A successful $10 test confirms delivery, not ownership. The incident highlights how address poisoning turns familiar payment history into a trap for Solana users.
The incident shows Genuine Check can validate an intact secure element while missing hardware added around it, leaving recovery phrases vulnerable to remote theft.
A freshly created wallet making repeated large UNI withdrawals from Binance is a classic pre-dump setup, and on-chain watchers are already flagging the address.
Version 3.4.1 gives the ecosystem a clear reference point for the fix while XRP's supply rules remain unchanged.
The episode exposes the risk of pairing 1,000x leverage with an external price feed and a shared pool that takes the other side of trades.
October's losses are concentrated in two incidents, putting tampered hardware devices and DeFi vault security at the center of the latest risk picture.
The flaw had existed since 2015, but exploiting it required hundreds of contrived offers and a transaction designed to consume them all at once.
The fix covers two theft paths, including a reconnect attack that could make a forwarding node pay a recipient without recovering the incoming funds.
The spyware can search for wallet apps, extract credentials and control infected phones remotely, but researchers found no evidence of completed crypto theft or a bypass of current iOS fixes.
The claims expose a potential oracle-design weakness: short-term changes in Hyperliquid quotes could affect executions on Papertrade.
More than $86 million in linked losses raises the stakes for hardware-wallet supply-chain security, even as Ledger says its own systems remain uncompromised.
No XRP was created or lost, but the incident exposed a decade-old weakness in XRPL's supply controls and forced developers to bypass normal validator approval.
An analysis of 49 Pump fun token callouts found suspected linked wallets buying ahead of posts and selling within about three minutes, often while the influencer was still publicly bullish.
Tor is no longer bundled by default in the standard Docker deployment, so operators who rely on onion access must explicitly add it at their next setup or update or their hidden service goes dark.
The campaign targets 24-word recovery phrases and follows earlier malicious Google ads that redirected Ledger users to fake verification pages.
The eight-year-old wallet had survived intact; the four-year pause before the user touched it again made it a sitting target for a long-dormant phishing kit.
Newly created wallets withdrawing more than a quarter of a token's total circulating supply in under 72 hours is a textbook accumulation or exit-preparation signal that traders watch closely.
The alleged implant shows how intact packaging may not prove hardware integrity, while Ledger has not confirmed the module or linked it to recent customer losses.
The flaw could have bypassed the ledger’s fixed-supply safeguards, but RippleX found no evidence of exploitation and shipped a patch in xrpld 3.4.1.
The ban is permanent and federal forfeiture is already at $48.4M, but the deal preserves Mashinsky's right to trade crypto for his own account, which lawyers will likely challenge.
CryptoSlate
Lookonchain
CoinTelegraph
TheBlock
WuBlockchain
CoinDesk