ledger

Evernorth's report shows that the number of XRP Ledger accounts has decreased, but the volume of single transactions has nearly tripled, with the total network value driven by stablecoins surpassing 4.2 billion dollars.

According to lawyer Ariel Givner, cryptocurrency hardware wallet manufacturer Ledger is facing a class-action lawsuit in the United States due to a security incident in 2023. The plaintiffs claim that the incident led to the leakage of personal identification information such as customer names, email addresses, and phone numbers, and that Ledger failed to timely and adequately disclose the relevant situation.The lawsuit also points out that hackers subsequently used this contact information to impersonate Ledger, tricking users into approving fraudulent transactions and stealing cryptocurrency assets.

Ayo Akinyele, Senior Director of Engineering at Ripple, stated that the company is developing a four-phase quantum-resistant migration plan for the XRP Ledger, aiming to complete the transition before quantum computers become a real threat. The plan includes assessing the network's exposure, testing quantum-resistant cryptographic solutions, running existing security systems in parallel with quantum-resistant alternatives, and preparing emergency response pathways for scenarios where quantum computing advances exceed expectations.Akinyele emphasized that migration is not just about replacing a cryptographic algorithm, but requires more flexible infrastructure, stronger key management, and clearer upgrade paths. The XRP Ledger has supported changing the keys that control accounts without altering the accounts themselves, a feature that is expected to reduce the difficulty of future migrations, but independent validators on the network still need to coordinate any broader rule changes.Meanwhile, Anthropic's model last month reduced the workload required to break leading post-quantum signature candidates by 67 million times, and Bitcoin and Ethereum developers also released their respective migration plans this week. Akinyele pointed out that AI and quantum computing are different technologies, but they are driving financial infrastructure to evolve in the same direction, as AI agents begin to trade and pay autonomously, raising new requirements for payment infrastructure that is always online and natively internet-based.

The security team of the open-source wallet provider OneKey successfully replicated the exploitation of a vulnerability in the old version of the Ledger Ethereum application in a laboratory environment. OneKey's founder and CEO Wang Yishi stated that they executed a "transaction replacement attack" on Ledger Ethereum application version 1.22.1 by exploiting a previously patched vulnerability, allowing attackers to overwrite pending transactions while users review legitimate transactions.Ledger responded that exploiting this vulnerability requires controlling the communication between the device and the host, such as through malware, compromised wallet software, or malicious web pages. Ledger has added application layer protections in the Ethereum application version 1.22.2 released on August 13 and fixed the underlying issue in Secure SDK 26.6.1 on August 21. Ledger emphasized that no users were hacked as a result; this was merely a replication of the vulnerability in a laboratory environment.This security test occurred after the Coldcard vulnerability incident. Previously, the Coldcard wallet had a firmware vulnerability that posed security risks to some mnemonic phrase generation, but Ledger stated that its devices were not affected by this vulnerability because recovery phrases are generated by a certified random source built into the device's secure chip. The vulnerability replicated by OneKey is unrelated to mnemonic phrase generation but affects the way transactions are processed during the signing process.

Yesterday, Ledger disclosed details of the LSB 023 security vulnerability on its official website. Some applications built on the Ledger Secure SDK may still receive new APDU commands during the user screen confirmation, leading to inconsistencies between the parameters displayed on the screen and the final signature parameters.In cases where the attacker controls the APDU communication between the device and the host, after the user confirms the operation shown on the screen, the device may generate a signature with different parameters. Ledger stated that it has fixed the issue through application-level checks and the SDK layer, and released Ledger Secure SDK v26.6.1 on August 21. The relevant applications have been rebuilt and released. Users need to update the applications through Ledger Live; merely updating the device firmware is insufficient to complete the fix. However, Ledger claims there is currently no evidence that the vulnerability has been exploited.

Ledger's Chief Technology Officer Charles Guillemet stated that there has recently been "FUD" targeting Ledger in the market, as a smart contract security company claimed to have discovered vulnerabilities in the Ledger Ethereum application. Guillemet mentioned that there indeed were vulnerabilities related to certain Clear Signing processes in the Ledger Ethereum application, but these vulnerabilities were discovered by Ledger's security research team Donjon using AI-driven vulnerability research tools, and the fixes were completed and deployed two weeks ago. Users can obtain protection by timely updating their Ledger device firmware and applications.The relevant security company contacted Ledger's bug bounty program only after the fixes were completed, did not follow responsible disclosure processes, and did not communicate with the bug bounty team, yet implied in subsequent content that the issue had not been resolved. This approach is not true security research but rather a way to create panic for attention. AI is changing the cybersecurity landscape, and both attackers and defenders can enhance efficiency with AI, but AI-driven security research can only truly enhance the security of the entire ecosystem when basic security principles such as responsible disclosure and pre-release verification are followed.Guillemet finally reminded Ledger users to keep their device firmware, Ledger applications, and related software up to date to automatically receive the latest security fixes and research results. Users should not be influenced by the related "FUD" and should timely update their software and maintain safe habits.

