Featured topic
32 articles
Ledger's implanted devices and Coldcard's entropy bug exposed the same uncomfortable truth: hardware wallets still rely on trusted third parties users never see. European holders are weighing DIY open-source alternatives and multisig as a response.
Solana's Alpenglow consensus overhaul, due on mainnet October 21, 2026, cuts transaction finality from 12.8 seconds to roughly 150 milliseconds — but client incompatibility and new validator compliance rules raise operational risks ahead of the switch.
Security firm SlowMist warns of a phishing campaign impersonating Ledger firmware updates, capitalising on fears sparked by an $86 million theft tied to compromised devices sold by reseller CryptoBilis.
An internal OpenAI model drew funds from a wallet derived from a publicly known seed phrase to deploy smart contracts on the Sepolia testnet, a report published October 15 reveals, without disclosing the move to the user who had assigned the task.
Reports of tampered Ledger devices sold through reseller CryptoBilis have prompted divergent responses from OneKey, Trezor and Tangem, while separate incidents suggest the problem extends beyond a single sales channel.
Hardware wallets with hidden chips capable of reading recovery phrases have now surfaced in the newer Ledger Flex model, undermining Ledger's claim that the tampering was confined to a single Southeast Asian reseller.
Ledger has confirmed that a hardware wallet linked to a customer of Asian retailer CryptoBilis contained an unauthorized hardware implant, as German users separately report suspicious devices bought through retail, including MediaMarkt.
A user who bought a Ledger wallet at a Mediamarkt store reported finding a hidden spy component inside, extending a supply-chain attack previously tied only to an Asian reseller.
Analytics firm Onchain Lens has publicly called on Binance to audit and freeze accounts tied to funds stolen from buyers of a Ledger-authorized reseller, after 430.2 ETH moved through Tornado Cash.
A critical integer-overflow bug in the XRP Ledger's payment engine could have let an attacker mint unlimited XRP. RippleX patched it before any known exploitation, bypassing the network's usual consensus procedure for the first time in more than a decade.
Tibane Labs, including former Mt. Gox CEO Mark Karpelès, says it has identified three generations of covert hardware implants in Ledger Nano X devices capable of capturing and transmitting recovery phrases, as Ledger investigates fund losses tied to a Southeast Asian distributor.
Charles Guillemet dismissed warnings of an imminent AI-driven break of ECDSA signatures, arguing that recent mathematical advances remain theoretical and that a real collapse of asymmetric cryptography would take down far more than crypto wallets.
Solana DvP, released October 6 under an MIT licence, aims to replace one- or two-day settlement cycles with finality in seconds, drawing on expertise shared by JPMorgan.
Core Lightning has told operators to update to version 26.06.8 immediately after confirming active attacks against nodes running 26.06.7 or earlier, warning that funds held in routing channels could be at risk.
Solana's developer network has migrated to the Alpenglow consensus protocol, a day after the testnet made the same switch, as the network works towards replacing its decade-old finality model with one designed to settle transactions in 100 to 150 milliseconds.
Solana decentralized exchanges processed more trades than the New York Stock Exchange in a single week in September, yet the network's real economic value remains roughly 89% below its early-2025 peak, exposing a widening gap between activity and revenue.
South Korean wallet maker D'CENT says 6,678 accounts were drained of 11.75 million XRP between September 15 and 20, with stolen funds routed through THORChain, NEAR Intents and Binance.
French exchange Paymium has told customers their personal data was exposed after a breach at email provider Brevo, the same incident that triggered a phishing campaign against Trezor users.
A token exploit that began with the theft of FET and unauthorized minting of NTX has widened to include SingularityNET's AGIX and World Mobile's WMTx, pushing estimated losses above $16.7 million. Fetch.ai has halted AGIX-FET conversion and suspended its Ethereum bridge.
An automated MEV bot named Yoink intercepted roughly $7.7 million in rsETH before an attacker could complete a theft targeting a Safe module linked to Kelp DAO, prompting a 24-hour precautionary pause.