rdw

According to PR Newswire, Solana Mobile, the mobile business of the Solana ecosystem, announced at the Ledger Op3n 2026 event in Paris that the hardware wallet company Ledger has become its first hardware expansion partner. The Solana dApp Store and wallet will merge into the Seeker app and integrate with the new device Ledger Atom, which will be pre-installed on the device's home screen for users to access the Solana ecosystem. Pre-orders for Ledger Atom are now open.Ledger Atom is based on the Android open-source project and features a secure element running Ledger OS, with a protection level of EAL6+, displaying and touch control physically isolated from the Android system. Signing and approval are completed in secure mode, and the device includes tamper-proof and tamper-evident solutions, sold exclusively through the Ledger official website. The built-in app store currently has over 1,500 applications covering categories such as trading, payments, gaming, and AI. Existing Seeker users are unaffected, and developers can reach more devices with a single submission.This collaboration builds on Solana Mobile's opening of the Solana Mobile Stack to Android manufacturers at the World Mobile Communications Conference in March 2026. The SKR token is used to reward user participation, developer building, and hardware vendor integration. Seeker has a transaction volume exceeding $13 billion, with 154 million transactions and over 200,000 devices sold; the company shipped Saga in 2023 and will ship Seeker in 2025.

Ledger announced the progress of the investigation into the hardware wallet implantation attack. According to its disclosure, an organized crime group spent months purchasing genuine Ledger devices, disassembling them to implant custom hardware specifically designed to steal mnemonic phrases, and then reintroducing them to the market through Southeast Asian distribution channels.The group also established a supporting system for collecting mnemonic phrases, asset theft, and money laundering, with Ledger stating that the scale of their investment reached several million dollars. Ledger emphasized that this incident is a localized distribution channel attack, and its chips, operating system, and servers were not compromised.The company has requested authorized distributors and resellers in Southeast Asia and Hong Kong to suspend sales and implement new security regulations, including prohibiting the display of devices on shelves or in display areas, as well as banning the resale of returned devices.

The founder of the hardware wallet OneKey, Yishi, announced the launch of a tool to detect whether hardware wallets have been tampered with, called tampered.app. Users can upload photos of the circuit board for detection, supporting OneKey, Ledger, and Trezor, free of charge, without registration, and without saving photos.The tool can mark suspected anomalies, but a normal result does not guarantee complete safety. Yishi stated that tests on approximately 400 photos submitted by users showed an accuracy rate of over 95%.

Binance founder Zhao Changpeng posted on X stating: In the future, all hardware wallets must adopt transparent cases.

The Synthetic Dollar Agreement's founder and CEO of Ethena, Guy Young, stated that users have noticed a large investor wallet transferring tokens in the past 48 hours. He confirmed that the related transfers are a security precaution related to recent concerns about hardware wallets and do not indicate that the tokens are being sold after being transferred.Guy Young made the above statement on X in response to the community's concerns about the on-chain movements of large wallets. He emphasized that the related operations are precautionary arrangements taken for security reasons and do not represent that investors are selling their held tokens.

According to Bitcoin News monitoring, Bitcoin News released a podcast where former Mt. Gox CEO Mark Karpelès discussed the largest supply chain attack in the history of the cryptocurrency industry with Foundation CEO Zach Herbert.Mark Karpelès stated that he discovered a spy implant three weeks before the funds were stolen and contacted Ledger, but received no response. The implant was equipped with a hidden cellular modem that could directly read the mnemonic phrases displayed on the screen and bypass Ledger's own checks; even setting a passphrase would not prevent the mnemonic phrases from being stolen.Mark Karpelès mentioned that if he had $5 million, he could create an implant that would only be detectable through X-rays. The show also discussed the hardware wallet dealer model, the Malaysian dealer behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, reasons why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The show timeline indicated that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.

According to an official post from Ledger, its security team Ledger Donjon is investigating Ledger signing devices sold by the Southeast Asian distributor CryptoBilis, which have been implanted with unauthorized hardware components. Ledger confirmed this matter on October 10 regarding a device belonging to an affected user. Donjon's analysis shows that the implant is located within the device's casing and can read the screen display content—decoding the 24-word recovery mnemonic during the initial setup and transmitting it externally via LTE through a built-in eSIM; this component does not alter the security chip, system, or transaction signature.Currently, all confirmed financial losses related to the incident disclosed on October 9 involve devices sold by CryptoBilis. CryptoBilis has stopped selling Ledger devices. The total number of affected users and the amount of losses have not yet been verified, and Ledger is investigating similar implant reports from other distributors and regions.

