ledger

According to CoinDesk, asset management giant Franklin Templeton recently added approximately 150 million dollars worth of tokenized money market fund shares to the XRP Ledger (XRPL), increasing the total supply of sgBENJI tokens on the network from about 48 million to 193 million.Based on the transaction record of 1.039 dollars per share, the total value is approximately 200 million dollars.

According to CoinDesk, the patch for the XRP Ledger vulnerability was delayed until November as the number of validator supports dropped to 26 (out of a total of 35), resetting the countdown timer for its effectiveness.Currently, the number of supports has risen back to 31, but due to the need to recalculate the two-week countdown, this fix has missed the originally impending effectiveness window.

Ledger Wallet officially launches the Crypto Loan feature, allowing users to directly use the Morpho open credit network for lending operations within the Ledger Wallet. The core of this feature is that users can use Wrapped Bitcoin (wBTC) or cbBTC as collateral to borrow stablecoins such as USDC or USDT without selling their assets.This integration brings hardware-level security standards into the DeFi lending space. All lending activities are physically confirmed through Ledger Signer, ensuring that every on-chain interaction from deposit to loan has clear signatures and hardware-level security guarantees. During the lending process, users' collateral remains in Morpho's smart contracts, with Ledger acting solely as a technology provider.Morpho is an open credit network running on Ethereum and major Layer 2s, providing flexible lending markets through infrastructures like Morpho Blue and Morpho Midnight. This feature supports operations such as adding collateral, repaying, increasing loan limits, and withdrawals. It is important to note that this service uses floating interest rates and carries liquidation risks, and users should pay attention to the specific supported countries and lending terms.

The Starknet Foundation announced the launch of the Bramble wallet, which integrates the STRK20 shielding feature, allowing users to hold privacy balances.Bramble is a wallet that only supports the Chrome browser, integrating privacy balances, Ledger hardware signing, and multi-signature account features, and provides recovery mnemonic phrases for backup.

The XRP Ledger vulnerability fix package named fixCleanup3_4_0 is expected to officially take effect around 09:34 UTC on October 23. This fix package has received votes from 29 validators, surpassing the threshold of over 80% approval among the network's default 35 validators, and must be maintained continuously for two weeks. The countdown has been ongoing for nine days. Since there is no margin in the vote count, if any validator withdraws support, the countdown will restart.This fix package partially addresses the unsecured lending system that Ripple has been promoting to banks and payment companies since June, but this system has not yet been activated. Currently, the lending amendment has only 19 votes, and the vault amendment for holding funds has 21 votes, neither of which has started the countdown. Therefore, even if both reach 29 votes today, the lending function will not be available until early November at the earliest.As designed, lenders will deposit XRP or other tokens into the vault, and loan brokers will then lend out the funds for a fixed term. The ledger is responsible for recording the loans and tracking repayments, while brokers assess the borrower's qualifications off-chain. Since borrowers do not need to provide collateral, the broker's judgment becomes the only guarantee for lenders against default losses. Ripple has promoted this scheme to payment companies that need liquidity during cross-border settlement. Additionally, the fix package also closes a vulnerability that allowed accounts authorized to destroy tokens to create new tokens under specific conditions and adjusts the rounding of vault amounts as well as the rules for determining loan overdue and default.

Clearpool announced the 2026 v4 protocol whitepaper and stated that its institutional credit market has been operating on multiple EVM-compatible networks and is further expanding to the XRP Ledger. The whitepaper reveals that the institutional credit protocol will collaborate with Ripple and Cicada Partners to expand to the XRP Ledger for the settlement of the regulated stablecoin RLUSD, and will migrate the token from CPOOL to the new token CLEAR at a 1:1 ratio.The total supply of CLEAR is 1.429 billion tokens, with 1.125 billion tokens in circulation at the time of migration, accounting for 78.75%; this migration and the XRPL expansion have been approved through Snapshot voting, with a support rate of 97.16%. Since its operation began in 2021, the protocol has issued loans totaling approximately $965 million, with borrowers including Jane Street, Flow Traders, and Wintermute, and currently supports six EVM chains. 50% of the protocol fees will be used for open market repurchases and permanent destruction of CLEAR. XRPL products are preparing for testing on Devnet.

Former Mt. Gox CEO Mark Karpelès questioned Ledger Support's previous statements. Ledger customer service had claimed that the secure element could detect physical tampering, and if additional hardware attempted to intercept signals, it would not pass authenticity verification. Karpelès pointed out that Ledger's own documentation states that if the original secure element is intact, authenticity verification cannot detect unauthorized physical modifications such as spy implants, which directly contradicts the customer service claims.Mark Karpelès stated that reports have shown that over $90 million has been stolen due to such "additional hardware" intercepting signals less than two months later, and that Ledger had published photos of spy implants for multiple models in a March 2026 academic article. Given the known threats, assuring users that authenticity verification can detect such modifications may constitute misleading advertising.

