TLDR

• XRP Ledger developers have proposed four fixes to close gaps in issuer approval requirements for restricted tokens.
• The changes would strengthen checks on trading pool shares and token transfers, preventing unapproved accounts from acquiring restricted assets through exceptions.
• Holders without approval would generally only be able to return affected tokens to the issuer, unless the issuer authorizes their account.
• The proposals are not live on mainnet. The XRP Ledger Foundation described the work as routine protocol hardening and reported no known outsider exploitation of the remaining exceptions.

XRP Ledger Developers Target Token Approval Gaps

XRP Ledger developers are proposing tighter controls over who can receive and hold tokens that require issuer authorization.

The four proposed fixes are grouped under an amendment called fixCleanup3_5_0. They aim to make existing approval requirements apply consistently across different ways tokens move through the network.

Issuers of assets such as regulated stablecoins or tokenized funds can require approval before an account holds their tokens. This allows an issuer to conduct identity checks or apply other eligibility requirements.

That authorization is recorded on a trust line, the connection an account establishes to hold another party’s issued token.

The proposed changes address exceptions in how those requirements are enforced. They concern restricted issued tokens, rather than introducing an issuer-approval requirement for holding native XRP.

Trading Pool Shares Face Stronger Checks

One proposed fix would require an account to have the necessary authorization for both assets in an automated market maker pool before acquiring its liquidity provider token.

These pool shares, often called LP tokens, represent a claim on the assets held inside the pool.

Developers identified a gap between depositing directly into a pool and receiving its LP tokens through another route. Although deposits already required the relevant authorizations, transfers of pool shares could allow an unapproved account to gain exposure to restricted assets.

The proposal extends checks across those acquisition routes, including payments, trading offers and NFT offers involving LP tokens.

The aim is to ensure that receiving a pool share cannot bypass the approval requirements attached to its underlying assets.

Existing Balances Would No Longer Bypass Authorization

A second proposal addresses an exception involving trust lines that already carry a token balance.

Under the behavior developers identified, an authorization check in the payment engine applied when a trust line’s balance was zero. A line that already held tokens could continue receiving more despite lacking approval.

The fix would prevent unauthorized trust lines from receiving additional restricted tokens through that route.

The broader package also seeks to keep authorization rules consistent across existing and future XRP Ledger features.

For an account already holding restricted tokens without approval, the proposed rules would generally allow those tokens to be returned to their issuer. The issuer could subsequently approve the holder’s trust line and restore normal use.

Foundation Says Work Is Unrelated to a Security Incident

The XRP Ledger Foundation described the proposals as routine improvements to protocol safeguards.

Speaking to CoinDesk, Hussein “Vet” Zangana, the foundation’s director of community and product, said the discussion concerned the guarantees the protocol should provide, rather than a report of affected users.

According to Zangana, known unauthorized balances originated from payments by issuers themselves or accounts those issuers had previously approved. The foundation said it knew of no balance created by an outside party exploiting the remaining exceptions.

Developers have also examined earlier routes involving NFT trades, including an issue addressed in August 2025.

XRP Ledger Changes Still Require Validator Support

As of the October 30 report, the four fixes had not been merged into the network’s main software or activated on mainnet.

Software inclusion would be only one step toward implementation. The amendment would also need sustained support from the network’s trusted validators for two consecutive weeks before activation.

Validator approval is also central to other network changes, including the separately proposed XRP Ledger Batch upgrade.

If adopted, the restricted-token fixes would give issuers more consistent enforcement of their existing approval requirements. For holders, the practical distinction would be whether their account has the issuer’s authorization.

Follow Bitcoinist’s latest Ripple news for further coverage of XRP and developments across the ecosystem.

Arkham reports that the CryptoBilis Ledger drainer stole USD 95.35 million from 1,486 addresses, with USD 13.84 million moved in the past 48 hours.

The XRP Ledger Foundation has added Flare to its recommended validator list and removed Anodos Finance at its own request, with the foundation and Ripple now publishing matching sets of 35 validator keys. XRP Ledger Foundation said in its announcement…

Zcash has introduced Zillions, an Anoma-powered browser wallet whose launch features include transparent and shielded transfers, multiple-account management, and Ledger hardware-wallet support. Zcash’s official account promoted the new wallet on Oct. 27, inviting users to explore its features and share…

Ripple’s Swell conference is scheduled for October 27–29 in New York, combining its institutional event with the Apex developer gathering. Ahead of the opening, the useful question is which announcements will connect a commercial promise to a working product and a clear implementation path.

