Ledger Attack Spreads to EU, AI Finds ’18 Trillion XRP’ Bug: Hodler’s Digest

Ledger implant exploit reportedly spreads to Europe after $93.4 million in losses from Asian reseller

A tampered Ledger attack that has already seen an estimated $93.4 million taken from Asian hardware wallet users, has reportedly spread to Europe.

X user Johannes has presented photographs of a tampered Ledger he said he purchased two weeks ago from the European consumer electronics chain MediaMarkt. The implant inside appears to be an earlier version of the one found linked to CryptoBilis shipped devices in Asia, and no funds have been taken.

“Either the device didn’t work, or they were waiting for a more widespread usage of the compromised devices,” he said. Former Mt Gox CEO Mark Karpeles, whose investigations into the tampered Asian Ledgers helped bring the problem to light, said the antenna in the device says it is the “Eurasian version” suggesting separate versions of the implant have been sent to regions that use different mobile frequencies. Ledger has not confirmed the reported European device is part of the same attack.

“PSA the ledger incident isn’t limited to Asia,” wrote European X user Johannes. Source: Johannes.

The sophisticated attack hit Ledger devices in Asia late last week, after devices from the official reseller CryptoBilis — which had recently been sold to a new owner — were found to be modified in a way that apparently enable attackers to read the seed phrase and steal funds even as though the device is still able to pass authenticity checks.

Ledger has asked CryptoBilis to suspend sales and shipments of its devices as a precaution and advised customers who had purchased devices from the reseller within the past 90 days to consider transferring their assets to a new Ledger. “The volume of impacted devices is limited,” it said in its most recent update today.

CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Cybersecurity outlet Yfarmx estimated the losses at $93.4 million across 471 addresses, but this figure has not been confirmed by Ledger.

Security firm uncovers XRP minting bug

Security firm Veria Labs has been paid a $250,000 bug bounty for uncovering an overflow bug hidden in XRP’s code since 2015. It claims that a single transaction could have printed trillions of XRP out of thin air.  

The bug has been patched and there is no evidence it had ever been exploited.

Cayden Liao, Veria Labs security co-founder, wrote on X that its AI agent had combed through rippled, the software that runs the XRP Ledger and found two low severity bugs. It worked out how to create a much larger exploit by using them in conjunction. Liao said that just one exploit transaction could have created more than 18 trillion XRP, which is 184 times greater than the total supply.

“This puts the full $94B at risk, more than 60 times the largest crypto hack on record,” he wrote, referring to XRP’s entire market cap. “We suspect one reason nobody caught this vulnerability is that it chains together two bugs that would be low severity on their own.”  The bugs were reported on September 22 and RippleX patched them three days later.

Source: Cayden Liao

Vitalik Buterin backs crypto ‘bunker mode’ amid rapid AI math advances

Ethereum co-founder Vitalik Buterin has backed researcher Justin Drake’s warning that advances in artificial intelligence could undermine the cryptography used in today’s blockchains before quantum computers do. 

“I don’t recommend anyone scramble to move their funds to new wallets today,” Buterin wrote. “But we should take the risks to cryptography from AI-accelerated math seriously.”

Drake urged the industry to prepare for “bunker mode” in light of OpenAI releasing hundreds of new mathematical findings that humans have been unable to solve. None of the findings related to cryptography, but the potential for AI agents to uncover new insights into the mathematical structure behind elliptic curve cryptography or lattice based cryptography has the core Ethereum team worried.

The concerns have been criticized by other projects and analysts as fear mongering, with critics saying there is no evidence AI agents are anywhere near breaking cryptography. But then again, there wasn’t a lot of evidence a new AI model was about to one shot the solution to hundreds of other unsolvable problems either.

Samsung Wallet to add USDC transfers for US Galaxy users in October

Samsung plans to introduce USDC transfers to the Samsung Wallet payment app for 82 million eligible US Galaxy users in the last week of October.

The feature will let users send USDC to compatible crypto wallets internationally and transfer money to eligible bank accounts in more than 60 countries, where recipients can receive funds in their local currency. Users must complete identity verification to access the service.

