A sophisticated supply-chain attack targeting Ledger hardware wallets, which resulted in an estimated $93.4 million loss from Asian users via the reseller CryptoBilis, has reportedly spread to Europe. A user identified a tampered device purchased from MediaMarkt containing an implant similar to those found in Asia, though no funds were stolen from this specific unit. Former Mt Gox CEO Mark Karpeles noted the device’s antenna indicated a “Eurasian version,” suggesting region-specific implants. Ledger has suspended sales from CryptoBilis and advised recent buyers to transfer assets, stating the volume of impacted devices is limited.
In a separate security development, Veria Labs received a $250,000 bug bounty after its AI agent discovered two low-severity bugs in the XRP Ledger code that, when chained together, could have allowed a single transaction to create more than 18 trillion XRP. This potential exploit represented 184 times the total supply and put the full $94 billion market cap at risk. RippleX patched the vulnerabilities three days after they were reported on September 22. Additionally, Ethereum co-founder Vitalik Buterin supported warnings that AI-accelerated mathematics could threaten current blockchain cryptography before quantum computing becomes viable.
The geographic expansion of the Ledger compromise highlights persistent vulnerabilities in physical supply chains for self-custody infrastructure. While digital attacks often dominate headlines, the presence of hardware implants in retail electronics suggests that attackers are increasingly targeting the intersection of logistics and consumer trust. The distinction between regional implant versions implies a coordinated, scalable operation rather than isolated incidents, challenging the assumption that authorized resellers provide a secure end-to-end delivery channel. For institutional custodians and retail users alike, the incident underscores the operational risk inherent in relying on third-party distribution networks without independent verification mechanisms at the point of sale.
Simultaneously, the discovery of the XRP vulnerability by an AI agent marks a shift in how critical infrastructure flaws may be identified and exploited. The fact that chaining two low-severity bugs created a catastrophic exploit demonstrates that traditional severity classifications may underestimate systemic risks in complex codebases. As AI tools become more proficient at mathematical analysis, the window for patching such vulnerabilities narrows, increasing the pressure on open-source maintainers to adopt automated auditing processes. This development also validates concerns raised by Ethereum leadership regarding AI’s potential to accelerate cryptographic breakthroughs, suggesting that the threat landscape is evolving faster than regulatory or technical frameworks can adapt.
