As investigators examine signs of tampered Ledger hardware in Europe, developers have also disclosed a vulnerability in XRP Ledger code that could theoretically have created more than 18 trillion XRP. The two incidents involve separate layers of digital-asset infrastructure—hardware supply chains and blockchain software—and neither has been shown to have spread widely or been exploited. They have nevertheless renewed scrutiny of custody controls and protocol code reviews.
Suspected tampered Ledger device reported at MediaMarkt
X user Johannes said he bought a Ledger device from European consumer-electronics retailer MediaMarkt two weeks ago and found what appeared to be an implanted component inside. He posted photographs of the device, which appears to be an older model and resembles an implant found in devices distributed through Asia by CryptoBilis. There is currently no evidence that the European device has caused any loss of funds.
Johannes said the device may simply be “non-functional,” or it may indicate that an attacker is waiting for more modified devices to enter use. Mark Karpeles, the former chief executive of Mt. Gox, has been involved in examining the earlier Asian Ledger-device incident. He said markings on the antenna in the device suggest it was an “Eurasian version,” potentially indicating that attackers prepared different implants for regions using different mobile-network bands. Ledger has not confirmed that the European device is connected to the earlier case.
Some Ledger devices used by customers in Asia were previously found to have been modified. They were distributed by CryptoBilis, an authorised Ledger reseller that has recently changed ownership. The reported modification could allow an attacker to read a wallet’s recovery phrase and move funds, while the device could still pass authenticity checks. Routine verification alone might therefore fail to identify the alteration.
Ledger has instructed CryptoBilis to suspend sales and shipments. It has also advised customers who bought devices from the reseller during the previous 90 days to consider moving their assets to a new Ledger device. In its latest update, Ledger said the number of affected devices was limited. Cybersecurity firm Yfarmx estimated that the incident involved 471 addresses and approximately $93.4 million in losses, although Ledger has not confirmed that figure.
CryptoBilis has been listed as an authorised Ledger reseller in Indonesia, Malaysia and the Philippines. If the European device is ultimately linked to the Asian case, the investigation could extend beyond a single regional sales channel to distribution, resale and supply-chain controls for market-specific device versions.
Patched XRP Ledger flaw could have inflated supply
Security firm Veria Labs received a $250,000 bug bounty after identifying an overflow vulnerability in XRP-related code. The issue had been present in XRP Ledger code since 2015 and has now been fixed. There is no evidence that it was ever exploited.
Veria Labs co-founder Cayden Liao said the firm’s artificial-intelligence agents found two lower-severity vulnerabilities while reviewing rippled, the software used to run XRP Ledger. Each issue had limited impact on its own, but researchers were able to combine them into a potentially much larger attack path.
Liao said a single attack transaction could theoretically have created more than 18 trillion XRP, equivalent to 184 times the current total supply. Based on XRP’s total market value of about $94 billion, he said exploitation could have affected the value of assets across the network. The theoretical scale would exceed the largest cryptocurrency attacks recorded to date, but it does not mean that this amount of XRP was actually created or that losses occurred.
Veria Labs reported the vulnerability to the relevant teams on September 22, and RippleX completed the fix three days later. Liao said the ability to chain together two individually lower-severity issues may help explain why the flaw remained undiscovered for so long. With no signs of exploitation identified, the potential impact at the code level needs to be distinguished from an on-chain incident that actually occurred.
Buterin urges closer review of AI and cryptography
Ethereum co-founder Vitalik Buterin backed researcher Justin Drake’s warning about a proposed “bunker mode.” Drake has argued that advances in mathematical research driven by artificial intelligence could put pressure on the cryptographic systems used by blockchains before quantum computers pose a direct threat to them.
Buterin said users should not rush to move funds into new wallets, but the industry should take seriously the cryptographic risks that could follow if AI accelerates mathematical research. Drake has urged the sector to prepare for the possibility that AI agents could uncover new mathematical structures affecting elliptic-curve cryptography or lattice-based cryptography.
OpenAI recently announced hundreds of mathematical research results that had not previously been solved by humans. Those results do not currently involve cryptography, and there is no evidence that AI agents are close to breaking the cryptographic algorithms used by existing blockchains. Some project teams and analysts therefore believe the warnings may overstate near-term risk. Supporters argue that the speed of AI progress on other complex mathematical problems means long-term security assessments cannot rely solely on the absence of current attacks.
