Lasers. Microscopes. $250K. One secured chip. Ledger Donjon just showed how they cracked debug access on RP2350-A4, a break worthy of Raspberry Pi's own Hacking Challenge. Respin or no respin? Raspberry Pi says no. Read why: raspberrypi.com/news/everyth…

No Ledger user was hacked. What's described here is a lab reproduction of a vulnerability in an outdated version of the Ethereum app. The issue was already identified through our security process and fixed in Ethereum app 1.22.2, released August 13, before this post. The security bulletin has been public since then: donjon.ledger.com/lsb/. There is no evidence of exploitation in the wild. A word on how this works, because it matters: All software has bugs. Hardware wallets are no exception. That's why updateability is a core part of Ledger's security architecture: when a vulnerability is found, whether by our own Donjon team or by external researchers, we can patch every device in the field. A wallet that can't be updated can't be fixed. This is a process we run continuously, not a one-off. We ship regular security updates, publish a security bulletin on the Ledger Donjon site donjon.ledger.com, and work with external researchers through our bug bounty program. That track record, finding, fixing, and disclosing, is what security maturity looks like. The alternative isn't wallets without bugs; it's wallets where you never hear about them. What to do: update your firmware applications to the latest available and Ethereum app to 1.22.3+ via Ledger Wallet, and verify the app version on your device, not just the firmware. Apps and firmware update separately.

🚨 All it takes is one website and your crypto disappears: Coruna may be the EternalBlue moment for iOS exploits. For years, large-scale exploitation of iPhones was considered impractical. Coruna proves otherwise. Recently exposed by the Google Threat Intelligence Group, Coruna is a modular, state-grade iOS exploit kit that shows how sophisticated cyber capabilities developed by governments or surveillance actors can eventually leak into criminal ecosystems. The framework contains five complete exploit chains built from 23 vulnerabilities targeting Apple devices. These chains combine: - WebKit remote code execution - Privilege escalation - PAC (Pointer Authentication) bypass (!!) - Sandbox escape - Page Protection Layer bypass Together, they enable full compromise of an iPhone from a simple website visit. The implications are immediate. Coruna has already been used primarily for cryptocurrency theft. The attack path is brutally simple: your keys sit in a software wallet on your iPhone, you visit a compromised website, and your crypto is gone. Once inside the device, the malware can: - Steal assets from software wallets - Extract seed phrases stored in Apple Notes or in your photos - Harvest photos, emails, and other sensitive data Researchers observed the toolkit targeting 18 cryptocurrency apps, including MetaMask, Trust Wallet, and Exodus Wallet. Coruna works out of the box against devices running iOS 13 through iOS 17.2.1, covering releases from 2019 to 2023. That represents hundreds of millions of potentially vulnerable devices worldwide. So far, researchers estimate that tens of thousands of iPhones have actually been infected. More recent iOS versions are also actively targeted by nation-state actors, though not exploited yet at this scale. But the trajectory is clear: as exploit development accelerates, particularly with the assistance of AI, these capabilities will become cheaper and more widely available. Large-scale mobile compromise will become more common. The lesson is straightforward: Storing valuable secrets on general-purpose devices is fundamentally risky. When a single browser visit can compromise the entire mobile phone, relying on software wallets to protect high-value assets is no longer a defensible security model. For those interested by the technical details, I recommend this excellent report from Google Threat Intelligence group. cloud.google.com/blog/topics…