According to CoinDesk, Ripple's stablecoin RLUSD has surpassed a market capitalization of $2 billion, becoming one of the fastest-growing projects in the stablecoin market. Data shows that the total issuance of RLUSD is currently around $2 billion, with approximately $963 million deployed on the XRP Ledger and about $1.1 billion issued on the Ethereum network.Ripple previously stated that RLUSD will combine with its global payment network to provide more efficient on-chain liquidity solutions for businesses and financial institutions.

According to Cointelegraph, digital asset infrastructure provider Taurus has integrated its tokenization and custody platform with Swift's blockchain-based ledger. Taurus stated in the announcement that its clients can make payments on this ledger using bank-issued tokenized deposits through the existing digital asset infrastructure.The first batch of client integrations is expected to go live in a few days, with the first distributed ledger transactions completed through the Taurus platform anticipated to occur within weeks. Swift announced in July this year that the ledger is available for preliminary use, with 17 banks from six continents preparing to pilot real-time transactions using tokenized deposits.Previously, Standard Chartered Bank and HSBC completed the first real-time cross-border transaction through this ledger, connecting their respective independent tokenized deposit systems. Swift's ledger acts as a coordinating layer, supporting 24/7 cross-border payments for tokenized deposits on participating banks' balance sheets and coordinating inter-institutional transfers through existing mechanisms (including real-time gross settlement systems) before final settlement.

In response to the recent rumors about "vulnerabilities in the Ledger Ethereum application," Ledger's Chief Technology Officer Charles Guillemet tweeted that there was indeed a bug related to a specific clearance process, which was discovered by Ledger's security team Donjon using AI vulnerability research tools.The vulnerability has been fixed and deployed two weeks ago. Users just need to keep the Ledger application updated to be protected.

According to CoinDesk, HSBC and Standard Chartered have completed the first real-time tokenized deposit transaction on the Swift blockchain ledger. This transaction marks progress for traditional financial institutions in utilizing blockchain technology to handle tokenized deposits, with both parties achieving real-time transfer and settlement of deposit tokens through Swift's distributed ledger infrastructure.As a global interbank messaging and clearing network, Swift is promoting the application of its blockchain ledger in tokenized asset and deposit scenarios to enhance the efficiency of cross-border and inter-institutional funds. As major international banks, the collaboration between HSBC and Standard Chartered demonstrates the feasibility of tokenized deposits in practical business, helping to explore further integration of traditional finance and blockchain infrastructure.

According to The Block, New York-listed fintech company Broadridge announced that its Distributed Ledger Repo (DLR) platform processed over $8 trillion in transactions in July, averaging about $365 billion per day, a year-on-year increase of 28%.DLR allows companies to use distributed ledger technology to settle repo transactions in existing trading and post-trading environments, enabling real-time financing and tokenized collateral liquidity. In addition, Broadridge also offers on-chain proxy voting and governance services, as well as digital asset infrastructure management.

According to on-chain detective Specter, the same attacker is running similar phishing activities targeting Ledger. The relevant screenshots were taken two days ago, and the sponsored advertisement has now been removed.As of now, these activities have stolen over 3 million dollars.

The latest software version 3.3.0 of the XRP Ledger (XRPL) introduces multiple upgrade proposals, among which the "Confidential Transfers" feature aims to provide higher privacy protection for institutional users, supporting the encryption of token balances and transfer amounts while maintaining visibility of account and token types. This feature is primarily targeted at Multi-Purpose Tokens (MPT) on the XRPL, with application scenarios including tokenized financial assets such as funds and bonds. Through cryptographic technologies like zero-knowledge proofs, the network can verify the validity of transactions without disclosing specific amounts.According to market news, the XRPL currently has approximately $1.38 billion in on-chain real-world assets (RWA), including about $845.7 million in RLUSD. In addition to RLUSD, there are over $530 million in tokenized assets on the XRPL, involving issuers such as Ondo, VERT Capital, Archax, and Société Générale. Besides Confidential Transfers, the XRPL 3.3.0 version also includes five proposals: Batch, Sponsor, Permission Delegation, and Dynamic MPT, which address institutional needs for batch transactions, fee payment, permission management, and dynamic adjustment of token attributes. However, these upgrades have not yet been officially launched and will need to gain over 80% support from trusted validation nodes on the XRPL for two consecutive weeks before activation. The market is paying attention to whether institutions like Aviva and Ondo, which have issued assets on the XRPL, will adopt this privacy feature.

