Ledger confirms hardware implant in some resold wallets behind crypto thefts

[CalmRanger]

Ledger has confirmed that some of its hardware wallets sold through a Malaysian reseller contained a hidden hardware implant that stole users' cryptocurrency. BleepingComputer reports that the devices came from CryptoBilis, a reseller operating across Southeast Asia. Researchers reportedly spotted implanted Ledger devices from 16 September, sold at almost half the price of the real thing

Ledger opened an investigation on 9 October and asked CryptoBilis to stop selling its products. On 10 October it confirmed an implant in at least one device. It later said all reported thefts were linked to CryptoBilis devices and described the number affected as limited

The technical details are alarming. Mark Karpelès, former CEO of Mt Gox, said the implant captured the display output and button presses to steal recovery phrases, then sent them out over LTE using an eSIM. Tibane Labs found two variants in devices bought on Amazon Japan and Yahoo Auctions Japan. One replaced the battery with a smaller one to make space for a microcontroller, a tiny eSIM and a shielded LTE module, while the other fitted where the display's foam padding sits

Ledger's built in authenticity check cannot detect implants like these if the original Secure Element is still intact. That is a sobering point, because it shows the limits of software checks against physical tampering. Ledger is advising affected users to move their funds to a new device with a new recovery phrase

The lesson is simple and worth repeating. Buy hardware wallets directly from the manufacturer or an authorised reseller, and be suspicious of prices that look too good to be true. A cheap wallet is not a bargain if it empties your savings

Where did you buy your hardware wallet? And should manufacturers do more to make tampering visible?

Ledger confirms spy chip implant behind wallet crypto theftswww.bleepingcomputer.com