Ledger links at least $86 million in crypto thefts to a hardware implant in devices sold by one reseller
A small circuit board hidden under the screens of signers sold through Southeast Asian reseller CryptoBilis captured user data and sent it to the attackers.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Ledger has confirmed that some of its signers, the offline hardware devices used to approve cryptocurrency transactions, were fitted with an unauthorized hardware implant. The tampered devices were sold through CryptoBilis, a Malaysia-based reseller operating across Southeast Asia. SecurityWeek reports that the implant is tied to the theft of at least $86 million in cryptocurrency from multiple users. The implant is a small circuit board hidden under the device screen that read user data and sent it to the attackers. It appears that someone in the distribution chain soldered it in by hand. Ledger opened an investigation on October 9 after users reported losing funds. It asked CryptoBilis to stop selling its devices and confirmed tampering on at least one device the next day. On October 13, it said every confirmed loss involved a signer sold through CryptoBilis. BleepingComputer reports that researchers had shown the implant as early as September 16, and that the tampered devices sold for nearly half the normal price. Ledger is advising anyone who bought from the reseller in the past 90 days not to set up the device, or, if they already have, to move their assets to a new signer with a new seed. The case shows that supply-chain tampering can defeat hardware that is meant to keep keys offline.