TL;DR

• The official schedule places Swell in New York on October 27–29.
• The combined event brings financial and developer audiences together.
• A partnership, a pilot and a live service provide different levels of evidence.

The combined programme puts implementation beside the pitch

The official event site lists payments, tokenization, stablecoins, settlement, privacy and XRP utility among its themes. It describes this as the first unified Swell-and-Apex event. This is a preview of the scheduled programme, not a report that any forthcoming product has launched.

Bringing the two audiences together can make some questions harder to avoid. A financial institution may want to know who holds customer assets and how disputes are resolved. A developer may want to know which transaction types, interfaces and network features are actually available.

A credible announcement needs both sets of answers. A demonstration can establish that a workflow is technically possible without proving that customers are using it at scale. A commercial agreement can establish intent without showing that integration has finished.

The distinction is relevant to Ripple Prime’s institutional clearing work. The financial relationship and the technical settlement process deserve to be understood on their own terms.

It also applies to tokenized deposits and stablecoin conversion. Similar-looking balances can represent different claims, even when an interface moves smoothly between them.

Network activation is a separate milestone from a stage announcement

For features that alter XRP Ledger transaction processing, the amendment process matters. The documentation describes validator voting and a sustained support threshold before an amendment becomes active. Including code in software does not itself mean that the network has enabled the feature.

That gives readers a practical way to assess a conference claim. Is a feature an idea, a specification, released software, an amendment awaiting approval or something already usable on the intended network? Each stage can represent progress, but they are different stages.

The same care is needed with tokenization figures. The activity examined in NewsBTC’s tokenized-equity coverage concerns assets and their uses. A newly announced distribution partnership would not immediately establish comparable balances or transaction volume.

Nor does business expansion automatically translate into demand for one particular token. Payment principal, collateral, transaction fees and reserves can be denominated in different assets. The mechanics of the announced service determine the connection.

When Swell begins, the strongest evidence will be named counterparties, specific customer availability, published terms and verifiable network milestones. The combined format creates a useful opportunity to connect those details. Until then, anticipated announcements remain anticipated.

Written by the News Desk and edited by Samuel Rae.

An XRP Ledger maintenance amendment is running on a new activation clock after losing the validator majority behind its earlier countdown. The fixCleanup3_4_0 amendment regained majority support on October 21, moving its earliest possible activation window to November 4, subject to that support continuing.

TL;DR: The amendment regained validator majority on October 21 after its first countdown failed. A fresh two-week window points to November 4 at the earliest, if support holds.

At the XRPL Dashboard’s October 24, 07:09 UTC snapshot, 32 of 35 trusted validators supported the amendment, or 91.43%. The tracker showed a new majority timestamp of October 21 at 14:46:22 UTC. Those figures are a dated observation; validators can change their positions.

XRPL Win’s amendment history separately records the earlier attempt beginning October 9 and losing majority on October 21. The interrupted run lasted more than 12 days. It did not satisfy the uninterrupted period required for activation, so the earlier October 23 expectation no longer applies.

The Clock Requires Continuous Support

The ledger’s official amendment documentation requires support from more than 80% of trusted validators for two weeks. If support falls below the requirement, the waiting period starts again when the amendment regains majority.

Network processing also means the end of the two-week period should not be treated as an exact appointment. Amendment decisions are handled through designated ledger checkpoints. November 4 is therefore a conditional earliest window, rather than a guaranteed switch at precisely 14:46 UTC.

This is a consensus process among validators on the blockchain. Holding XRP does not itself constitute an amendment vote. The visible count matters because it shows whether the required network support is being maintained throughout the waiting period.

A Collection Of Technical Fixes

The official amendment description groups fixes affecting vaults, lending, automated market makers, permissioned exchange functions, trust lines, NFTs and other ledger features. Examples include more precise vault rounding and changes to when a loan can be treated as in default.

