Tampered Ledger wallets linked to $86 million crypto theft
Hardware wallet maker Ledger is investigating crypto thefts tied to devices sold by a Southeast Asian reseller, CryptoBilis, and confirmed one device had an unauthorized hardware implant. Investigators estimate losses of $72 million to $86 million. Ledger says its own systems were not breached.
Some owners of Ledger crypto wallets have had their accounts drained, and tampered hardware appears to be the cause.
Ledger, a major maker of hardware wallets for storing cryptocurrency, is investigating reports of stolen funds tied to devices sold by CryptoBilis, a reseller in Southeast Asia, The Verge reported. Ledger confirmed that "one of the impacted users' devices contained an unauthorized hardware implant."
Photos and videos posted online appear to show a small circuit board hidden under the device's screen. The implant allegedly captures what appears on the screen, including the secret recovery phrase shown during setup. Using a built-in SIM card, it then sends that information to the attacker, who can empty the wallet.
Blockchain researchers Specter and tanuki42 estimate losses at $72 million to $86 million across Bitcoin, Ethereum and Tron wallets, CoinCentral reported. Hundreds of wallets were hit.
Ledger asked CryptoBilis to pause all sales and shipments during the investigation, LiveBitcoinNews reported. Ledger says its own systems were not compromised and there is no sign that wallets bought directly from Ledger were affected.
Binance co-founder Changpeng Zhao called for the industry to help trace and recover the stolen money.
Hardware wallets are meant to be the safest way to hold crypto because the secret keys never touch the internet. This kind of "supply chain attack" targets the device before it reaches the buyer.
Security experts often advise buying wallets only from the maker or trusted sellers. Ledger has posted guidance on how to check whether a device has been tampered with.
What we know: Ledger asked reseller CryptoBilis to pause sales while it investigates tampered devices.
What we don't: who planted the implants or the final size of the losses.
Where outlets agree The Verge, CoinCentral and LiveBitcoinNews all report Ledger asked CryptoBilis to pause sales during its investigation.
Where they differ CoinCentral cites researchers estimating losses of $72 million to $86 million, while The Verge and LiveBitcoinNews put them at over $86 million.