Ledger Tampering Scheme Expands Into European Retail
The sophisticated hardware-wallet tampering operation that has already siphoned an estimated $93.4 million from users in Asia has now reportedly reached European soil. An X user going by the name Johannes shared photographs of a modified Ledger device he purchased roughly two weeks earlier from MediaMarkt, a well-known consumer electronics retailer operating across the continent. The embedded implant visible in the device appears to be an earlier iteration of the same hardware found in tampered units distributed through CryptoBilis in Asia, and no digital assets have been drained from the European unit so far.
Johannes suggested two possible explanations for the inactivity: either the implant simply failed to function, or the attackers were deliberately waiting for the compromised devices to see broader adoption before executing the theft. Mark Karpeles, the former CEO of the collapsed Mt Gox exchange, whose own investigation into the Asian tampered Ledgers first drew public attention to the scheme, noted that the antenna component inside the device is labeled as a "Eurasian version." This detail implies the attackers have been deploying region-specific implant variants calibrated to the mobile frequencies available in different markets. Ledger itself has not confirmed whether the MediaMarkt unit is connected to the same campaign.
The original wave of compromised devices surfaced in late last week in Asian markets. Units sourced from CryptoBilis — an authorized Ledger reseller in Indonesia, Malaysia, and the Philippines that had recently changed ownership — were discovered to carry hidden modifications allowing an attacker to extract the device seed phrase and transfer funds, all while the wallet continued to pass standard authenticity verification. Ledger has instructed CryptoBilis to halt all sales and shipments as a precautionary measure and has urged customers who bought devices from that reseller during the previous 90 days to migrate their holdings to a fresh Ledger unit. In its latest advisory, the company stressed that the number of affected devices remains limited. Cybersecurity outlet Yfarmx pegged the total losses at $93.4 million spread across 471 wallet addresses, a figure Ledger has not independently verified.
AI Agent Uncovers $94 Billion XRP Overflow Bug for a $250,000 Bounty
In a separate security development, Veria Labs disclosed that its artificial-intelligence agent identified an integer overflow vulnerability lurking in the XRP codebase since 2015. The flaw, hidden within rippled — the software powering the XRP Ledger — could have allowed a single crafted transaction to mint more than 18 trillion XRP out of thin air, a quantity 184 times the protocol's total supply. At current valuations, that would expose the entire $94 billion market capitalization to theft, a figure the firm described as more than 60 times larger than the single biggest crypto heist on record.
Cayden Liao, Veria Labs' security co-founder, explained on X that the AI agent initially flagged two low-severity bugs individually. The breakthrough came when the system chained the two together to produce a far more destructive exploit. Liao speculated that the reason the vulnerability went undetected for nearly a decade was precisely this compounding effect: neither bug looked alarming in isolation. The findings were reported to RippleX on September 22, and a patch was deployed three days later. Despite the severity of the exposure, Veria Labs received a bounty of $250,000.
AI and Cryptography: Growing Unease in the Blockchain Community
Ethereum co-founder Vitalik Buterin publicly endorsed researcher Justin Drake's caution that rapid advances in AI may erode the cryptographic foundations underpinning modern blockchains before quantum computers arrive. Buterin urged the community to take AI-accelerated mathematical research seriously while explicitly advising holders not to panic-move their funds into new wallets at this stage.
Drake's call for the industry to enter what he termed "bunker mode" followed OpenAI's release of hundreds of new mathematical results that had previously eluded human solvers. None of those findings touched cryptography directly, but the possibility that AI agents could eventually probe the mathematical structures behind elliptic-curve or lattice-based systems has raised genuine concern within the core Ethereum team. Critics from other projects and independent analysts have dismissed the alarm as fear-mongering, pointing out that no AI system has come close to breaking established cryptography. Drake's supporters counter that the same skepticism existed before a new AI model appeared to solve hundreds of long-unsolved problems in a single pass.
Weekly Market Snapshot and Notable Industry Moves
By the close of the trading week, Bitcoin had slipped 2.8 percent to $83,435, Ethereum was down 6.5 percent at $2,562, and XRP fell 7 percent to $1.40. The aggregate cryptocurrency market capitalization stood at $2.82 trillion per CoinMarketCap data. Among the top 100 coins by market value, StarkNet (STRK) led the gains with a 91 percent surge after announcing its transition to a post-quantum Layer 1, followed by Binance Life (25.4 percent) and Celestia (TIA) at 20.8 percent. The steepest declines belonged to Venice Token (VVV) at minus 18.5 percent, Sky (SKY) at minus 16.2 percent, and Uniswap (UNI) at minus 15.4 percent.
In corporate news, Samsung confirmed it will open USDC transfer functionality inside its Samsung Wallet app to 82 million eligible Galaxy users in the United States during the final week of October. The feature supports international USDC sends to compatible wallets and cross-border transfers to bank accounts in more than 60 countries, with recipients receiving local currency. Identity verification is required, Bastion will supply the stablecoin account and payment rails, Coinbase will act as sub-custodian via Coinbase Prime Vault, and Solana and Sui are credited as technical partners.
Bitmine chairman Tom Lee told the Token2049 audience on Friday that he expects Ethereum to clear $5,000 before year-end and that the token "could easily be 25,000 or 50,000" by the end of the current cycle. He also disclosed that Bitmine has accumulated roughly 6 million ETH and needs only about 100,000 more to hit its self-imposed 5 percent cap, a threshold he described as a hard limit the firm will not exceed.
Additional developments include former Celsius CEO Alex Mashinsky being permanently barred from the crypto, securities, and commodities industries under a settlement with New York Attorney General Letitia James, which carries up to $35 million in conditional payments. The agreement resolves a 2023 civil suit alleging Mashinsky misled hundreds of thousands of investors about Celsius's solvency before its 2022 collapse; he is already serving a 12-year federal sentence for fraud and was separately ordered to forfeit over $48 million. Meanwhile, Coldcard, the Bitcoin-only hardware wallet maker, reported that an unauthorized phishing link briefly appeared on its official X account on Sunday despite the use of offline two-factor authentication; the post was removed, and the company reiterated that coldcard.com is its sole legitimate web address. DefiLlama's tracker had previously estimated $115 million in losses tied to a July Coldcard exploit.
THORChain technical co-founder Chad Barraford accused Tether of blacklisting the network's USDT vault addresses without prior notice, freezing a combined 1.45 million USDT across four wallets before unfreezing them roughly two hours later. In France, authorities logged 90 crypto-related criminal cases — spanning kidnapping, extortion, threats, and violent theft — over a seven-month period. Separately, former New York Governor Andrew Cuomo argued that the crypto industry's heavy financial support of US Republicans has alienated the Democrats whose votes are essential to passing federal crypto legislation, noting that Kalshi prediction markets put the odds of a Democratic sweep of both chambers at roughly 61 percent.
