Unauthorized hardware implant confirmed

Ledger confirmed on Saturday, October 10, that an unauthorized hardware implant was found in a device used by someone involved in an investigation into cryptocurrency thefts. The affected products were purchased from CryptoBilis, a reseller in Southeast Asia.

Security of hardware wallets tested

The discovery highlights a vulnerability in the security of hardware wallets, which are devices designed to store cryptocurrency securely. The implant suggests that the device's integrity could have been compromised between manufacturing and first use, even if the secure chip inside was authentic.

Investigation and losses estimated

On October 9, Ledger announced an investigation and asked CryptoBilis to stop selling and shipping its devices. The company also advised customers who bought from CryptoBilis in the past 90 days not to configure their devices. Analysts estimated losses of over 86 million dollars, but these figures have not been independently confirmed.

Implant operation still unclear

Ledger confirmed the presence of the implant on October 10 but did not fully explain how it works or whether it caused all the reported thefts. The company stated it found no evidence that its own systems were compromised. Descriptions suggest the implant could intercept information shown on the device's screen, such as a recovery phrase used to access cryptocurrency.

Recovery phrase and security risks

A recovery phrase is a sequence of words that allows users to restore access to their cryptocurrency on another device. If a hardware wallet captures this phrase during setup, a third party could potentially move funds without needing the original device. Users are advised to keep the phrase secure, such as writing it down on paper.

Verification limitations

Ledger's "Genuine Check" verifies the authenticity of the secure chip inside the device but cannot detect all physical modifications, such as spy implants. This means the check confirms one aspect of security—whether the chip is legitimate—but not the entire journey of the device from manufacturer to user.

Precedents of modified devices

Modified hardware wallets have been reported before. In 2021, a fake Ledger Nano X was sent to a user with a USB memory containing a fraudulent application. In 2022, altered Trezor devices were sold on unauthorized Russian marketplaces. These cases show that hardware wallets have been tampered with before, though the methods differ from the current display interception issue.

Distribution network under scrutiny

CryptoBilis, an authorized reseller, has suspended sales of Ledger products, but it is not clear if the reseller was aware of the modifications. The investigation must determine where the devices were altered—during transport, storage, or another stage. Ledger's documentation states that partners cannot resell returned devices, but this case shows the importance of controlling the entire supply chain.

Customer protection measures

Ledger advises affected users who have already configured their devices to transfer their assets to a new device with a new recovery phrase. Users should never share their recovery phrase with anyone, even if they claim to be customer support.