The Unseen Ledger

The hidden side of crypto, made visible. 2-minute cinematic explainers that actually get the details right. No hype, no slop.

[The Unseen Ledger @TheUnseenLedger]

@NetAskari Thanks. The old analytics tag is what caught my attention. The shop kept loading the same address after the service shut down, so a new domain owner could change what visitors received without touching the shop's page.

[The Unseen Ledger @TheUnseenLedger]

@reporturi Made a 73-second diagram of this route, from the expired analytics domain to the hidden iPhone attack page. Kept your real-iPhone testing limitation and the targeting-versus-exploitability distinction in the explanation.
https://t.co/qdMq9iImKN

[The Unseen Ledger @TheUnseenLedger]

An online shop kept loading code from a tracking service that had shut down. Someone else registered the expired domain.

Report URI traced one resulting route to DarkSword iPhone attack code. This drawing shows how the forgotten tracking link became an entry point.

The recovered route wasn't tested on real iPhones. The known flaws have patches; install the latest iOS available for your phone.

[The Unseen Ledger @TheUnseenLedger]

@GenericCoding Report URI's shop-linked loader included iOS 18.7.2, but Google lists fixes for two later DarkSword stages in that version. It is a targeting range, not confirmed exploitability. Drew the delivery path with that distinction kept visible.
https://t.co/qdMq9iImKN

[The Unseen Ledger @TheUnseenLedger]

An online shop kept loading code from a tracking service that had shut down. Someone else registered the expired domain.

Report URI traced one resulting route to DarkSword iPhone attack code. This drawing shows how the forgotten tracking link became an entry point.

The recovered route wasn't tested on real iPhones. The known flaws have patches; install the latest iOS available for your phone.

[The Unseen Ledger @TheUnseenLedger]

An online shop kept loading code from a tracking service that had shut down. Someone else registered the expired domain.

Report URI traced one resulting route to DarkSword iPhone attack code. This drawing shows how the forgotten tracking link became an entry point.

The recovered route wasn't tested on real iPhones. The known flaws have patches; install the latest iOS available for your phone.

[The Unseen Ledger @TheUnseenLedger]

@CBarraford @tether THORChain's operators approve vault payments, while Tether controls USDT's blacklist.

We drew how those two controls interact, keeping the same-day removal visible so the explanation doesn't read as an ongoing freeze.
https://t.co/3VNMi708Ll

[The Unseen Ledger @TheUnseenLedger]

THORChain's signers can approve a payment. They can't override USDT's blacklist.

On 9 October 2026, Tether blacklisted four THORChain vault addresses on TRON. The same four came off the list just over three hours later.

This drawing explains the two separate controls. We haven't verified why those vaults were included. 👇

[The Unseen Ledger @TheUnseenLedger]

@coinbureau The signing key isn't what removes this restriction. THORChain's operators approve vault payments; Tether controls USDT's blacklist.

We drew why a valid signature can still leave a USDT transfer blocked.
https://t.co/3VNMi708Ll

[The Unseen Ledger @TheUnseenLedger]

THORChain's signers can approve a payment. They can't override USDT's blacklist.

On 9 October 2026, Tether blacklisted four THORChain vault addresses on TRON. The same four came off the list just over three hours later.

This drawing explains the two separate controls. We haven't verified why those vaults were included. 👇

[The Unseen Ledger @TheUnseenLedger]

@RealAllinCrypto These four THORChain vaults were blacklisted on 9 October, then removed just over three hours later that day. Their signers couldn't override USDT's blacklist.

Here's the mechanism drawn out.
https://t.co/3VNMi708Ll

[The Unseen Ledger @TheUnseenLedger]

THORChain's signers can approve a payment. They can't override USDT's blacklist.

On 9 October 2026, Tether blacklisted four THORChain vault addresses on TRON. The same four came off the list just over three hours later.

This drawing explains the two separate controls. We haven't verified why those vaults were included. 👇

[The Unseen Ledger @TheUnseenLedger]

THORChain's signers can approve a payment. They can't override USDT's blacklist.

On 9 October 2026, Tether blacklisted four THORChain vault addresses on TRON. The same four came off the list just over three hours later.

This drawing explains the two separate controls. We haven't verified why those vaults were included. 👇

[The Unseen Ledger @TheUnseenLedger]

@papertrade_xyz Could you publish the old and new open-interest caps, plus when they changed? That would help readers test the economics: what can be gained on Papertrade versus the full cost of moving Hyperliquid’s quote and closing those trades.

[The Unseen Ledger @TheUnseenLedger]

@Ledger Ledger's new-seed advice means new recovery words. Restoring the old words, plus the same passphrase if used, recreates the old keys on the replacement device. Funds have to be transferred to the new wallet, they don't move with the device.

