Ledger confirmed that a hardware wallet sold through the reseller CryptoBilis contained an unauthorized hardware implant, following reports of stolen funds from buyers in Southeast Asia. A pseudonymous blockchain investigator put losses above 86 million dollars, while Ledger described a limited number of affected devices, all sold through that reseller. Ledger paused sales through CryptoBilis, which halted all hardware wallet sales pending the investigation. Ledger advised buyers from the past 90 days not to set up unconfigured devices, and to move assets to a new signer with a fresh seed if a device was already initialized. Users should avoid unauthorized resellers.
iVerify detailed P7 DarkSword, a new variant of the commercial DarkSword iOS exploit kit that has circulated among financially motivated and other actors since late 2025. It reduces its on-device footprint and adds on-device keychain and cryptocurrency wallet theft plus two-way command-and-control, running inside SpringBoard and polling for commands every 15 seconds. Collected data includes iCloud Keychain, Apple Notes, Photos, and wallet contents, with commands for disk, wallet, and photo scanning and file transfer. The chain exploits WebKit and Core Audio flaws, CVE-2025-24201 and CVE-2025-31200, patched in earlier iOS releases, and is distributed through fake websites, poisoned analytics domains, and bogus crypto platforms.
TrustStrike Labs