices through the Southeast Asian reseller CryptoBilis saw their funds drained across Bitcoin, Ethereum, TRON and other chains. On-chain researchers estimated losses between roughly $86 million and more than $100 million. Ledger confirmed that at least one affected device contained an unauthorized hardware implant and stated that every confirmed loss in the incident was linked to a device sold by CryptoBilis. The company has emphasized that its own infrastructure, firmware and direct sales channels were not compromised.
The Supply-Chain Attack
The attack was physical. Someone in the distribution chain opened genuine Ledger Nano X devices, installed a small circuit board and resealed them. The implant sits inside the enclosure under or behind the screen where foam padding normally rests, and taps the SPI bus that carries data from the Secure Element to the display. When the owner sets up the device and the screen shows the 24-word recovery phrase, the implant’s microcontroller recognizes those screens, reconstructs the words and sends them out over LTE using a provisioned eSIM and a small antenna. Because the original Secure Element remains untouched, the device continues to pass Ledger’s Genuine Check. Mark Karpelès and Tibane Labs have documented multiple generations of the implant, progressing from early versions with visible wires and a smaller battery to later flex-circuit designs that are harder to notice and sometimes keep the original battery.
Source: Mark Karpelès
Mark Karpelès publicly posted a photo of a unit that arrived from Malaysia with flawless packaging. The extra hardware only became visible when he opened the case.
Source: Mark Karpelès
Similar implants have been reported in devices obtained through other channels, including Japanese marketplaces and at least one European store, although Ledger has so far tied every confirmed fund loss specifically to CryptoBilis purchases.
It was confirmed that the Ledger supply chain is compromised in Europe as well. Source: @0xJohannes_
The company has asked the reseller to halt sales and has advised recent buyers not to initialize unused devices. Those who already completed setup are told to move their assets to a new signer purchased directly from Ledger and initialized with a fresh seed phrase.
How to Buy a Hardware Wallet Safely
The single most effective protection is to purchase directly from the manufacturer’s own online store.
Authorized resellers are listed on the manufacturer’s website, yet CryptoBilis was also a partner that introduced modified units into the channel. Marketplace listings of third-party shops carry a much higher risk of both counterfeits and implants.
Once the package arrives, you should confirm that a new device requires you to generate a recovery phrase yourself on first use. Any recovery phrase that’s already written on a card or printed in documentation belongs to someone else and should never be used. The phrase must appear only on the device’s own screen and you must write it down yourself on paper or metal. Never type it into a computer or phone, don’t use websites or applications with it.
Below you can see a photo of the hardwallet owner signing a transaction inside the faraday cage to avoid any interference and possible theft.
Source: @oren_z0
Check Your Wallet
The first question is the source of the device. Anyone who bought a Ledger from CryptoBilis or another untrusted reseller in recent months should treat the unit as unsafe. Genuine Check is still worth running because it confirms that the Secure Element is original and the firmware is approved, yet it can’t detect added circuitry that merely listens to the screen.
You can also visually inspect the case for extra wires or antennas that can reveal tampering, but modern implants are designed to be inconspicuous and reliable detection usually requires opening the device. After a wallet is set up, compare receiving addresses shown on the device screen against those displayed in the companion application and review transaction history on block explorers for unexpected outgoing transfers. The recovery phrase must be generated by the device under your direct observation and written down only by you.
Mark Karpelès also has a few videos on opening and closing Ledger wallets that you might find helpful.
What to Do If You Suspect Compromise
If a device was purchased from CryptoBilis or any other questionable source and has already been initialized, the existing recovery phrase should be treated as compromised. Move your assets to a new wallet whose seed was generated on a trusted device bought directly from the manufacturer. Never reuse the old seed for any purpose.
More Recommendations
A BIP-39 passphrase adds a meaningful layer of protection because it isn’t displayed during ordinary setup and must be known in addition to the seed. It’s also known as passphrase (the extra “25th word”). It’s optional and you may choose it later. It is not generated or displayed by the device during ordinary setup. Adding it creates a hidden wallet, which means you have completely different keys and addresses.
For larger holdings use a multisignature arrangement to reduce reliance on any single device. Always check the address where you send your money to, as it can often be replaced by malware or bots making small transactions with similar addresses to mislead you into sending money to this similar address.
Hardware wallets still provide strong protection against the majority of remote thefts precisely because private keys never leave the Secure Element and every transaction requires physical confirmation on the device itself.
