An extensive investigation initiated by Ledger on October 10 has unveiled the presence of a malicious hardware implant within a cryptocurrency wallet sold by Southeast Asian reseller CryptoBilis. This alarming discovery may potentially lead to losses estimated at over $86 million.
summary
The investigation revealed that one affected device from CryptoBilis housed a “rogue hardware implant.” Following this finding, CryptoBilis has suspended the sale of all hardware wallets while Ledger assesses the situation and contacts affected customers. Blockchain expert Mark Karpeles has highlighted findings of an unusual electronic device hidden behind the display of a Ledger Nano X in Malaysia. While Bitquery’s analysis suggests possible losses have amounted to $92.9 million over 311 wallets, Ledger has not validated this figure.
According to Ledger’s official communication, the modified device identified during their ongoing investigation belonged to a user impacted by this alarming security breach. The company stated that CryptoBilis has paused all hardware wallet sales as they actively engage with authorities to resolve the situation. Ledger has also advised customers who have purchased devices from CryptoBilis to refrain from setup and indicated that a new recovery phrase should be utilized by others.
This incident follows previously issued warnings regarding potentially compromised wallets distributed by resellers, presenting evidence of physical tampering in at least one case.
Discovery of a Rogue Implant
As investigations progressed, Ledger’s findings included additional electronic components in the wallets of affected users. The company specifically labeled one of the components as a “rogue hardware implant,” although they did not disclose details about the model, installation process, or data transmission capabilities of the device.
In light of these revelations, Ledger’s security team is actively investigating the incident while reaching out to customers potentially affected by the compromised devices. The precise number of wallets subjected to similar alterations has yet to be confirmed.
The issue came to light when reports emerged about fraudulent transactions involving users who had procured Ledger products through CryptoBilis, which operates in countries including Indonesia and Malaysia. Following mounting complaints, Ledger launched its investigation and recommended halting sales and shipments of the implicated devices.
The current estimates of financial losses vary: initial reports suggested over $72 million, with later assessments indicating figures as high as $86 million; however, Ledger has refrained from officially confirming any specific amount. Despite the magnitude of the situation, the company reiterated that there was no evidence indicating a breach of their internal systems or security protocols.
“There is no indication that Ledger’s security infrastructure, systems, or services have been compromised,” the company asserted.
In response to these vulnerabilities, manufacturers are crafting additional defenses against physical tampering to fortify device security, while investigations delve into how the harmful component infiltrated the impacted wallets.
Suspension of Hardware Wallet Sales by CryptoBilis
Following Ledger’s critical findings, CryptoBilis has publicly announced a complete halt on the sales of all its hardware wallet inventory.
This suspension encompasses all products distributed by the company and extends beyond Ledger’s previous advisory. As of an October 10 report from TokenPost, CryptoBilis aims to maintain this suspension until the investigation concludes.
Ledger is facilitating ongoing communications with its resellers regarding the incident and subsequent actions. Customers who have purchased devices from CryptoBilis are being advised not to initiate setup unless previously done.
For individuals who have already utilized the compromised devices, Ledger recommends migrating their cryptocurrencies to a new hardware wallet initialized with a fresh recovery phrase. This step is crucial as transferring the existing recovery phrase does not mitigate the risk of it being exposed through the original hardware.
The company has also opened a channel for individuals with relevant information to contact them and has engaged with law enforcement, collaborating with the Security Alliance’s SEAL_911 Incident Response Initiative for further assistance.
Uncovering Tampering with Ledger Devices
Prior to Ledger’s acknowledgment, Mark Karpeles, the former CEO of Mt. Gox, disclosed an investigation into one particular Ledger Nano-X, noting that he discovered unexpected electronic components hidden behind the device’s display screen. Karpeles explained that the packaging appeared intact, raising questions about customers’ ability to discern tampered devices through casual visual inspections. In accompanying photographs, these components showed electronic circuitry distinct from the device’s original hardware.
Further investigation revealed that the suspicious modifications contained a microcontroller, cellular hardware, and links to the screen’s data lines, leading to speculation that these implants could capture information displayed during wallet setup.
Estimates of Cryptocurrency Losses
As investigations continue, blockchain analysts are working to quantify the value of cryptocurrencies reportedly removed from compromised wallets. In a finding published on October 9, Bitquery estimated that about $92.9 million was misappropriated across 311 individual crypto wallets, considerably surpassing earlier damage reports of $72 million to $86 million. The discrepancy attributed to this excess was derived from the inclusion of additional wallets and networks reviewed during their analysis.
The bulk of reported losses involved transactions in USDT on the TRON network, alongside Bitcoin and Ethereum transfers. It was observed that approximately $70.5 million moved from TRON wallets, while around $16.8 million were linked to Bitcoin. Bitquery noted a pattern of transactions that suggested an attacker had control over multiple wallets, highlighting movements of funds to Tornado Cash, a platform for obfuscating transaction histories.
Researchers noted additional suspicious transfer activity on October 10, with estimates indicating significant amounts of ETH entering Tornado Cash following similar patterns of transfers, although these evaluations remain separate from Ledger’s confirmed data.
Security Alerts and Recommendations by Ledger
In light of the ongoing investigation, Ledger has issued warnings addressing potential exploitation by malicious actors amid the reseller scandal. The company encourages customers to rely solely on official channels for updates about affected devices and any pertinent security protocols. Importantly, Ledger reiterated that support representatives will never ask users for their 24-word recovery phrase.
Previous investigations concerning fraudulent Ledger websites revealed phishing attempts aimed at acquiring recovery phrases via counterfeit wallet verification prompts. Additionally, a recent report discussed malicious advertisements directing users to fake Ledger sites and applications, although these activities are not related to the CryptoBilis incident.
Looking ahead, Ledger is developing additional safeguards against unauthorized physical modifications to their devices, though specific details or release dates remain unannounced. Customers seeking support and further guidance are directed to reach out through Ledger’s official support channels.