Another change concerns delegated payment permissions. The documentation says an account with a delegated PaymentBurn permission should also need PaymentMint permission to cross a zero balance into minting. That concerns issued tokens and multi-purpose tokens, which can represent tokenized assets; it should not be described as permission to mint native XRP.

The package also separates signing prefixes used for sponsor and counterparty signatures. These are changes to the handling of transactions and permissions, rather than evidence that a new lending service has launched.

Separate lending amendments still have their own voting status. Users tracking the wider DeFi roadmap should therefore distinguish the cleanup package from activation of those features. The next decisive development for this amendment will be sustained majority through the full window, followed by the ledger recording it as enabled.

Written by the News Desk and edited by Samuel Rae.

A hardware wallet’s strongest cryptography offers little protection when an attacker can interfere with the device before its owner even switches it on. That is the uncomfortable lesson from the CryptoBilis case now facing Ledger customers in Southeast Asia.

TL;DR: Investigators have linked roughly $90 million or more in reported crypto losses to tampered wallet devices sold through a reseller channel. Ledger says its own systems were not compromised and has warned affected customers to move to newly generated recovery phrases.

The incident involves physical modifications rather than an ordinary phishing message. Reports describe implants that could capture a recovery phrase during device setup and transmit information to attackers. Once someone else possesses that phrase, they may be able to recreate the wallet without needing physical access to the device.

Ledger said confirmed cases involved wallets sold through CryptoBilis, a reseller listed in parts of Southeast Asia. It asked the reseller to stop sales and shipments while investigations continued. Customers who received affected devices were advised not to initialize them, and those already in use were told to secure funds with new credentials using trusted equipment.

The precise loss figure is still an estimate, and investigators have not publicly established a complete count of affected units. A device successfully passing an ordinary software or chip authenticity check should not automatically be interpreted as proof that no unauthorized physical component has been added elsewhere.

This attack is especially troubling because hardware wallets are bought to reduce dependence on third parties. Here, the supply chain itself became the point of exposure. For anyone buying a security device, provenance and physical integrity now deserve attention alongside firmware version and backup discipline.

Written by the News Desk and edited by Samuel Rae.

Bitcoin Magazine

Poetic Justice: Scammer Lost $5M in Bitcoin After Being Targeted by Ledger Thieves

Call it poetic justice: one of the biggest victims of last week’s Ledger theft happened to be a scammer themself, according to blockchain analysts, and lost nearly $5 million in bitcoin. 

In a post Thursday, Chainalysis wrote that a crook lost 60 bitcoins worth about $4.8 million they’d stolen via a so-called task scam. 

According to Chainalysis, the address was linked with a con where people were paid to fake sales and reviews of real items. They were told to add their own money in order to get paid — and then stolen from. 

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.

In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told… https://t.co/IJX4tx9ib3 pic.twitter.com/pGXNJkZJUi

— Chainalysis (@chainalysis) October 15, 2026

But the mastermind behind the task scam moved the stolen money to Ledger addresses which were then targeted by different scammers last week.

“On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses,” Chainalysis said. “On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.”

Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis. 

Ledger has since said that the scam was a massive organized crime operation where a group installed implants into devices and put them back on the market. The implants could read users’ seed phrases so criminals could then drain wallets. 

Calling it one the most “sophisticated attacks” the digital asset industry has experienced, Ledger is yet to reveal how much money has been lost — but blockchain investigator Specter said $86 million had been drained. 

And the task scam conman, according to Chainalysis, was one of the victims.

Ledger has said that it is working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure” and has made sure no other vendors have been targeted by scammers. 

CryptoBilis has stopped selling Ledger products, the company said. 

Criminals have targeted bitcoin hardware sellers this year, with a huge attack taking place in July on the popular Coldcard products. 

Crooks were able to steal close to $120 million in bitcoin from Coldcard users because the devices had a firmware bug which led to faulty seed generation, allowing hackers to guess investor seedphrases. 

This post Poetic Justice: Scammer Lost $5M in Bitcoin After Being Targeted by Ledger Thieves first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users

Ledger has issued a statement following reports from customers of loss of funds and tampered devices, calling it one the most “sophisticated attacks” the digital asset industry has experienced. 