Summary
Hardware wallets can pass authenticity tests and still contain an implant capable of capturing the recovery phrase the moment it appears on screen. The best thing you can do is to buy devices only from the manufacturer, generate the seed yourself on the device and write it down offline. For anyone who recently purchased a device from a third party, the cost of generating a new seed and moving funds is far lower than the cost of discovering the compromise after the fact.
A hardware wallet’s strongest cryptography offers little protection when an attacker can interfere with the device before its owner even switches it on. That is the uncomfortable lesson from the CryptoBilis case now facing Ledger customers in Southeast Asia.
TL;DR: Investigators have linked roughly $90 million or more in reported crypto losses to tampered wallet devices sold through a reseller channel. Ledger says its own systems were not compromised and has warned affected customers to move to newly generated recovery phrases.
The incident involves physical modifications rather than an ordinary phishing message. Reports describe implants that could capture a recovery phrase during device setup and transmit information to attackers. Once someone else possesses that phrase, they may be able to recreate the wallet without needing physical access to the device.
Ledger said confirmed cases involved wallets sold through CryptoBilis, a reseller listed in parts of Southeast Asia. It asked the reseller to stop sales and shipments while investigations continued. Customers who received affected devices were advised not to initialize them, and those already in use were told to secure funds with new credentials using trusted equipment.
The precise loss figure is still an estimate, and investigators have not publicly established a complete count of affected units. A device successfully passing an ordinary software or chip authenticity check should not automatically be interpreted as proof that no unauthorized physical component has been added elsewhere.
This attack is especially troubling because hardware wallets are bought to reduce dependence on third parties. Here, the supply chain itself became the point of exposure. For anyone buying a security device, provenance and physical integrity now deserve attention alongside firmware version and backup discipline.
Written by the News Desk and edited by Samuel Rae.
Call it poetic justice: one of the biggest victims of last week’s Ledger theft happened to be a scammer themself, according to blockchain analysts, and lost nearly $5 million in bitcoin.
In a post Thursday, Chainalysis wrote that a crook lost 60 bitcoins worth about $4.8 million they’d stolen via a so-called task scam.
According to Chainalysis, the address was linked with a con where people were paid to fake sales and reviews of real items. They were told to add their own money in order to get paid — and then stolen from.
One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.
But the mastermind behind the task scam moved the stolen money to Ledger addresses which were then targeted by different scammers last week.
“On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses,” Chainalysis said. “On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.”
Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis.
Ledger has since said that the scam was a massive organized crime operation where a group installed implants into devices and put them back on the market. The implants could read users’ seed phrases so criminals could then drain wallets.
Calling it one the most “sophisticated attacks” the digital asset industry has experienced, Ledger is yet to reveal how much money has been lost — but blockchain investigator Specter said $86 million had been drained.
And the task scam conman, according to Chainalysis, was one of the victims.
Ledger has said that it is working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure” and has made sure no other vendors have been targeted by scammers.
CryptoBilis has stopped selling Ledger products, the company said.
Criminals have targeted bitcoin hardware sellers this year, with a huge attack taking place in July on the popular Coldcard products.
Crooks were able to steal close to $120 million in bitcoin from Coldcard users because the devices had a firmware bug which led to faulty seed generation, allowing hackers to guess investor seedphrases.
Critical Internet keys changed this week. Did you notice? The keys behind DNSSEC, the system for cryptographically validating DNS responses, rolled over on October 11 2026. This is the second time the DNSSEC keys have rotated since the system was implemented, and the first time in 2018 didn’t exactly go entirely smoothly.
DNS is what resolves a host name and turns it into an IP address. It underpins web browsing, email, and just about every other connection. It’s also a very early Internet protocol, written in both a simpler, less paranoid era, and an era where encryption was computationally expensive and legally problematic. DNS offers little protection against malicious actors spoofing responses, and the impacts range from phishing to redirecting email to just about any other manipulation of connections you can image.
DNSSEC addresses this by creating a chain of trust between DNS resolvers — the servers that forward the DNS query into the DNS infrastructure and return the results — and the global DNS servers. Part of this chain of trust is the root key that each resolver must have and trust, and this key is what changed this week. DNSSEC resolvers automatically watch for a new root of trust key, but the key must be signed by the previous root of trust, and is checked for at least 30 days before it is trusted. If someone were able to issue a bogus certificate, they would have to maintain control of the infrastructure for over a month before DNS resolvers would trust it.
The process of distributing the new key actually began more than a year ago, on January 11, 2025, to give DNSSEC resolvers time to get the new key. DNSSEC services should have had plenty of time to obtain and trust the new key, and unless DNS stopped working for you this week, they did their job.
The next major change for DNSSEC will require more profound changes to deploy a new signing algorithm that will be post-quantum secure.
