Blockchain news and engineering summaries

Ledger confirmed that compromised devices sold through Southeast Asian reseller CryptoBilis contained a hardware implant linked to cryptocurrency wallet thefts. At least one Ledger device was tampered with, and Ledger said all reported unexpected fund drains involved CryptoBilis-sold devices. Researchers found two Ledger X implant variants using an MCU, eSIM, and LTE module to capture displays and button presses, enabling seed-phrase theft. Ledger advises affected users not to set up devices or to move assets to a new signer with a new seed.

A major supply chain attack compromised over 30 WordPress plugins from the 'Essential Plugin' library. After being sold on Flippa to a commercial buyer, the plugins were updated with a dormant backdoor that triggered months later, using blockchain-based command-and-control to inject spam. WordPress.org eventually closed the plugins, but users must manually clean their compromised wp-config.php files.

QM is a collaborative multiplayer agent platform for startups, allowing employees to manage isolated workspaces while collaborating in Slack and on the web. It supports various LLM models, provides granular admin security, and executes tasks in durable sandboxes. QM is designed for deployment in private clouds, ensuring internal data privacy and tool interoperability.

PeerWeb is a decentralized website hosting platform that leverages WebTorrent technology to distribute content across a peer-to-peer network. By removing the dependency on centralized servers, the platform ensures that websites are censorship-resistant and maintain high availability through community seeding. Users can easily host sites by dragging and dropping folders, which generates a unique torrent hash. PeerWeb includes advanced features like smart caching for improved performance, debug modes for developer troubleshooting, and security measures integrated via DOMPurify. Its architecture represents a significant shift toward a decentralized web, where magnet links and trackers replace traditional hosting infrastructures.

A malicious pull request in the Egonex-AI/Understand-Anything repository uses a supply chain attack targeting Astro’s build pipeline. The attacker hides an obfuscated payload in astro.config.mjs, which executes during build or dev processes. It beacons C2 servers and uses Tron/BSC blockchain transactions as a command-and-control relay to fetch and execute secondary payloads, mirroring the PolinRider campaign.

Researchers discovered a social engineering campaign targeting finance and crypto sectors using a malicious Obsidian vault. Victims are tricked into enabling community plugins, triggering the PHANTOMPULSE RAT. This malware features a sophisticated blockchain-based C2 mechanism for resilience, enabling full system control on Windows and macOS. Defensive measures include plugin restrictions and user training.

On-chain investigator zachxbt has publicly identified an individual known online as 'Lick' as John Daghita, allegedly involving him in cryptocurrency theft. Following the exposure, Daghita attempted to erase his Telegram history and sent unsolicited funds from a theft-linked address to zachxbt's public wallet. The investigation highlights a significant conflict of interest, as John Daghita is the son of Dean Daghita, owner of Command Services & Support (CMDSS). CMDSS recently secured a contract with the US Marshals to manage seized cryptocurrency assets. In response to the allegations, CMDSS scrubbed its digital presence, raises serious questions regarding the vetting process for government contractors handling sensitive digital assets and the Department of Justice's oversight of their service providers.

Freenet is a peer-to-peer decentralized platform that enables unstoppable communication, collaboration, and commerce. By utilizing open protocols and a small-world network, it eliminates the need for central servers. Developers can build serverless, cloud-free applications using Rust and TypeScript, while users benefit from private, censorship-resistant, browser-based web experiences.

Monero uses RandomX for its proof of work, a mechanism designed to be CPU-friendly by executing random programs on a specialized virtual machine. Unlike Bitcoin's SHA-256, which favors ASICs, RandomX forces miners to utilize memory-intensive operations, floating-point math, and branch handling, effectively neutralizing the advantage of specialized mining hardware to ensure network decentralization.

Codeberg is facing internal debate over a proposed ban on cryptocurrency projects for the upcoming Assembly 2026. Critics argue that outlawing an entire technology category sets a dangerous precedent and unfairly targets legitimate software, while others cite reputation concerns related to fraud and high-risk investments associated with the crypto industry.

Bitcoin miners face a crisis, with average production costs of $88,000 against a $69,200 market price. Rising energy costs from geopolitical tensions have caused hashrate drops and a 7.76% difficulty decline. Many miners are diversifying into AI and high-performance computing to mitigate losses as forced liquidations continue to impact the market structure.

