Ledger Hack: When Your Crypto Wallet Has a Spy Inside

Imagine you want to secure your crypto assets on a cold wallet. You buy a brand-new one, you set it up, make sure you do everything right and start storing your crypto on it, only to discover later that your funds suddenly disappeared… Someone else had your recovery phrase all along.

Well, that’s pretty much what seems to be happening for some Ledger devices. After the crazy Coldcard heist this summer, hackers are not stopping. Let me tell you more about it.

First things first, what is Ledger?

Ledger is one of the biggest names in crypto security, building hardware wallets that keep your private keys secured and your crypto offline. These devices help you protect your crypto from online hackers trying to steal your assets.

They are what we commonly call cold wallets, supposed to be one of the most reliable ways to secure your crypto. But Ledger has just experienced an unexpected issue…

The Spy Device Attack

On October 9, Ledger raised the alarm after users in Southeast Asia reported their crypto disappearing from their wallets despite never sharing their recovery phrases. How is that possible?

Well, there is something to have in mind first. Ledger is a physical product seller, and to distribute its devices around the world the company collaborates with resellers. That’s where the issue started.

The users who saw their funds disappear had bought their Ledger devices from CryptoBilis, an official reseller whose ownership changed earlier this year. So, Ledger quickly asked the company to suspend sales and shipments while it investigated.

A few days later, Ledger confirmed that at least one device contained an unauthorized hardware implant… In other words, there was a spy inside.

This implant could read the 24 recovery words displayed during setup and send them to attackers over a mobile network. Once the attackers have those words, they can recreate the wallet and drain its funds without ever touching the original device. Yep, pretty scary.

And even worse, the modified devices could apparently still pass authenticity checks because the implant reportedly left Ledger’s security chip and operating system untouched…

On October 15, Ledger shared its official response, revealing more details about how the attack was carried out.

According to the company, a highly organized criminal group spent months buying genuine Ledger devices, opening them, installing custom-built hidden components, and putting them back into circulation through resellers in Southeast Asia. The group also built its own infrastructure to collect recovery phrases, drain wallets, and launder the stolen funds.

Ledger says the attackers spent millions preparing the operation. As for the damage, independent investigators estimate that more than $90 million may have been stolen, although Ledger has yet to confirm the total.

From Southeast Asia to Europe?

Things started in Southeast Asia, where CryptoBilis mainly operates, but it got more complicated after a few days.

Former Mt. Gox CEO Mark Karpelès reported finding a Ledger is one of the biggest names in crypto security, while a customer in Germany reported suspicious components inside two devices bought from separate MediaMarkt stores. So the problem appeared to be broader than expected.

On October 13, MediaMarktSaturn pulled Ledger products from its stores and websites across all its markets as a precaution. Ledger also asked resellers in six Southeast Asian countries and Hong Kong to suspend sales as investigations continued.

There’s an important note to take into account here: Ledger has confirmed losses linked to CryptoBilis, but has not verified any theft involving devices purchased elsewhere.

Ledger says it sent teams to Germany to purchase and inspect devices from stores and also examined samples from warehouses. According to the company, every unit its teams examined was clean. This does not confirm that every device reported as suspicious elsewhere has been independently cleared.

The company maintains that its own systems, security chip, operating system, and servers were not compromised, describing the incident as a localized attack on its distribution channel.

On a lighter note

Ledger is not the only cold wallet option out there. Other popular companies provide similar services but with a different approach.

In the case of Tangem, for example, its hardware wallets are built in the shape of a credit card or a ring that you use through NFC to connect to your wallet on your mobile.

The very different design makes this particular type of spy device harder to implement… and some users had “jokes” about it.

What’s next?

Ledger is continuing its investigation into who tampered with the devices and how they entered the distribution chain, working with law enforcement and security experts to trace the stolen funds and dismantle the attackers’ infrastructure.

Naturally, the company is also tightening security measures for its authorized resellers.

In the meantime, if you’ve bought a Ledger recently, follow Ledger’s official safety guidance, never use a recovery phrase supplied with a device, and be extra cautious if your wallet came through a reseller mentioned in the investigation.

We should get some important answers in the coming days, hopefully, so check out Ledger’s official X account to keep yourself updated.

It really feels like we’re living in a crypto movie this year.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.