Ransomware Recovery Company Didn’t Recover
BleepingComputer reports that the CEO of a company advertising services for recovering from ransomware attacks has been charged with fraud.
The company advertised that it could help with recovering from a ransomware attack by providing decryption services to unlock the ransomed files. Instead, the CEO of the company is accused of negotiating a ransom payment with the attackers and charging the victims a premium on top of the ransom.
In addition to fraudulent claims of decrypting the data without a ransom, this could fall foul of embargo laws against paying ransomware operators in some countries, or be against customer policy regarding payments.
The charges detail incidents in which the ransomware operators were paid $9,800, while the victims were charged $150,000 for “recovery”, and claim the company overall paid more than $8 million in ransom fees while charging customers $18 million.
More Refrigeration Hacks
Several weeks ago, commissaries operated by the United States military suffered a series of refrigeration failures. Units on multiple bases in multiple states and countries entered defrost mode, which activated heaters, spoiling food overnight. This week, hundreds of supermarkets in France have suffered the same issue, with units heating up and some even reportedly catching fire.
The attack started Sunday night, and not only triggers defrost mode, but seems to force the units to stay in defrost mode for a prolonged period. Losses are estimated to reach over $300,000. French prosecutors have called for investigations of the wide-spread attacks.
Clearly, a vulnerability has been found in the refrigeration controllers connected to the Internet, and fingers are being pointed at the Danfoss brand, which is also used by the US military bases. Researcher Kevin Beaumont points out that it may not even be a traditional vulnerability: Many of the units are directly connected to the Internet, with the username “admin”, and a password that changes daily. Unfortunately, the password changes to the current date. “Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily.”
OpenAI employee charged with spying
An OpenAI employee was charged with spying after being caught placing “sophisticated listening devices” in meeting rooms, hidden in toilet paper: the most sophisticated of camouflage.
Employees discovered the device approximately two days after it was placed, according to the report. Ironically, logs indicate the employee used OpenAI’s own chatbot to help design the device and identify locations for it. Photos of the device look like it a SEEED Studio ESP32 device, a dev board likely very familiar to readers.
Stop & Shop and Hannaford hacked
The US supermarket chains Stop & Shop and Hannaford, which share a common owner, seem to have been hacked. There aren’t many details available yet, but multiple news sources in multiple states are reporting that the stores have taken their websites and online ordering completely offline, however stores remain open.
The company says it does not currently believe that customer payment details were part of the compromise.
Hardware wallets are offered as the panacea every time another crypto heist or supply-chain stealer makes the rounds. The idea is simple: private keys stay on the device and never touch your daily-driver, which is surely contaminated with keyloggers and trojans. The crypto transaction is built on the host and hands it to the device, the wallet device then solves it with the private keys and returns the signature. The only user interface is typically a screen display, which is exactly where the physical supply chain hack against Ledger happened.
The implants, found mainly in Ledger Nano X devices so far, sit dormant until the owner sets up the wallet. When the device shows the new recovery seed on its screen, the implant reads each character and sends the seed out through its own LTE modem, antenna, and eSIM. The implant never touches the host computer or the users WiFi network. The secure storage inside the wallet is never compromised: the hardware implant spies directly on the LCD to read the recovery keys as displayed to the user.
Blockchain analytics firm Bitquery links about 315 drained accounts, roughly $102 million in Bitcoin, Ethereum, Tron and others, to devices sold by CryptoBilis: that’s Ledger’s authorized reseller for Malaysia, Indonesia, and the Philippines.
[Joe Grand], a hardware hacker often featured here and the force behind many DEFCON conference badges, began looking in August 2025 after a Reddit post from someone who had bought a wallet on a Thai marketplace. [Joe] bought eight more Nano X units and found implants in four of them. This was reported to Ledger in March of 2026, but according to [Grand], Ledger didn’t follow up for months.
Then in September, Mark Karpelès, the former Mt. Gox CEO, published a teardown showing how the implants have evolved. The first generation used hand-soldered wires to the screen. The second used a transparent orange flex circuit laminated onto the board, with a smaller battery to make room. The third uses a black-coated flex with the part numbers scraped off and a custom antenna. A Japan-based researcher who examined ten Nano X and two Flex devices found five distinct implant designs. They traced the eSIM traffic to an Alibaba-managed data center in Hong Kong, with at least 90 implants reporting seeds there in June alone.
Ledger’s official position is that a “limited number” of devices came from a single seller. It says there is no sign that its own systems were compromised, and it has told resellers to buy only through authorized channels and “never to restock returned products. That last line points at a likely route: buy wallets, implant them, return them, and let them go back on the shelf.
