Justin Drake tweeted that it is reasonable to expect ECDSA (Elliptic Curve Digital Signature Algorithm) could break in months, not years

Overview Debates Related claims Topics

On October 9, 2026, Ledger began investigating hardware wallet thefts linked to devices sold by Southeast Asian reseller CryptoBilis

Ledger's October 13, 2026 update confirmed over $102 million was stolen across 324 cryptocurrency wallets compromised by tampered devices

Ledger confirmed a hardware implant was discovered inside at least one Ledger device sold by reseller CryptoBilis

A tampered Ledger device intercepted the 24-word recovery seed phrase displayed on screen and transmitted the data using a radio frequency transmitter

The XRP ecosystem awarded a $250,000 bug bounty payout for the responsible disclosure of the XRP infinite mint vulnerability

An OpenAI employee planted a homemade audio recording device behind a television in an executive boardroom at OpenAI's office

Mass-market consumer smartphones like Apple iPhones provide supply chain security benefits for cryptocurrency storage due to high production volumes compared to dedicated hardware wallets

Between $70 million and $100 million was stolen via tampered Ledger hardware wallets distributed through reseller channels over a four-to-five-month period

Passkeys can sign transactions on smart contract wallets using the secp256r1 cryptographic curve

Attackers compromised genuine Ledger hardware wallets by soldering an LTE chip, a CPU module, and an eSIM onto the legitimate device board

A vulnerability allowing an infinite minting bug existed undetected in the XRP codebase for a decade

Tampered Ledger devices in early supply chain attacks were pre-initialized with a 24-word recovery phrase printed on paper or a scratch card

A security research team spent $40,000 on compute resources over six days to discover a remote code execution vulnerability in Google Chrome

Shamir's Secret Sharing enables cryptocurrency recovery seed phrases to be split into multiple parts requiring a specified threshold to reconstruct

A hardware implant inside compromised Ledger devices intercepted seed phrase data sent from the secure element to the screen display

Google's maximum bug bounty payout for critical vulnerabilities, including remote code execution bugs in Chrome, is $250,000

A hardware implant inside compromised Ledger devices transmitted intercepted seed phrases to an external command-and-control server via cellular LTE

Tampered Ledger devices bypassed the Ledger genuine check because an implant intercepted display data without modifying the genuine CPU, secure element, or firmware

Paper wallets prevent online transaction signing while providing cold storage for cryptocurrency private keys

The Ledger genuine check verifies whether the device's CPU, secure element, or firmware have been modified or replaced