When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
In a separate post, Ledger CEO Pascal Gauthier said, “Physical supply chain tampering is a risk for the whole industry. We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can,” confirming the company's plan to review its chain-of-custody and tamper detection practices. The company is inviting researchers and other vendors to collaborate in assessing these practices.
The incident that prompted the reviews was first noticed on Friday, October 9, when hundreds of otherwise secure wallets drained simultaneously across the Bitcoin, Ethereum, and Tron networks, triggering a massive alert across social media and blockchain security networks. Several victims came online to report losses and try to figure out what was happening. Early investigation revealed that almost all the affected wallets had been procured from CryptoBilis, an authorized third-party reseller covering Malaysia and Southeast Asia. Ledger ordered CryptoBilis to immediately halt all sales and shipments.
After further investigation, Ledger officially announced on October 10 that it had discovered a physical, unauthorized hardware implant equipped with a cellular/LTE module inside an affected user's device. It turns out that the attackers had manually installed the chips in brand-new devices at some point in the supply chain. When a new user is generating or verifying their 24-word recovery seed phrase on the wallet's screen during initial setup, the rogue chip records the OLED output or reads the raw hardware data lines carrying the text.
The integrated cellular chip then silently transmits the unencrypted recovery phrase over LTE networks directly to the attackers' external command servers, granting them full remote access to clone the private keys and drain the associated cryptocurrency funds. The hardware modification completely bypassed Ledger's standard automated “Genuine Check” software protocol, as it sat entirely outside the microchip running Ledger's standard firmware.
Store-bought hardware crypto wallets had secret chips installed that enabled stealing crypto recovery phrases
Hackers drain $320 million in Bitcoin from Liquid Network, emptying roughly 95% of federation wallet
Hacker turns 25 cents into 46 billion fake Bitcoins to steal $770,000
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cryptocurrency/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cryptocurrency/ledger-to-review-sales-and-anti-tamper-policies-after-usd93-million-hardware-wallet-supply-chain-attack-rogue-lte-implants-reportedly-stole-users-recovery-phrases#main
- https://www.tomshardware.com/membership
- TSMC confirms it is considering Terafab chipmaking expansion with Elon Musk
- Fall Into 25 New Games on GeForce NOW This October
- Rally Up: ‘Gears of War: E-Day’ Launches on GeForce NOW
- All Systems Go: Global PC App Ecosystem Ready for NVIDIA RTX Spark
- NVIDIA Expands Advanced Technology Access for Europe’s Scientific Community Through Open Learning Resources, Collaborations and Compute
Informational only. No financial advice. Do your own research.