A hardware wallet tampering campaign that drained an estimated $93.4 million from Ledger users in Asia has spread to Europe, according to a user who says he bought a compromised device from the consumer electronics chain MediaMarkt. Cybersecurity outlet Yfarmx put the Asian losses at $93.4 million across 471 addresses, a figure Ledger has not confirmed.

X user Johannes published photographs of a tampered Ledger he said he purchased two weeks ago at MediaMarkt. The implant inside appears to be an earlier version of the hardware found in devices shipped by the authorized reseller CryptoBilis in Asia, and no funds have been taken from the European device.

"Either the device didn't work, or they were waiting for a more widespread usage of the compromised devices," Johannes said.

Former Mt. Gox CEO Mark Karpeles, whose investigation helped expose the Asian tampering, said the antenna in the device marks it as the "Eurasian version," suggesting the attackers built regional implant variants tuned to different mobile frequencies. Ledger has not confirmed the European device belongs to the same campaign.

What is Ledger doing about the reseller channel?

The attack hit Asia late last week. Devices sold by CryptoBilis — an authorized reseller in Indonesia, Malaysia and the Philippines that had recently changed ownership — carried modifications that let attackers read the seed phrase while the device still passed Ledger's authenticity checks.

Ledger has asked CryptoBilis to suspend sales and shipments and advised customers who bought from the reseller in the past 90 days to move their assets to a new device. "The volume of impacted devices is limited," the company said in its most recent update.

The operational consequence is a distribution-channel problem, not a firmware flaw: Ledger now faces pressure to tighten reseller vetting after a change of ownership at an authorized seller preceded the incident.

How did an AI agent find an '18 trillion XRP' bug?

Security firm Veria Labs earned a $250,000 bug bounty for uncovering an overflow bug that had sat in XRP's code since 2015. The flaw is patched, and there is no evidence it was ever exploited.

Veria Labs co-founder Cayden Liao wrote on X that the firm's AI agent combed through rippled, the software powering the XRP Ledger, and found two individually low-severity bugs. Chaining them together, a single exploit transaction could have minted more than 18 trillion XRP — 184 times the total supply.

"This puts the full $94B at risk, more than 60 times the largest crypto hack on record," Liao wrote, referring to XRP's entire market capitalization.

Veria Labs reported the bugs on September 22, and RippleX patched them within three days.

Buterin warns AI math advances threaten cryptography

Ethereum co-founder Vitalik Buterin backed researcher Justin Drake's warning that AI advances could undermine blockchain cryptography before quantum computers do.

"I don't recommend anyone scramble to move their funds to new wallets today," Buterin wrote. "But we should take the risks to cryptography from AI-accelerated math seriously."

Drake urged the industry to prepare for "bunker mode" after OpenAI released hundreds of mathematical findings humans had been unable to solve. None related to cryptography, but the core Ethereum team worries AI agents could crack insights into elliptic curve or lattice-based cryptography. Critics call the warnings fear-mongering, noting no evidence AI agents are close to breaking cryptography.

Samsung Wallet adds USDC for 82 million US users

Samsung will introduce USDC transfers in Samsung Wallet for 82 million eligible US Galaxy users in the last week of October. Users can send USDC to compatible wallets internationally and transfer funds to bank accounts in more than 60 countries, with payouts in local currency after identity verification.

Bastion will provide stablecoin account and payment infrastructure, Coinbase will act as sub-custodian through Coinbase Prime Vault, and Solana and Sui were named technical partners.

New York bars Mashinsky in $35M settlement

Former Celsius CEO Alex Mashinsky is permanently barred from the crypto, securities and commodities industries under a settlement with New York Attorney General Letitia James that includes up to $35 million in conditional payments. The deal settles a 2023 civil suit alleging Mashinsky misled hundreds of thousands of investors before Celsius collapsed in 2022. Mashinsky is already serving a 12-year federal sentence and was ordered to forfeit more than $48 million.

Elsewhere, Coldcard is investigating how a phishing link appeared on its official X account despite offline two-factor authentication; DefiLlama estimates losses tied to July's Coldcard exploit at $115 million. THORChain co-founder Chad Barraford accused Tether of blacklisting USDt vault addresses holding about 1.45 million USDT, then unfreezing them roughly two hours later without explanation.

With Ledger still auditing its reseller network and the 90-day advisory window open for affected buyers, hardware wallet distribution security will remain the industry's most immediate operational test in the weeks ahead.