Keystone is destroying 18,835 crypto wallets. A hacker stole the key that certifies they're authentic. As a result, fake wallets could pass official verification and steal your funds.
On top of that, 25,964 customer records exposed… even though the company had long promised to delete them. The deletion tool was broken.
Your seed phrases? Not affected, according to Keystone. But if you received a wallet after October 20: verify it before using it.
Some speculate that Karpelès's public warning (approximately 90,000 views) may have alerted the attacker, prompting them to accelerate the transfer of funds from multiple wallets. However, this link has not been confirmed.
5. Recommendations for Users
For users who purchased a device from CryptoBilis within the last 90 days:
1. Not yet configured: do not proceed with initialization 2. Already configured: consider transferring assets to a new device, using an entirely new recovery phrase 3. Suspected tampering: avoid entering an existing recovery phrase into any unverified software or website
General advice: purchase hardware wallets through authorized official channels, and verify the authenticity of the device according to official procedures upon receipt.
6. Scope of the Incident
If the $86 million estimate is confirmed, this would be one of the most serious incidents ever linked to a hardware wallet's distribution chain. The essential difference, however, lies in the fact that this is an attack at the reseller level, and not a flaw affecting Ledger's entire systems or product line.
Ledger states that the investigation is ongoing and that it will publish updates as it progresses.
CryptoForge
·
--
Binance founder CZ commented that the evidence points toward a localized supply chain attack targeting a single vendor, rather than a flaw affecting Ledger's entire product line.
3. Unusual Changes at CryptoBilis
3.1 Change of Ownership
Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.
The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.
3.2 Link to the Attack Not Established
At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.
4. Mark Karpelès's Discovery of an Implanted Module
Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.
4.1 Technical Details
The module was concealed in the location of the screen's original padding, and included the following components:
· An LTE communication component · An antenna · An eSIM · A microcontroller, connected to the Ledger's SPI bus
4.2 Attack Principle
According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.
Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.
Binance founder CZ commented that the evidence points toward a localized supply chain attack targeting a single vendor, rather than a flaw affecting Ledger's entire product line.
3. Unusual Changes at CryptoBilis
3.1 Change of Ownership
Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.
The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.
3.2 Link to the Attack Not Established
At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.
4. Mark Karpelès's Discovery of an Implanted Module
Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.
4.1 Technical Details
The module was concealed in the location of the screen's original padding, and included the following components:
· An LTE communication component · An antenna · An eSIM · A microcontroller, connected to the Ledger's SPI bus
4.2 Attack Principle
According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.
Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.
Le projet de loi sur la structure du marché crypto le plus attendu n'a pas obtenu les 60 voix nécessaires pour franchir la motion de clôture. Le vote s'est soldé par un échec à 50 contre 49, repoussant probablement le processus législatif à 2027.
🗣️ La bataille de Warren. Elizabeth Warren a qualifié les dispositions éthiques du texte de « feuille de vigne dérisoire ». Selon elle, la version actuelle affaiblit les protections financières et pourrait préparer les conditions d'une nouvelle crise à la 2008. Son cheval de bataille principal : les conflits d'intérêts liés aux activités crypto de Trump, estimés à plus d'un milliard de dollars pour le président et sa famille l'an dernier.
🔄 Ce que ça signifie vraiment. Ce n'est pas un vote « pour ou contre la crypto ». C'est un désaccord sur qui fixe les règles, et dans l'intérêt de qui. Les défenseurs du texte estiment qu'un cadre fédéral clair réduirait justement les risques. Mais pour l'instant, la SEC et la CFTC continueront d'avancer via leurs propres pouvoirs — des règles réversibles à chaque changement d'administration.
Le combat pour un cadre durable n'est pas terminé. Il est juste reporté.
L’indice de l’altseason est souvent mal compris. Beaucoup pensent qu’il indique automatiquement une saison haussière des altcoins, alors que son mode de calcul est bien plus nuancé.
Concrètement, cet indice mesure la performance des 100 principales altcoins sur une période de 90 jours, en les comparant à la performance du Bitcoin sur la même période.
Lorsque l’indice affiche 17, cela signifie que 17 altcoins du top 100 ont surperformé le Bitcoin sur les 90 derniers jours.
À l’inverse, un indice élevé (par exemple 92) signifie que 92 altcoins ont fait mieux que le Bitcoin, mais cela ne veut pas forcément dire que le marché est haussier.
Point fondamental à comprendre : 👉 Surperformer le Bitcoin ne signifie pas être en hausse.
Si le Bitcoin chute fortement et que certaines altcoins chutent moins que lui, elles sont considérées comme « plus performantes » dans le calcul de l’indice. Ainsi :
Vous pouvez être globalement en perte,
Tout en voyant l’indice d’altseason monter fortement.
Dans certains cas extrêmes, l’indice peut même approcher 90 ou plus, simplement parce que le Bitcoin corrige plus violemment que le reste du marché — sans qu’il n’y ait de véritable altseason.
L’indice d’altseason est un indicateur statistique, pas un signal de marché suffisant à lui seul. Il peut aider à lire une tendance relative, mais il ne doit jamais servir de base unique pour prendre une décision d’investissement ou de trading.