Bastion will provide stablecoin account and payment infrastructure, with Coinbase serving as a sub-custodian through Coinbase Prime Vault. Solana and Sui were named as technical partners.

Crypto’s heavy backing of Republicans alienated Democrats: Cuomo

The crypto industry’s heavy backing of US Republicans has alienated Democrats whose support is needed to pass federal crypto legislation, says former New York Governor Andrew Cuomo.

Kalshi prediction markets put the probability of Democrats winning both chambers of Congress at about 61%. Cuomo said a Democratic-controlled Congress could either seek to roll back the SEC and CFTC’s crypto initiatives, or it could work with the Trump administration to pass the full CLARITY Act. 

“You need Democrats to pass the bill. You need Republicans. You have to be more balanced,” he said.

While he conceded there is a perception that Democrats are “anti-crypto” he says the technology fits in well with the party’s goals and beliefs.

“It’s empowering people who otherwise wouldn’t have access to financial products, and the Democratic Party has been working to do that all its life,” he said.

Winners and Losers

At the end of the week, Bitcoin (BTC) is down 2.8% to trade at $83,435, Ethereum (ETH) is down 6.5% to trade at $2,562 and XRP (XRP) is down 7% to $1.40. The total market cap is at $2.82 trillion according to CoinMarketCap.

Among the biggest 100 cryptocurrencies, the top three altcoin winners of the week are StarkNet (STRK) with a 91% gain (after announcing it would become a post-quantum L1), Binance Life (币安人生) on 25.4%, and Celestia (TIA) on 20.8%.

The top three altcoin losers of the week are Venice Token (VVV) which was down 18.5%, Sky (SKY) down 16.2% and Uniswap (UNI) down 15.4%.

Prediction of the Week

Ethereum will hit $25,000 to $50,000 this cycle says Tom Lee

Bitmine chair Tom Lee told Token2049 on Friday that ETH will top $5000 by the end of the year and by the end of the cycle Ethereum “could easily be 25,000 or 50,000 per token,” he said.

Lee also revealed Bitmine is nearing its 5% target after accumulating roughly 6 million Ether. The firm will only need to buy about 100,000 ETH more to reach that percentage.

“That’s a hard cap. We’re not gonna be accumulating past 5%,” Lee said. “We’re not gonna own more than 5% of Ethereum.”

Top FUD of the Week

Coldcard says it’s investigating how phishing link appeared on its X account  

Bitcoin-only hardware wallet Coldcard said an unauthorized phishing link appeared Sunday on its official X account, despite the company using offline two-factor authentication.

The post has since been deleted, and the firm said the only official website is https://coldcard.com. 

DefiLlama’s hack tracker estimated losses tied to July’s Coldcard exploit at $115 million.

THORChain dev accuses Tether of temporarily freezing USDT vaults

THORChain technical co-founder Chad Barraford accused stablecoin issuer Tether of blacklisting the network’s USDt (USDT) vaults without explanation, then unfreezing them hours later. 

In a Friday X post, Barraford said that Tether had blacklisted THORChain vault addresses, freezing about a combined 1.45 million USDT in the network’s funds across four wallets. He reported about two hours later than trading would resume after Tether unfroze all the addresses.

New York permanently bars Celsius founder Mashinsky in $35M fraud settlement

Former Celsius CEO Alex Mashinsky has been permanently barred from the cryptocurrency, securities and commodities industries under a settlement with New York Attorney General Letitia James that includes up to $35 million in conditional payments.

The New York agreement, announced Friday, settles a 2023 civil lawsuit accusing Mashinsky of misleading hundreds of thousands of investors about the safety of Celsius before its collapse in 2022.

Mashinsky is serving a 12-year federal prison sentence for fraud and was separately ordered to forfeit more than $48 million.

Top Magazine Features of the Week

French authorities recorded 90 crypto-related cases involving kidnapping, extortion, threats and violent theft in seven months. What makes France such a hotspot?

Crypto lending has risen by 55% since July, but now has to deal with the dangers of AI assisted hacks, and risks cascading through interlinked protocols. Here’s how to stay safe.

Real Vision founder Raoul Pal says a pause in the AI stock rally could help crypto attract capital, while AI agents are likely to boost Ethereum and Solana adoption.