According to X user @0xJohannes, a Ledger hardware wallet purchased from an official dealer in Europe a few weeks ago was found to contain an unauthorized spy implant. The device has suspicious circuitry inside that genuine Ledger hardware does not possess, indicating it may have been physically tampered with before sale.The implant is suspected to be an older version, as newer versions typically hide components behind the screen. Funds in the affected devices have not yet been stolen. Currently, there are suspected case reports in Asia, South America, and Europe. If the original security components remain intact, Ledger's software Genuine Check cannot detect unauthorized physical modifications.

Ledger Support released an update stating that it has confirmed the presence of unauthorized hardware implants in the device of one affected user. They are currently contacting the affected user and continuing to investigate the matter. Ledger is calling on anyone with information to provide leads and has stated that it is cooperating with relevant law enforcement agencies to hold those involved accountable. As a precaution, CryptoBilis has confirmed the suspension of sales of all hardware wallet inventory until the investigation is complete, and Ledger is actively communicating with them regarding follow-up measures.Ledger stated that there are currently no signs that its security infrastructure, systems, or services have been compromised. For users who purchased Ledger devices from this dealer, if the initialization setup has not yet been completed, it is advised not to start the setup; if the setup has been completed, they should consider transferring assets to a new Ledger signing device using new recovery phrases.Ledger emphasizes that security threats are constantly evolving, and the company is continuously improving security measures and advancing more sophisticated tamper-proof solutions. It also reminds users to be vigilant against scams that take advantage of this situation and to obtain the latest information only through official Ledger channels. Ledger will not ask users for their 24-word recovery phrase.

Zhao Changpeng stated that users should pay attention to asset security (Stay SAFU out there) and clarified that he does not oppose hardware wallets or self-custody.Zhao Changpeng added that different wallets and products are suitable for different use cases, and their security implications and best practices vary. He also disclosed that YZi Labs has invested in hardware wallet projects such as OneKey and SafePal, as well as mobile wallet products like Trust Wallet.

Hardware wallet dealer CryptoBilis announced that, due to Ledger investigating a case involving fund losses for Southeast Asian users, the company has suspended all sales and shipments of Ledger devices and is cooperating with Ledger's investigation. Ledger previously stated that it is investigating reports of fund losses from Southeast Asian users who purchased products from this dealer, and as a precaution, has requested CryptoBilis to suspend the sales and shipments of related devices, advising users who purchased devices in the past 90 days not to set them up if they have not completed initialization.CryptoBilis reminds users who have completed setup to follow Ledger's advice and transfer their assets to a new Ledger signing device generated with a new mnemonic phrase. It emphasizes that the mnemonic phrase must be generated by the device during initialization and handwritten by the user; if the device comes with a pre-printed or written mnemonic card or paper, or if the mnemonic has been seen by others, the wallet should be considered unsafe, and users should not disclose their mnemonic phrase or PIN to anyone. The notice also warns to be cautious of third parties claiming to assist in recovering lost funds, as such proposals are often scams.For users who have already experienced fund losses, CryptoBilis recommends contacting their official customer service channels and providing the order number, purchase time and location, device serial number, affected wallet address, and transaction ID, while keeping the device and packaging, not resetting or discarding them, and suggests reporting to the police. The company stated that it will not send users links requesting them to connect wallets, input mnemonic phrases, or install software.

The Chief Information Security Officer of Slow Mist Security, 23pds, stated that if the modification of the Ledger device's PCB is indeed as described by former Mt. Gox CEO Mark Karpelès, the attacker would possess a considerable level of technical skill.23pds mentioned that the possible attack process involves the wallet generating a mnemonic phrase within a secure element and displaying it on the screen for the user to write down. A malicious module could obtain the displayed content through screen data lines such as SPI, record the complete mnemonic phrase, and then send the data to the attacker via LTE/eSIM. The secure element can prevent the private key from being directly read or exported, but it cannot stop external modules from accessing the information currently displayed on the screen. He noted that the above analysis is based on the premise that the PCB has indeed been modified in the described manner, and the relevant attack paths and hardware implantation still require independent verification.Mark Karpelès previously stated that a Ledger hardware wallet he received was suspected of being implanted with a spy module. The device came from Malaysia, the outer packaging was intact with shrink wrap, and the implant was hidden in the position where the screen originally had a cushion, containing LTE communication components, an antenna, eSIM, and a microcontroller connected to the Ledger SPI bus, capable of analyzing the characters displayed to the user and sending relevant data after the mnemonic phrase setup is completed.