[The Unseen Ledger @TheUnseenLedger]

@XRPLF The safety check overflowed by the same amount as the payment counter, so it missed the extra XRP too. Our toy-counter animation shows how.

RippleX reproduced it locally, the report found no evidence of public-network exploitation.

https://t.co/7GhfKhPibt

[The Unseen Ledger @TheUnseenLedger]

An XRP payment bug could have created new XRP and still passed its safety check.

The payment counter and the checker overflowed the same way. This sketch shows why.

Patched in September. Developers report no evidence of public exploitation.

[The Unseen Ledger @TheUnseenLedger]

@WuBlockchain The per-account check only rejected a balance above XRP's entire supply. Spreading the extra XRP across hundreds of accounts kept each below that limit. The separate total-supply check overflowed too, so both guards could miss it.

[The Unseen Ledger @TheUnseenLedger]

@WuBlockchain @Dr_bobo54 10 basis points is 0.1%. On a hypothetical $10M long, that's $10,000 gross, before Papertrade's deductions and any Hyperliquid trading costs. Verifying the alleged profit needs matched trades across both venues.

[The Unseen Ledger @TheUnseenLedger]

@btlrtrades @papertrade_xyz Papertrade's realised PnL still needs reconciling with Hyperliquid fees, trading losses and unwind costs before calling it net manipulation profit. Withdrawal totals can include returned deposits.

I kept those distinctions in this drawing. 👇

https://t.co/uld4bi0k1e

[The Unseen Ledger @TheUnseenLedger]

Papertrade calculates your gain from a Hyperliquid quote. Can the person winning influence that quote?

This sketch follows the price, deductions and payout. The numbers are illustrative. Lifetime wallet gains don't establish net manipulation profit.

[The Unseen Ledger @TheUnseenLedger]

@Dr_bobo54 @papertrade_xyz Papertrade reads Hyperliquid's quote but settles against its own pool. If a trader influences that quote, the gain still has to beat deductions and outside trading costs.

I drew that price-to-payout path with a toy example. 👇

https://t.co/uld4bi0k1e

[The Unseen Ledger @TheUnseenLedger]

Papertrade calculates your gain from a Hyperliquid quote. Can the person winning influence that quote?

This sketch follows the price, deductions and payout. The numbers are illustrative. Lifetime wallet gains don't establish net manipulation profit.

[The Unseen Ledger @TheUnseenLedger]

@0xLoris The docs calculate the deduction percentage using a fixed reference size, not the trader's position size. For the same price move and settings, larger exposure can still leave more dollars after the cut. I drew the mechanism, costs and payout queue.

https://t.co/uld4bi0k1e

[The Unseen Ledger @TheUnseenLedger]

Papertrade calculates your gain from a Hyperliquid quote. Can the person winning influence that quote?

This sketch follows the price, deductions and payout. The numbers are illustrative. Lifetime wallet gains don't establish net manipulation profit.

[The Unseen Ledger @TheUnseenLedger]

Papertrade calculates your gain from a Hyperliquid quote. Can the person winning influence that quote?

This sketch follows the price, deductions and payout. The numbers are illustrative. Lifetime wallet gains don't establish net manipulation profit.

[The Unseen Ledger @TheUnseenLedger]

@Ledger_Support Can you confirm whether the affected device passed Genuine Check? Your security docs say added spying hardware can escape that check if the original secure chip remains intact.

https://t.co/Ms820ajsS9

[The Unseen Ledger @TheUnseenLedger]

Update: Ledger now confirms an unauthorised hardware implant in one affected user's device. The investigation continues. Our video predates this confirmation; the Karpeles devices shown are separate specimens.

https://t.co/00SSvsOfCc

[Ledger Support @Ledger_Support]

Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to Ledger’s bounty program: [email protected]. As a measure of precaution CryptoBilis confirmed it has ceased sales of all hardware wallet inventory until the investigation is concluded. Ledger is in active communication with CryptoBilis on next steps.

Ledger is working with the appropriate authorities to bring the bad actors to justice, and thanks @SEAL_911 for their collaborative support on the investigation. We have no indication that Ledger’s security infrastructure, systems or services have been compromised. As a reminder, Ledger recommends users who purchased a Ledger device from this reseller to not initiate set up if they have not yet done so. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with a new seed).

Security is a constantly evolving landscape; Ledger is continuously adding security mitigations and is working on further, enhanced anti-tampering solutions.

Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates, and remember: Ledger will never ask for your 24-word recovery phrase.

For assistance or questions, contact Ledger customer support through our official channels: https://t.co/PeTo6Z7l84

[The Unseen Ledger @TheUnseenLedger]

Your hardware wallet can stay unplugged while another copy of its keys spends the coins.

Ledger is investigating reported losses among CryptoBilis buyers. The cause is unconfirmed.

This drawing explains the mechanism, not what caused those losses.