Ledger CEO Pascal Gauthier responded to former Mt. Gox CEO Mark Karpelès' warning about the security risks of hardware implants, questioning his stance and stating that Ledger has always done its utmost to protect users.Pascal Gauthier stated that the relevant security work is extremely challenging, acknowledged Karpelès' concerns on the matter, but urged him to speak based on known facts and avoid speculation, while also sarcastically saying, "Come on, you're not some white knight, be realistic."Previously, Mark Karpelès accused Ledger of potentially avoiding over $90 million in losses if they had disclosed related issues more timely and effectively, rather than just publishing a discreet article on Ledger Academy. He also questioned why Ledger had not maintained sufficient vigilance regarding the mass production of advanced implant devices.

According to on-chain detective Specter, ZachXBT disclosed that the Bitget attackers concealed the stolen funds through Zcash (ZEC), and other stolen funds also began to flow into ZEC, including funds from the Cryptobills Ledger incident and $12 million from the Triple-A hacker attack.Threat actors are using ZEC to transfer stolen funds.

According to Cointelegraph, French hardware wallet manufacturer Ledger received multiple reports of malicious implants months before the latest security crisis occurred. Former Mt. Gox CEO Mark Karpelès stated that at least two individuals contacted Ledger starting in December 2025 to report that their devices had been tampered with, but no public warning was issued.Security researcher Joe Grand reported a malicious implant to Ledger on March 4, 2026, which was located in a Nano X purchased from Lazada in Thailand in August 2025.Ledger confirmed the findings and stated that an internal investigation would be launched, but did not proactively alert customers. Mark Karpelès believes that the increase in the number of reports and the complexity of the technology used should prompt Ledger to take action and at least remind customers to remain cautious.Ledger declined to comment on how they handled Joe Grand's disclosure, only directing to their public statement on X. The Ledger security crisis was made public on October 9, involving the loss of wallet crypto assets sold by Southeast Asian authorized dealer CryptoBilis; Ledger confirmed that one affected device contained an unauthorized implant. Trezor had also previously received reports involving unauthorized sellers tampering with devices.

Slow Mist stated that a fraudulent "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to carry out attacks. The phishing page is highly realistic, including a fake "Genuine check" page, device selection interface, and "Update Now" button. Slow Mist reminds users not to update Ledger devices through website links and not to enter recovery phrases anywhere.

Ledger released a report on the investigation of hardware implant attacks, stating that a highly organized criminal gang purchased genuine Ledger devices over several months, disassembled them, and implanted custom hidden components to steal users' recovery phrases when initializing the devices. They then resold the devices through Southeast Asian distributor channels.The attackers invested millions of dollars to build infrastructure for collecting recovery phrases, asset transfers, and money laundering, coordinating actions to transfer victims' assets. Ledger emphasized that this incident was not caused by vulnerabilities in the chip, operating system, or servers, but rather a localized distribution channel attack that occurred after the devices left the company's control. Currently, Ledger has requested authorized distributors and resellers in Southeast Asia and Hong Kong to suspend sales and conduct random checks on inventory and retail channel devices, finding no other tampered devices.Additionally, Ledger has requested authorized distributors not to resell any returned devices, even if the packaging is intact; they have also immediately prohibited displaying products on shelves or in display areas, requiring devices to be stored at the back of the store and delivered upon purchase. The company is working with law enforcement and the security community to track the stolen funds and will disclose more technical details in the future.

According to Chainalysis, one of the biggest victims in the theft incident involving the cryptocurrency hardware wallet manufacturer Ledger was also a scammer, suffering a loss of over 60 BTC, worth approximately 4.8 million dollars, with funds coming from a task scam.In this scam, participants were paid to create fake sales and reviews for real products. Subsequently, a "negative balance" appeared, and participants were told that they had to invest their own funds to receive payment. On September 22, the mastermind behind the scam transferred the funds to three separate Ledger addresses. On October 9, the thieves emptied all three addresses, transferring the funds to the same wallet through a single transaction from each address. The receiving wallet has been reported to be involved with the stolen funds.

According to PR Newswire, Solana Mobile, the mobile business of the Solana ecosystem, announced at the Ledger Op3n 2026 event in Paris that the hardware wallet company Ledger has become its first hardware expansion partner. The Solana dApp Store and wallet will merge into the Seeker app and integrate with the new device Ledger Atom, which will be pre-installed on the device's home screen for users to access the Solana ecosystem. Pre-orders for Ledger Atom are now open.Ledger Atom is based on the Android open-source project and features a secure element running Ledger OS, with a protection level of EAL6+, displaying and touch control physically isolated from the Android system. Signing and approval are completed in secure mode, and the device includes tamper-proof and tamper-evident solutions, sold exclusively through the Ledger official website. The built-in app store currently has over 1,500 applications covering categories such as trading, payments, gaming, and AI. Existing Seeker users are unaffected, and developers can reach more devices with a single submission.This collaboration builds on Solana Mobile's opening of the Solana Mobile Stack to Android manufacturers at the World Mobile Communications Conference in March 2026. The SKR token is used to reward user participation, developer building, and hardware vendor integration. Seeker has a transaction volume exceeding $13 billion, with 154 million transactions and over 200,000 devices sold; the company shipped Saga in 2023 and will ship Seeker in 2025.