The Malaysian hardware wallet distributor CryptoBilis has been revealed to have changed ownership during the investigation into a suspected supply chain attack on Ledger devices. Newly disclosed company records show that an individual named Jiaming, with a registered address in Heilongjiang Province, China, has held 100% of the company's shares since August 3.The former co-founder of CryptoBilis confirmed that the company was acquired in March of this year, and the original shareholders subsequently withdrew from all operational, management, and administrative positions. The founding team has been unable to understand the actual operations of the company after the handover, only continuing to assist with some activity coordination, and stated that they are no longer part of the company, urging the current management to handle the matter transparently.As the change in ownership was exposed, CryptoBilis has come under scrutiny for its alleged involvement in the supply chain attack on Ledger hardware wallets, with related devices reportedly implanted with hidden modules capable of stealing recovery phrases. There is currently no conclusive evidence linking the change in ownership to the wallet theft incident. CryptoBilis has temporarily suspended sales and shipments of all brand hardware wallets at its stores and online channels in Malaysia, the Philippines, and Indonesia, and has closed offline stores until further notice.

Zhao Changpeng issued a reminder for Ledger hardware wallet users to remain vigilant, especially those who have purchased devices recently. According to the information currently available, this incident appears to be limited to the supply chain, involving a supplier, and a few users may have purchased counterfeit or tampered Ledger devices.Zhao Changpeng stated that Ledger is a well-established and relatively secure hardware wallet brand in the industry, but such incidents can still occur. He anticipates and calls for the BNB ecosystem and the entire cryptocurrency industry to assist in tracking the stolen funds and promoting recovery.Previously, Ledger confirmed that it is investigating an asset theft incident involving Southeast Asian users, who had purchased devices through the distributor CryptoBilis. Ledger has requested CryptoBilis to suspend sales and shipments and advised users who purchased devices through this distributor in the past 90 days not to initialize their devices; if they have already completed the setup, they should create a new Ledger signing device using a new mnemonic phrase and transfer their assets to the new wallet.On-chain investigator Specter estimates that this incident has led to the theft of hundreds of wallets on the Bitcoin, Ethereum, and TRON networks, with losses exceeding 86 million dollars. Security researcher tanuki42 previously estimated the losses to be over 72 million dollars and stated that the amount is still increasing. Currently, the specific cause of the incident and whether the involved devices have security vulnerabilities are still under investigation.

According to reports from Lei Feng Network·Whale Rhino, AI hardware company Loke Technology NOOKLAB has completed several rounds of financing, with investors including Sequoia China, Linear Capital, and others, accumulating a total amount of several hundred million RMB, with a current valuation close to 100 million USD. The two rounds of financing were concentrated at the beginning of this year.Loke Technology's founder Raymond was born in 1996 and has previously worked at OPPO, OnePlus, Anker, and ByteDance, where he was responsible for the second-generation AI glasses in the Byte Ocean team. Its first product, Moonphase Flip, weighs 54 grams and attaches to the back of the phone via MagSafe magnetic suction. The company defines it as a low-disruption AI portable screen, primarily targeting overseas markets. The team currently consists of about 30 people.

According to Ark Invest Tracker, Ark Invest states that AI hacking attacks are affecting everything. The risks go far beyond Bitcoin, as AI makes software vulnerabilities easier to discover and exploit.Bitcoin and hardware wallets may be the first to be impacted, but social media, tax, and banking websites may also face the same threats. Trusting a big brand still means trusting that the company will not make mistakes as AI becomes increasingly powerful. ARK expects that large custodial institutions will also become targets, with AI potentially discovering and exploiting vulnerabilities at an unprecedented speed.

Chutianlong recently won the bid for a digital renminbi hardware wallet management system project from an operating organization. The full-stack platform output from hardware supply to issuance continues to enhance the full-link service capability.