The real-time cross-border capital flow platform OpenFX announced the acquisition of Global Ledger, with its founder Tyler McIntyre appointed as the head of banking. At the same time, it launched a multi-currency account service. McIntyre previously co-founded the new bank Novo, which serves over 300,000 businesses and is valued at over $700 million.The account allows customers to make payments in local currency, and companies can hold received funds directly without the need for immediate conversion. OpenFX has launched the USD account in its first phase, which can receive and send funds to over 100 countries through ACH, Fedwire, and SWIFT, and supports instant connection with stablecoins like USDC.

According to Decrypt, Ledger's Chief Technology Officer Charles Guillemet stated that the Coldcard vulnerability incident exposed weaknesses in hardware wallet random number generation and emphasized that AI is reshaping the cybersecurity offensive and defensive landscape. Guillemet pointed out that the security model of hardware wallets "lives or dies by random numbers," and this incident proved that in the most expensive way.Ledger stated that its hardware wallets were unaffected because their mnemonic phrases are generated by a hardware random number generator within a certified secure element, with no software fallback path, generating a complete 256-bit random number each time. Guillemet believes that open-source code, if not thoroughly reviewed, does not equate to security, and AI is enabling attackers to scan code and identify vulnerabilities at machine speed, requiring defenses to advance at the same speed, which relies on secure design, hardware, and mathematics. Guillemet suggested that users should understand how the random number generation of a hardware wallet works and whether it has been independently certified when choosing one.

According to CoinDesk, Jazzi Cooper, the head of RippleX products, stated on the X platform that the next version of the XRP Ledger, xrpld 3.3.0, will be released next week. This update will introduce five new features for validators: confidential MPT, batch transactions, permissioned delegation, fee delegation and reserves, and dynamic MPT.Among these, the amendments for batch transactions and permissioned delegation were previously withdrawn urgently due to serious vulnerabilities discovered by security researchers.She stated that the XRP Ledger is already capable of supporting tokenized assets on a large scale, and this upgrade will further promote the application of these assets in global transfer, trading, collateralization, and settlement scenarios.

Zilliqa stated that there is a serious random number generation vulnerability in the Zilliqa Ledger application, affecting the Schnorr signatures of native non-EVM Zilliqa transactions. Attackers can recover the signer's private key from the biased temporary random numbers using only publicly available on-chain data.Any account that has signed and broadcasted about 5 or more native transactions through the Zilliqa Ledger application should be considered compromised. Since the related signatures are permanently recorded on the chain, subsequent updates to the application cannot eliminate the risk, and the affected private keys must be deactivated. EVM transactions and development tools such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.The vulnerability arises from the application selecting the wrong 32 bytes when copying the random number, retaining 8 bytes of zero padding and losing 8 bytes of entropy, resulting in each random number having a maximum of 64 bits fixed to zero. Attackers can use 5 or more affected signatures to recover the private key within seconds using ordinary hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21.Zilliqa has suspended native transactions to prevent further loss of funds and is preparing a revised application with Ledger. However, the revised version cannot protect the exposed keys, and affected users should not transfer assets on their own but wait for the official announcement of a coordinated disposal plan.

According to CoinDesk, hardware wallet company Ledger has launched an open-source toolkit called Ledger Agent Stack, which supports AI agents to interact with crypto wallets by reading balances, preparing transactions, and suggesting actions, with all transactions requiring user approval on Ledger hardware devices.Ledger stated that this release is the first step in its AI roadmap, aiming to integrate hardware-based security mechanisms into AI-driven crypto applications and to prevent autonomous agents from transferring funds or accessing sensitive credentials without human approval.

Bloomberg ETF analyst Eric Balchunas posted on the X platform that DTCC's digital conversion is taking place on HyperLedger Besu, which is DTCC's private network, as well as on the Canton public blockchain. This is part of DTCC's multi-chain strategy aimed at ensuring resilience, scalability, and selectivity.Additionally, DTCC currently holds over $114 trillion in securities, and its subsidiaries processed approximately $47 trillion in securities transactions last year.