An user reports buying a tampered Ledger from a big retailer in Europe. Security researchers use AI to uncover a “$94 billion” XRP bug — but receive just a $250K bounty.
A tampered Ledger attack that has already seen an estimated $93.4 million taken from Asian hardware wallet users, has reportedly spread to Europe. X user Johannes has presented photographs of a tampered Ledger he said he purchased two weeks ago from the European consumer electronics chain MediaMarkt. The implant inside appears to be an earlier version of the one found linked to CryptoBilis shipped devices in Asia, and no funds have been taken.
“Either the device didn’t work, or they were waiting for a more widespread usage of the compromised devices,” he said. Former Mt Gox CEO Mark Karpeles, whose investigations into the tampered Asian Ledgers helped bring the problem to light, said the antenna in the device says it is the “Eurasian version” suggesting separate versions of the implant have been sent to regions that use different mobile frequencies. Ledger has not confirmed the reported European device is part of the same attack.
“PSA the ledger incident isn’t limited to Asia,” wrote European X user Johannes. Source: Johannes.
The sophisticated attack hit Ledger devices in Asia late last week, after devices from the official reseller CryptoBilis — which had recently been sold to a new owner — were found to be modified in a way that apparently enable attackers to read the seed phrase and steal funds even as though the device is still able to pass authenticity checks.
Ledger has asked CryptoBilis to suspend sales and shipments of its devices as a precaution and advised customers who had purchased devices from the reseller within the past 90 days to consider transferring their assets to a new Ledger. “The volume of impacted devices is limited,” it said in its most recent update today.
CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Cybersecurity outlet Yfarmx estimated the losses at $93.4 million across 471 addresses, but this figure has not been confirmed by Ledger.
Security firm Veria Labs has been paid a $250,000 bug bounty for uncovering an overflow bug hidden in XRP’s code since 2015. It claims that a single transaction could have printed trillions of XRP out of thin air.
The bug has been patched and there is no evidence it had ever been exploited.
Cayden Liao, Veria Labs security co-founder, wrote on X that its AI agent had combed through rippled, the software that runs the XRP Ledger and found two low severity bugs. It worked out how to create a much larger exploit by using them in conjunction. Liao said that just one exploit transaction could have created more than 18 trillion XRP, which is 184 times greater than the total supply.
“This puts the full $94B at risk, more than 60 times the largest crypto hack on record,” he wrote, referring to XRP’s entire market cap. “We suspect one reason nobody caught this vulnerability is that it chains together two bugs that would be low severity on their own.” The bugs were reported on September 22 and RippleX patched them three days later.
Ethereum co-founder Vitalik Buterin has backed researcher Justin Drake’s warning that advances in artificial intelligence could undermine the cryptography used in today’s blockchains before quantum computers do.
Source
This article is syndicated for educational reading. For the latest updates, visit the original publisher.
Read on cointelegraph.com