Despite the claims of a single compromised seller, a user named [Johannes] found implants in two Nano X units bought at MediaMarkt stores in Europe, and MediaMarkt is a listed authorized reseller with around a thousand stores across ten countries. There are also reports of implanted Flex devices, and Stax reports that are still unverified. Trezor has started trimming its own authorized-seller list as a “preventive step.” Attribution is still unknown.
CryptoBilis changed ownership earlier this year under an NDA that only recently expired, which has raised eyebrows. Zetter is careful to note that there’s no evidence connecting CryptoBilis to the implants or the thefts.
The takeaway is uncomfortable for anyone who has told people to “just buy a hardware wallet”. The threat model always assumed the device itself was trustworthy, and “buy direct from the vendor” was advice for being extra careful. Now it’s the minimum. Tamper-evident packaging clearly isn’t enough against someone with a lamination process and a parts budget. The options get less fun from here: open the case and inspect the board, which voids the warranty, and good luck spotting a black flex on a black PCB, generate the seed somewhere you control and import it, or use multi-signing across vendors so one bad device can’t empty everything.
Crypto forces you to be your own security, and if you have enough money for someone to design an attack that would have only been expected of a nation-state a few years ago, your home-grown security has to be really, really good.
Ledger has issued a statement following reports from customers of loss of funds and tampered devices, calling it one the most “sophisticated attacks” the digital asset industry has experienced.
The hardware manufacturer said Thursday that a “highly organized criminal group” bought Ledger devices and installed implants that could read users’ seedphrases before then putting them back into the supply chain via resellers.
Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis.
The company then said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant.
It isn’t clear how much money has been lost from the tampered devices but blockchain investigator Specter said $86 million had been drained. Ledger did not respond to Bitcoin Magazine’s written questions.
“[The criminal group] built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets,” Ledger said in a Thursday statement.
“There was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised. This was an attack on the distribution channel after the devices left our control.”
The company said that in its “largest investigation to date” it sent employees to other markets — including Europe — to make sure other supply chains hadn’t been targeted.
It said that screened devices were clean and authorized resellers and distributors in Southeast Asia and Hong Kong have suspended their sales.
Ledger added that it was working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure.”
It isn’t clear how many customers had been targeted from Ledger’s statement.
The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.
There have also been a number of data breaches this year, with scammers targeting Ledger to get customer information via the company’s payment processor Global-e.
Hardware manufacturer Trezor has said it has reduced the number of resellers it works with following supply-chain incidents related to its competitor Ledger.
The Prague, Czech Republic-based company added in a Tuesday post on X that it was in the process of checking which vendors it works with.
It added that there were no reports of any issues with Trezor devices. “Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised,” the company wrote.
“This is a preventive step, taken out of an abundance of caution.”
Signing device manufacturer Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis.
Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with.
Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised.
Ledger then said that one of the impacted users’ devices contained an unauthorized hardware implant.
More reports of what appear to be tampered devices have since surfaced on social media but Ledger said Tuesday that only devices sold through CryptoBilis have been linked to lost funds.
It added that it had only confirmed an unauthorized hardware implant in one affected user’s device. The implant, according to Ledger, was able to read a seedphrase when it appeared on the device.
Ledger did not reveal how much money had been lost but blockchain investigator Specter said $86 million had been drained from devices.
“We have not confirmed the total number of affected users or the total value lost,” Ledger added on X. “Figures circulating online come from third parties and Ledger has not fully verified them.”
Ledger did not respond to Bitcoin Magazine’s questions.
CryptoBilis has also stopped selling devices, Ledger added, and advised customers who bought from CryptoBilis to not set up their devices and contact the Ledger support team.
Criminals have been targeting hardware wallets this year. Hackers in July were able to steal close to $120 million in bitcoin from Coldcard users due to a firmware bug in the devices.
Canadian company Coinkite, which makes the popular products, said that the bug led to faulty seed generation, allowing hackers to guess investor seedphrases.
In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen.
Scammers earlier this year were able to get hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.
Ledger has said it is working with authorities after users last week reported losing funds and one received a tampered device. But the company reassured customers that the number of impacted products was “limited.”
The hardware wallet manufacturer added in an announcement on Sunday that it had reached out to affected customers.
Paris-based Ledger on Friday said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from a reseller.
Then, on Saturday, Ledger said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant.
Ledger would not confirm the amount of money lost but blockchain investigator Specter said $86 million had been drained from devices.
“As the investigation continues, we are working with relevant authorities,” Ledger wrote on Sunday.
It added: “Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.
“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.”
