Crypto Wallet Hack: $102M Stolen

Ledger Confirms Hidden Implant in Wallets

Ledger, a leading crypto hardware wallet manufacturer, confirmed that a hidden implant was found in some of its wallets, which stole recovery phrases during setup. The implant transmitted the stolen recovery words over a mobile connection, allowing attackers to access the wallets and steal funds.

According to Bitquery, a blockchain analytics firm, an estimated $102 million was stolen across 324 wallets. The incident occurred in Southeast Asia, where customers purchased the affected wallets through CryptoBilis, an authorized reseller.

How the Implant Worked

The implant was a small controller that intercepted the recovery words as they appeared on the screen during setup. It then transmitted the words over LTE using an embedded SIM card. The implant did not need to break the protected chip or trick the owner into entering the words on a fake website.

The owner could finish setup, use the wallet, and approve legitimate transactions, while someone else had an identical way to access the funds. An optional additional passphrase can protect accounts created with it, but for ordinary accounts, the recovery words alone are enough.

Ledger's Response

Ledger's security team explained that the added electronics had read the wallet's 24 recovery words as they appeared on the screen during setup and sent them over a mobile connection. The company has asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales and is tightening controls on returned products.

Ledger has also advised customers who bought from CryptoBilis not to initialize unused devices and to move funds to a new signer with a new phrase. Affected owners should use official support channels, preserve potentially relevant evidence, and never provide recovery words to someone claiming they can help recover the money.

Consequences of the Hack

The incident highlights the importance of physical access and the distribution chain in hardware wallet security. The attackers did not need to wait for an owner to make a mistake after opening the box, as they gained access long before the owner even arrived.

The hack also shows that the security boundary people think they are buying extends beyond the chip inside the device. It extends through the screen, casing, packaging, and distribution chain, all the way to the moment the recovery words first appear.

• The incident resulted in an estimated $102 million in losses across 324 wallets.
• Ledger has suspended sales in Southeast Asia and Hong Kong.
• Customers who bought from CryptoBilis are advised not to initialize unused devices and to move funds to a new signer with a new phrase.

Lessons Learned

The incident highlights the importance of verifying the authenticity of hardware wallets and the need for secure distribution channels. Self-custody removes the need to trust an exchange to hold the keys, but not the need to trust the hardware that creates and displays them.

As the crypto industry continues to grow, it is essential to prioritize security and verify the authenticity of hardware wallets to prevent such incidents in the future.

Implications for Readers in India

The incident serves as a reminder to readers in India to be cautious when purchasing hardware wallets, especially from authorized resellers. It is essential to verify the authenticity of the device and ensure that it has not been tampered with during the distribution process.

Readers in India should also be aware of the importance of physical access and the distribution chain in hardware wallet security. They should take necessary precautions to protect their recovery phrases and ensure that their devices are secure.

What to Watch Next

The incident is a wake-up call for the crypto industry, and it is likely that we will see increased scrutiny of hardware wallet security and distribution channels in the future. Readers should stay informed about the latest developments in crypto wallet security and be cautious when purchasing hardware wallets.

Additionally, readers should be aware of the potential for similar incidents to occur in the future and take necessary precautions to protect their crypto assets. This includes verifying the authenticity of hardware wallets, ensuring secure distribution channels, and protecting recovery phrases.

Expert Perspective

Experts in the field of crypto security emphasize the importance of robust security measures to prevent such incidents. They recommend that hardware wallet manufacturers implement strict quality control measures and conduct regular security audits to ensure the integrity of their devices.

Furthermore, experts suggest that customers should only purchase hardware wallets from authorized resellers and should verify the authenticity of the device before using it. They also recommend that customers keep their recovery phrases secure and use additional security measures such as two-factor authentication to protect their crypto assets.

Timeline of Events

The incident occurred in early October, when customers in Southeast Asia discovered that their crypto had disappeared from their Ledger hardware wallets. On October 10, Ledger confirmed an unauthorized implant in one affected customer's device. Three days later, its security team explained that the added electronics had read the wallet's 24 recovery words as they appeared on the screen during setup and sent them over a mobile connection.

On October 15, Ledger updated its security advisory, asking authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales and tightening controls on returned products. The company also advised customers who bought from CryptoBilis not to initialize unused devices and to move funds to a new signer with a new phrase.