Cryptocurrency hardware wallet manufacturer Ledger announced the launch of Ledger Agent Intent, which is now open for free to all signature devices compatible with Ledger. The AI agent can monitor the market and provide portfolio optimization suggestions, allowing users to review and approve relevant actions on their Ledger devices, while the private keys remain under the user's control.Agent Intent will be directly integrated with OpenClaw, allowing users to register the OpenClaw agent and authorize actions on their Ledger Atom devices, with the OpenClaw application pre-installed on the device. This tool also supports Pay.sh from the Solana Foundation, and requests made by the agent can enter a unified queue for users to choose the timing for signing.Ledger collaborates with Venice AI to address privacy issues and stated that user data will not be used for training models by third parties.

Ledger announced the progress of the investigation into the hardware wallet implantation attack. According to its disclosure, an organized crime group spent months purchasing genuine Ledger devices, disassembling them to implant custom hardware specifically designed to steal mnemonic phrases, and then reintroducing them to the market through Southeast Asian distribution channels.The group also established a supporting system for collecting mnemonic phrases, asset theft, and money laundering, with Ledger stating that the scale of their investment reached several million dollars. Ledger emphasized that this incident is a localized distribution channel attack, and its chips, operating system, and servers were not compromised.The company has requested authorized distributors and resellers in Southeast Asia and Hong Kong to suspend sales and implement new security regulations, including prohibiting the display of devices on shelves or in display areas, as well as banning the resale of returned devices.

The founder of the hardware wallet OneKey, Yishi, announced the launch of a tool to detect whether hardware wallets have been tampered with, called tampered.app. Users can upload photos of the circuit board for detection, supporting OneKey, Ledger, and Trezor, free of charge, without registration, and without saving photos.The tool can mark suspected anomalies, but a normal result does not guarantee complete safety. Yishi stated that tests on approximately 400 photos submitted by users showed an accuracy rate of over 95%.

According to Bitcoin News monitoring, Bitcoin News released a podcast where former Mt. Gox CEO Mark Karpelès discussed the largest supply chain attack in the history of the cryptocurrency industry with Foundation CEO Zach Herbert.Mark Karpelès stated that he discovered a spy implant three weeks before the funds were stolen and contacted Ledger, but received no response. The implant was equipped with a hidden cellular modem that could directly read the mnemonic phrases displayed on the screen and bypass Ledger's own checks; even setting a passphrase would not prevent the mnemonic phrases from being stolen.Mark Karpelès mentioned that if he had $5 million, he could create an implant that would only be detectable through X-rays. The show also discussed the hardware wallet dealer model, the Malaysian dealer behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, reasons why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The show timeline indicated that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.

According to Bitcoin News monitoring, a German Ledger user @jayr_crypto reported receiving a forged letter again this week. The letter impersonates Ledger, claiming that new regulations require users to register their Bitcoin wallets through a service called ZenLedger by October 31. The letter uses Ledger's official branding elements and mentions German financial regulators, while also including a QR code that directs users to a so-called mandatory registration process.The user believes that addresses exposed in a previous data breach are being used for targeted attacks on Ledger users. In the same week, Ledger coordinated with MediaMarktSaturn to suspend the sale of its hardware wallets in a European retail network covering 11 countries and over 1,000 stores.Earlier reports indicated that malicious spy implants were found inside Ledger devices purchased from European retailers. Ledger confirmed separately that compromised devices sold by a Southeast Asian distributor contained implants capable of stealing recovery phrases and transmitting them over cellular networks. Ledger has not confirmed any breaches of devices in Europe. Ledger users are currently facing physical supply chain tampering and targeted phishing attacks initiated using home addresses. Do not scan suspicious QR codes or enter recovery phrases.

Ripple announced the integration of the wallet technology from Privy, a subsidiary of Stripe, into the XRP Ledger, allowing financial applications and AI agents to create accounts, hold cryptocurrency assets, and complete payments without users needing to manage wallet software themselves. Developers can create wallets within their own products and authorize transfers involving XRP, the US dollar stablecoin RLUSD issued by Ripple, and other network assets. Privy is responsible for the wallet infrastructure, reducing the workload for application developers while supporting the export of private keys or mnemonic phrases for wallet migration to other platforms.This integration also allows AI agents or automated bots to hold funds and automatically pay for online data and service fees. Privy documentation states that wallets running on enterprise servers can allow software to hold and spend funds, including purchasing data access services through the x402 payment standard. J. Ayo Akinyele, head of engineering at RippleX, stated that the network has processed over 13 million agent payments via x402, accounting for about 25% of ledger activity. Data from the XRPL AI Hub operated by payment infrastructure developer t54 shows that as of Wednesday, cumulative transactions exceeded 14.3 million, covering 169 registered merchants.However, the cumulative transfer amount is much smaller than the scale suggested by the number of transactions, with the dashboard recording cumulative payments of approximately 6,991 XRP and 12,752 RLUSD, most transaction amounts being very small. Ripple began providing related tools to developers in June and expanded support for payment standards developed by Stripe and payment blockchain Tempo in September.