A Tampered Ledger in Europe, a $94B XRP Bug, and a $250K Bounty
Someone bought a Ledger from a major European retailer and got a compromised device. In the same week, researchers used AI to find an XRP bug worth $94 billion in potential exposure, and got paid $250,000 for it. Both stories point at the same weak spot: trust.
A user in Europe says they walked into a major retailer, bought a Ledger hardware wallet, and got a tampered device. That's the part worth sitting with. Not a phishing email. Not a fake app. A sealed box, on a shelf, in a store.
Same week, security researchers leaned on AI to dig through XRP's code and surfaced a bug they say could've exposed roughly $94 billion in value. They disclosed it the right way. The payout came to $250,000.
Do the math on that. $250K against $94 billion works out to about three ten-thousandths of a percent. Bug bounties are supposed to price risk. Right now they price paperwork.
The Ledger report is the scarier one, honestly. Software bugs get patched. Retail supply chains are physical, slow, and mostly unaccounted for. And in Latin America, where plenty of people buy hardware wallets through marketplace resellers instead of straight from the manufacturer, that gap gets wider. In Buenos Aires, stablecoins aren't speculation. They're survival. So the device holding those savings has to be as trustworthy as the receipt in your pocket.
XRP's whole pitch is the remittance corridor, which makes a $94 billion bug a personal problem for anyone sending money home to family. The corridor is where crypto actually works. It's also where a single line of bad code travels fastest.
Ledger's own rules are simple and people keep skipping them. Buy direct when you can. Check the packaging for signs of resealing. Never trust a device that arrives with a recovery phrase already written down, because legitimate ones never ship that way, ever.
The bounty number says something else too. When a network with tens of billions at stake pays out less than a quarter million for a catastrophic find, the incentive to sell that bug quietly to someone else gets a lot stronger.
Watch what retailers do next. If a big-box store can't prove a Ledger box hasn't been opened, the whole buy-it-at-the-mall pitch falls apart.
Explore More
Key Terms Explained
A reward offered by crypto projects for completing specific tasks like finding bugs, writing code, or creating content.
A physical device that stores cryptocurrency private keys offline.
A record of transactions.
A social engineering attack where scammers create fake websites, emails, or messages that look legitimate to steal your credentials or trick you into signing malicious transactions.