Samsung plans USDC transfers for eligible US users
Samsung plans to make USDC transfers available to eligible Galaxy users in the US during the final week of October through Samsung Wallet. The service is expected to reach about 82 million users. Customers will be able to send USDC to compatible wallets overseas or transfer funds to eligible bank accounts. The service covers more than 60 countries, with recipients able to receive local currency.
Identity verification will be required. Bastion will provide the stablecoin account and payments infrastructure, while Coinbase will act as the sub-custodian through Coinbase Prime Vault. Solana and Sui are listed as technology partners. The arrangement embeds stablecoin transfers into an existing mobile-payments channel, although the countries served, banking rails and account eligibility will depend on regional rules when the service launches.
Crypto assets finish the week lower
By the end of the week, Bitcoin was down 2.8% at $83,435. Ether fell 6.5% to $2,562, while XRP declined 7% to $1.40. Total cryptocurrency market capitalisation stood at about $2.82 trillion.
Among the 100 largest crypto assets by market value, the biggest weekly gainers were StarkNet, up 91%; Binance Life, up 25.4%; and Celestia, up 20.8%. StarkNet’s advance followed its announcement that it would transition to a post-quantum layer-1 network.
The biggest decliners were Venice Token, down 18.5%; Sky, down 16.2%; and Uniswap, down 15.4%.
Tom Lee sees potential for Ether to reach $25,000-$50,000
Bitmine chairman Tom Lee said at the Token2049 event on Friday that Ether could rise above $5,000 by the end of the year and “easily” reach between $25,000 and $50,000 by the end of the current cycle. The figures represent his personal market view rather than a certain outcome.
Lee also said Bitmine was approaching its goal of holding 5% of Ethereum’s total supply. The company currently holds about 6 million ETH and would need to purchase roughly 100,000 more to reach that target. He said 5% was the company’s ceiling and that Bitmine would not increase its holdings beyond that share of Ethereum’s supply.
Coldcard investigates phishing link on official X account
Bitcoin hardware-wallet maker Coldcard said an unauthorised phishing link appeared on its official X account on Sunday. The company said the post was published despite the account using offline two-factor authentication. The post was later removed, and Coldcard reminded users that its only official website is coldcard.com.
DefiLlama’s hack tracker estimates losses of $115 million in connection with an attack involving Coldcard in July. Coldcard has not disclosed how the phishing link appeared this time or said whether any users lost funds after viewing the post.
THORChain says 1.45 million USDT was temporarily frozen
Chad Barraford, THORChain’s technical co-founder, accused stablecoin issuer Tether of placing the network’s USDT treasury addresses on a blacklist without explanation, then lifting the restriction several hours later.
Barraford said on Friday that Tether had frozen about 1.45 million USDT held across four THORChain wallets. About two hours later, he said Tether had unfrozen all of the addresses and that transactions would resume. There was no further information on whether Tether would disclose the reason for the freeze or whether the action formed part of a broader compliance or risk review.
Celsius founder Mashinsky barred from related industries in New York
New York Attorney General Letitia James reached a settlement with Alex Mashinsky, the former chief executive of Celsius. Under the agreement, Mashinsky will be permanently barred from the cryptocurrency, securities and commodities industries and may be required to pay up to $35 million in conditional payments.
The agreement, released on Friday, relates to a civil lawsuit filed in 2023. The lawsuit accused Mashinsky of misleading tens of thousands of investors about the safety of the Celsius platform before its collapse in 2022. Mashinsky is currently serving a prison sentence. A federal court previously sentenced him to 12 years for fraud and separately ordered the forfeiture of more than $48 million.
France records 90 crypto-related violent incidents in seven months
French law-enforcement agencies recorded 90 cases involving kidnapping, extortion, threats and violent robbery linked to crypto assets over a seven-month period. The number has focused attention on the physical safety of crypto holders, extending the risk beyond account and wallet security to the custody of assets in the real world.
Crypto lending activity has also increased 55% since July. Risks facing the sector include AI-assisted attacks and the possibility of cascading failures when several connected protocols run into trouble. The handling of funds by exchanges, lending protocols and individual users continues to depend on their respective security controls, custody structures and liquidity management.
Raoul Pal, founder of Real Vision, said a pause in AI-stock gains and a weaker dollar could redirect some capital toward crypto assets. He also said AI agents could support greater use of Ethereum and Solana. Those are market views, however, and the crypto market ended the week with Bitcoin, Ether and XRP all lower.