The hardware manufacturer said Thursday that a “highly organized criminal group” bought Ledger devices and installed implants that could read users’ seedphrases before then putting them back into the supply chain via resellers. 

Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis. 

The company then said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant. 

It isn’t clear how much money has been lost from the tampered devices but blockchain investigator Specter said $86 million had been drained. Ledger did not respond to Bitcoin Magazine’s written questions. 

“[The criminal group] built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets,” Ledger said in a Thursday statement. 

“There was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised. This was an attack on the distribution channel after the devices left our control.”

The company said that in its “largest investigation to date” it sent employees to other markets — including Europe — to make sure other supply chains hadn’t been targeted. 

It said that screened devices were clean and authorized resellers and distributors in Southeast Asia and Hong Kong have suspended their sales. 

Ledger added that it was working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure.”

It isn’t clear how many customers had been targeted from Ledger’s statement. 

The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.  

There have also been a number of data breaches this year, with scammers targeting Ledger to get customer information via the company’s payment processor Global-e.

This post Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Trezor Reduces Number of Resellers Following Ledger Drainage Incident 

Hardware manufacturer Trezor has said it has reduced the number of resellers it works with following supply-chain incidents related to its competitor Ledger. 

The Prague, Czech Republic-based company added in a Tuesday post on X that it was in the process of checking which vendors it works with. 

It added that there were no reports of any issues with Trezor devices. “Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised,” the company wrote. 

“This is a preventive step, taken out of an abundance of caution.”

Signing device manufacturer Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis. 

Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with.

Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised.

This is a preventive step, taken… https://t.co/pKF4tCHo5c

— Trezor (@Trezor) October 13, 2026

Ledger then said that one of the impacted users’ devices contained an unauthorized hardware implant. 

More reports of what appear to be tampered devices have since surfaced on social media but Ledger said Tuesday that only devices sold through CryptoBilis have been linked to lost funds. 

It added that it had only confirmed an unauthorized hardware implant in one affected user’s device. The implant, according to Ledger, was able to read a seedphrase when it appeared on the device. 

Ledger did not reveal how much money had been lost but blockchain investigator Specter said $86 million had been drained from devices. 

“We have not confirmed the total number of affected users or the total value lost,” Ledger added on X. “Figures circulating online come from third parties and Ledger has not fully verified them.”

Ledger did not respond to Bitcoin Magazine’s questions. 

CryptoBilis has also stopped selling devices, Ledger added, and advised customers who bought from CryptoBilis to not set up their devices and contact the Ledger support team. 

Criminals have been targeting hardware wallets this year. Hackers in July were able to steal close to $120 million in bitcoin from Coldcard users due to a firmware bug in the devices. 

Canadian company Coinkite, which makes the popular products, said that the bug led to faulty seed generation, allowing hackers to guess investor seedphrases. 

In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen. 

Scammers earlier this year were able to get hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.  

This post Trezor Reduces Number of Resellers Following Ledger Drainage Incident  first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device

Ledger has said it is working with authorities after users last week reported losing funds and one received a tampered device. But the company reassured customers that the number of impacted products was “limited.” 

The hardware wallet manufacturer added in an announcement on Sunday that it had reached out to affected customers. 

Paris-based Ledger on Friday said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from a reseller. 

Then, on Saturday, Ledger said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant. 

Ledger would not confirm the amount of money lost but blockchain investigator Specter said $86 million had been drained from devices. 

“As the investigation continues, we are working with relevant authorities,” Ledger wrote on Sunday. 

It added: “Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.

“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.”

Customers in South East Asia last week reported losing funds after buying from Kuala Lumpur, Malaysia-based vendor CryptoBilis. 

Ledger then advised customers who’d bought from CryptoBilis to not set up their devices. 

CryptoBilis has since stopped selling its hardware wallets, Ledger said on Sunday. 

People on social media posted picture evidence of devices implanted into Ledger products, claiming it could get users’ private keys. It isn’t clear how many of Ledger’s signing devices contained the implant. 

Neither Ledger nor CryptoBilis immediately responded to questions from Bitcoin Magazine. 

Hardware wallet security has been a hot topic ever since hackers in July were able to steal close to $120 million in bitcoin from Coldcard users. 

The products, made by Canadian company Coinkite, contained a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases. 

In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen. 

Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails. 

This post Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Ledger Warns Buyers Not to Set Up Wallets From Reseller After Users Report Losses

Hardware wallet manufacturer Ledger has said that it is investigating loss of user funds after customers in South East Asia reported issues with devices bought from a reseller. 

The Paris-based company on Friday advised customers who’d bought from vendor CryptoBilis within the last 90 days to not set up their devices. 

Ledger did not reveal how much money users had lost but one blockchain investigator, Specter, wrote on X that he’d traced theft addresses following social media posts and that over $86 million had been lost. 

BREAKING: Ledger reports loss of funds from users in South East Asia who purchased products from the reseller "CryptoBillis".

The situation is ongoing and users are urged to review Ledger's official updates. pic.twitter.com/0GT3cthQtD

— Bitcoin Magazine (@BitcoinMagazine) October 9, 2026

The issue comes following a number of data breaches this year in the crypto world and a huge hack of popular Coldcard hardware wallet devices in July. 

“Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBilis,” Ledger said via its support X account. 

Ledger added that it had asked CryptoBilis to pause all sales and shipments of Ledger devices.

“If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses,” the company said. 

In a statement to Bitcoin Magazine, Ledger said that based on the information to date, the incident is isolated specifically to this reseller in this specific market. 

“No reports were made of products purchased directly from Ledger, and Ledger’s infrastructure, systems and services were not compromised,” the company added. 

CryptoBilis is a Kuala Lumpur, Malaysia-based hardware wallet vendor, according to its website. The company did not immediately respond to questions from Bitcoin Magazine. 

The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users. 

The products, made by Canadian company Coinkite, had a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases. 

Galaxy Research said in the months following the attack various attackers were able to exploit the bug independently. 

In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen. 

Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails. 

This post Ledger Warns Buyers Not to Set Up Wallets From Reseller After Users Report Losses first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

TL;DR: The XRP Ledger’s BatchV1_1 amendment remains in its activation window and is expected to enable around October 9 if validator support stays above the required threshold. The upgrade allows multiple transactions to be bundled into an atomic group, replacing an earlier Batch version that was halted after a critical bug was found.

A major XRP Ledger upgrade is approaching activation after one of the more unusual validator coordination episodes in the network’s recent history.

BatchV1_1 is currently inside the XRPL amendment process and is expected to activate around October 9 if support remains above the required supermajority threshold.

The feature allows multiple transactions to be bundled together so they either succeed as a group or fail as a group.

That opens the door to more complex operations such as atomic swaps and workflows where several ledger actions need to complete together.

The route to activation has not been smooth.

An earlier version of Batch was prevented from activating after a critical issue was discovered.

Validators then coordinated around a corrected version, with support temporarily adjusted so the activation countdown could reset and the Batch amendment could arrive alongside its associated fix.

XRPL amendments require more than 80% support from trusted validators for two consecutive weeks before they can become active.

If support falls below that threshold, the clock resets.

That mechanism is deliberately conservative.

An amendment changes the rules understood by the network. Once it activates, servers that do not support the new rules can become amendment blocked and stop following the ledger correctly.

The corrected BatchV1_1 feature is therefore being paired with newer software designed to address the earlier problem.

The upgrade matters because atomic transaction groups are a basic building block for more sophisticated financial applications.

Without them, a developer may need to coordinate several separate ledger operations and deal with the possibility that one succeeds while another fails.

Batching lets the application treat those actions as one logical unit.

That can be useful for trading, tokenization and other workflows where partial execution would create risk.

The XRP Ledger has increasingly been adding features aimed at institutional assets and more complex on-chain finance.

Batch transactions fit into that broader direction, alongside work on multi-purpose tokens, permission controls and other features designed to support financial applications beyond basic XRP transfers.

The current countdown is not an absolute guarantee.

Validator support has to remain above the required level until the activation process completes.

But the network is much closer to enabling Batch than it was when the first version ran into trouble.

In some ways, the delay may be the more reassuring part of the story.

A decentralized network found a serious issue before activation, validators coordinated to stop the change, and the amendment process was reset around a fix.

Now the feature gets another attempt.

This time, the XRP Ledger is trying to make sure the batch arrives as a complete package rather than simply arriving on time.