The emergence of 'Pump and Dump Software' represents a cynical convergence of generative AI and cryptocurrency scams. Following the 2025 boom in 'vibe coding'—where large language models allow individuals to generate massive amounts of code without deep technical understanding—a new fraudulent pattern has emerged. Developers create unmaintainable, AI-generated software blobs at a high token cost, then partner with crypto entities to launch associated shitcoins. Through aggressive astroturfing and FOMO-driven marketing, they lure unsuspecting users and investors before liquidating the currency and abandoning the project. This cycle exploits the rapid pace of the tech industry, leaving users with broken tools and investors with worthless tokens. Projects like 'gastown' and Clawdbot are cited as examples of this deceptive trend, highlighting the need for critical evaluation of hyped AI tools.

Prediction markets like Polymarket are emerging as significant national security risks. Suspiciously timed bets preceded military strikes in Iran and Venezuela, suggesting potential insider trading by individuals with classified knowledge. While these platforms offer forecasting signals, they also allow adversaries to anticipate secret operations, potentially leading to retaliation or Compromised military objectives through financial incentives.

Attackers have implanted Ledger Nano X, Flex, and possibly Stax wallets sold through unauthorized and authorized resellers, stealing about $102 million from roughly 315 CryptoBilis-linked accounts. The implants capture wallet recovery seed phrases through added circuitry, antennas, LTE modules, and eSIMs, then transmit them to remote servers. Researchers found increasingly sophisticated, production-oriented designs, including devices sold by MediaMarkt. Ledger says its systems were not breached and is investigating, but the perpetrators and supply-chain entry point remain unknown.

A cryptographically-relevant quantum computer (CRQC) poses an existential threat to Bitcoin by breaking current signature schemes. While the exact timeline is uncertain, the risk necessitates proactive planning. The upgrade requires complex consensus changes, wallet migrations, and ecosystem coordination. Experts argue that prioritizing post-quantum cryptographic development is essential for Bitcoin's long-term survival and security.

Y Combinator, the world-renowned startup incubator, has announced a significant shift in its funding strategy by offering its spring cohort the option to receive their $500,000 investment in USDC, a stablecoin issued by Circle. This move, led by visiting partner Nemil Dalal, reflects a growing commitment to on-chain capital raising and the broader crypto ecosystem. Founders can choose to receive these tokens across multiple blockchains, including Ethereum and Solana. Despite the current volatility in the broader cryptocurrency market, stablecoins are increasingly viewed as essential financial infrastructure for modern startups. This transition aligns with major industry moves, such as Stripe's acquisition of Bridge and interest from tech giants like Cloudflare. Y Combinator aims to institutionalize stablecoin use for its operational speed and lower transaction costs, signaling a future where blockchain-based funding becomes standard for tech entrepreneurs globally.

HardenedBSD has begun migrating its code repositories to Radicle, a decentralized code collaboration platform. While core functionality is operational, including basic ports tree integration, the project is still addressing performance tuning for large repositories. Users can now seed and clone official HardenedBSD repositories from their dedicated node infrastructure.

Criminals have sold modified Ledger Nano X hardware wallets containing a hidden eSIM-based LTE implant that captures seed phrases from the screen and transmits them remotely. The implant leaves the Secure Element untouched but intercepts its display signal, recognizes characters, and uses an LTE modem, antenna, and the wallet’s battery to call home. Observers say more than 300 wallets lost about $93 million. Ledger warns Cryptobilis buyers to stop using devices; newer versions are professionally mass-produced and hard to detect.

The fil-qt repository is a specialized C++ framework tailored for local development workflows within the Filecoin ecosystem. It leverages the Qt framework to provide a cross-platform graphical user interface for managing Filecoin actors and network interactions. Key features include tools for visualizing state transitions, debugging smart contracts, and streamlining the deployment process for developers working on the Filecoin Virtual Machine (FVM). By integrating these technical components, the project aims to lower the barrier to entry for building decentralized applications and maintaining robust nodes in a local testing environment.

The ATProto architecture faces a critical security vulnerability because Personal Data Server (PDS) operators hold user signing and rotation keys. This allows operators to impersonate users across the entire ecosystem or lock them out entirely. To improve sovereignty, users should be prompted to enroll self-controlled rotation keys by default to mitigate trust-based centralization risks.