Ledger says hardware implant in cryptocurrency wallets stole recovery phrases
Ledger cryptocurrency wallets sold through a Southeast Asian reseller had an implant allowing outsiders to drain funds, the company said.
Noch kein anderes von Zonactu verfolgtes Medium berichtet über diese Meldung.
Cryptocurrency wallet maker Ledger said Tuesday that devices sold through Southeast Asian reseller CryptoBilis contained hidden hardware implants that captured users’ recovery phrases, allowing attackers to steal their funds.
In a series of social media posts , the Paris-based company said its security research team found the affected devices contained implants that read data displayed on the screens.
During setup, the implants detect users’ 24-word recovery phrase and transmit it over an LTE connection using an embedded eSIM. Unknown attackers subsequently used the phrase to access users’ funds.
Those funds were drained last week, on Oct. 9. Ledger said it has not confirmed the total losses and urged caution against speculation.
“If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase,” the company said.
“Do not enter or restore any recovery phrase on a signer bought from CryptoBilis,” its statement added.
Ledger said all confirmed thefts, which have largely been reported within Southeast Asia, involve devices sold through CryptoBilis — but it added it is “also reviewing reports of implants in other signers and locations.”
In a notice on its website, CryptoBilis linked to the Ledger warning and said it has “paused all sales and shipments of Ledger devices while Ledger investigates,” and said it was “cooperating fully with Ledger’s investigation.”
Ledger has not identified the affected models, but warned that because the implants leave one of its key security features, the Secure Element, intact, tampered devices may still pass the company’s authenticity checks.
Ledger urged CryptoBilis customers not to activate unused devices and advised those already using them to promptly transfer funds to a new wallet with a new recovery phrase.
The company said victims should reach out to them and to local law enforcement before opening or shipping affected devices. It added that it believes the “volume of impacted devices is limited.”