Customers in South East Asia last week reported losing funds after buying from Kuala Lumpur, Malaysia-based vendor CryptoBilis.
Ledger then advised customers who’d bought from CryptoBilis to not set up their devices.
CryptoBilis has since stopped selling its hardware wallets, Ledger said on Sunday.
People on social media posted picture evidence of devices implanted into Ledger products, claiming it could get users’ private keys. It isn’t clear how many of Ledger’s signing devices contained the implant.
Neither Ledger nor CryptoBilis immediately responded to questions from Bitcoin Magazine.
Hardware wallet security has been a hot topic ever since hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.
The products, made by Canadian company Coinkite, contained a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases.
In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen.
Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.
Hardware wallet manufacturer Ledger has said that it is investigating loss of user funds after customers in South East Asia reported issues with devices bought from a reseller.
The Paris-based company on Friday advised customers who’d bought from vendor CryptoBilis within the last 90 days to not set up their devices.
Ledger did not reveal how much money users had lost but one blockchain investigator, Specter, wrote on X that he’d traced theft addresses following social media posts and that over $86 million had been lost.
BREAKING: Ledger reports loss of funds from users in South East Asia who purchased products from the reseller "CryptoBillis".
The situation is ongoing and users are urged to review Ledger's official updates. pic.twitter.com/0GT3cthQtD
The issue comes following a number of data breaches this year in the crypto world and a huge hack of popular Coldcard hardware wallet devices in July.
“Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBilis,” Ledger said via its support X account.
Ledger added that it had asked CryptoBilis to pause all sales and shipments of Ledger devices.
“If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses,” the company said.
In a statement to Bitcoin Magazine, Ledger said that based on the information to date, the incident is isolated specifically to this reseller in this specific market.
“No reports were made of products purchased directly from Ledger, and Ledger’s infrastructure, systems and services were not compromised,” the company added.
CryptoBilis is a Kuala Lumpur, Malaysia-based hardware wallet vendor, according to its website. The company did not immediately respond to questions from Bitcoin Magazine.
The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.
The products, made by Canadian company Coinkite, had a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases.
Galaxy Research said in the months following the attack various attackers were able to exploit the bug independently.
In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen.
Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.
TL;DR: The XRP Ledger’s BatchV1_1 amendment remains in its activation window and is expected to enable around October 9 if validator support stays above the required threshold. The upgrade allows multiple transactions to be bundled into an atomic group, replacing an earlier Batch version that was halted after a critical bug was found.
A major XRP Ledger upgrade is approaching activation after one of the more unusual validator coordination episodes in the network’s recent history.
BatchV1_1 is currently inside the XRPL amendment process and is expected to activate around October 9 if support remains above the required supermajority threshold.
The feature allows multiple transactions to be bundled together so they either succeed as a group or fail as a group.
That opens the door to more complex operations such as atomic swaps and workflows where several ledger actions need to complete together.
The route to activation has not been smooth.
An earlier version of Batch was prevented from activating after a critical issue was discovered.
Validators then coordinated around a corrected version, with support temporarily adjusted so the activation countdown could reset and the Batch amendment could arrive alongside its associated fix.
XRPL amendments require more than 80% support from trusted validators for two consecutive weeks before they can become active.
If support falls below that threshold, the clock resets.
That mechanism is deliberately conservative.
An amendment changes the rules understood by the network. Once it activates, servers that do not support the new rules can become amendment blocked and stop following the ledger correctly.
The corrected BatchV1_1 feature is therefore being paired with newer software designed to address the earlier problem.
The upgrade matters because atomic transaction groups are a basic building block for more sophisticated financial applications.
Without them, a developer may need to coordinate several separate ledger operations and deal with the possibility that one succeeds while another fails.
Batching lets the application treat those actions as one logical unit.
That can be useful for trading, tokenization and other workflows where partial execution would create risk.
The XRP Ledger has increasingly been adding features aimed at institutional assets and more complex on-chain finance.
Batch transactions fit into that broader direction, alongside work on multi-purpose tokens, permission controls and other features designed to support financial applications beyond basic XRP transfers.
The current countdown is not an absolute guarantee.
Validator support has to remain above the required level until the activation process completes.
But the network is much closer to enabling Batch than it was when the first version ran into trouble.
In some ways, the delay may be the more reassuring part of the story.
A decentralized network found a serious issue before activation, validators coordinated to stop the change, and the amendment process was reset around a fix.
Now the feature gets another attempt.
This time, the XRP Ledger is trying to make sure the batch arrives as a complete package rather than simply arriving on time.
Login
Hackaday
Bitcoin Magazine
