Odaily reports that according to Pascal Gauthier's monitoring, all confirmed losses of funds in this incident involved Ledger signing devices sold through the Southeast Asian reseller CryptoBilis. Ledger confirmed on October 10 that one of the affected devices had been implanted with an unauthorized hardware implant, and there is currently no indication that Ledger's own infrastructure, systems, or services were compromised. CryptoBilis has stopped selling Ledger devices. Ledger's security team Donjon is examining recovered devices, cooperating with law enforcement, and contacting affected users.

Odaily News: According to Ledger monitoring, its security team Ledger Donjon is investigating Ledger signing devices (signers) sold by Southeast Asian distributor CryptoBilis. The batch of devices was implanted with unauthorized hardware components, and Ledger confirmed on October 10 that one user's device was affected. Ledger Donjon's analysis shows that the implant is located inside the device casing and can read the screen display contents, decode the 24-word recovery seed phrase during initial setup, and transmit it externally via a built-in eSIM and LTE. The component does not modify the secure chip, system, or transaction signing. Currently, all confirmed fund losses related to the incident disclosed on October 9 involve devices sold through CryptoBilis. CryptoBilis has stopped selling Ledger devices.

Odaily News: According to monitoring by SafePal's official customer service account, SafePal stated on October 10 that it is aware of reports of fund losses involving Ledger devices sold by reseller CryptoBilis, and is reminding SafePal users to verify three protective measures: device authentication during initialization, the first activation date reminder in the App, and tamper-proof packaging seals. These mechanisms are designed to help identify tampered or used devices. If any check appears abnormal, users should stop using the device and contact official support through the SafePal website or App.

Odaily reports: In response to user concerns on X, Trezor stated that it is actively investigating the situation. So far, it has not received any reports of tampered Trezor devices sold by reseller CryptoBilis, nor are there any indications that Trezor devices have been affected. As a precaution, Trezor has removed CryptoBilis from its reseller list and stopped selling products through it. Trezor reminds users not to forcibly open the device casing, as the built-in battery in Safe 7 makes disassembly a safety risk. If users have concerns, they should contact official support.

Odaily News: Blockaid co-founder Ido Ben-Natan stated that since the release of the H1 report in August, the number of onchain cybersecurity incidents has continued to hit record monthly highs. Attackers are profit-driven, and attacking onchain infrastructure offers the highest return on investment for hackers. As AI agents gain access to more capital, this trend will become even more severe. Ben-Natan also noted that Blockaid is currently in one of its busiest periods since inception, partly due to the significant increase in hacking attacks. Nansen CEO Alex Svanevik predicts that by 2028, trading crypto assets through AI agents rather than manually clicking through interfaces will become the norm.

Odaily News: Quit, Yuga Labs' Vice President of Blockchain, posted on X platform that as Blur announces it will discontinue its frontend on November 12, users are advised to immediately revoke NFT approvals to Blur smart contracts.Quit stated that their investigation has not yet found any exploitable vulnerabilities in Blur's existing contracts, but the contracts are upgradeable and carry the risk of malicious modification in the future. Currently, NFTs worth at least $10 million remain approved to Blur contracts, and their security depends on the Blur team's operational security capabilities. Quit recommends users revoke relevant approvals through tools such as revoke.cash to guard against potential contract attacks or malicious upgrade risks.

Odaily: Starknet posted on X stating that most blockchains do not have quantum security plans and can only respond by migrating funds; its network supports upgrading cryptographic schemes without changing user addresses and without migrating funds, which it calls "cryptographic agility" for addressing quantum risks. Starknet says it has compared the quantum security readiness of 10 networks.

Odaily News: According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update fixing vulnerabilities that could allow malicious nodes to steal funds. The most severe vulnerability involves Lightning channel reconnection. According to Bitcoin Optech, malicious nodes could falsely claim they did not receive previously confirmed channel updates. The vulnerable LDK software could then sign conflicting commitment transactions without properly recording the relevant transactions, allowing attackers to reclaim Bitcoin after forwarding payments are completed. LDK versions 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.

Odaily reports: Arravind Prabu, former head of crypto hardware wallet reseller CryptoBilis, has issued a statement regarding the recent security incident involving CryptoBilis and Ledger, denying any connection to the matter.Arravind stated that CryptoBilis was previously acquired by a new team, and that he and Vimalatheethan formally handed over all operational, management, and administrative responsibilities of the company in March 2026. Since the handover was completed, neither individual has had any access or administrative control over the company's backend systems, customer databases, order records, or corporate communication channels. (Cointelegraph)

Odaily reports that Ontology has announced the conclusion of its investigation into a security incident involving an ecosystem project, and its mainnet has resumed block production and returned to normal operation. Ontology's core network infrastructure remains secure, and no funds were lost on the network itself. The previous suspension of block production was a precautionary measure taken by Ontology in coordination with consensus nodes to facilitate the investigation and mitigate potential risks.