CryptoSlate
Ledger confirmed an unauthorized hardware implant in one affected customer's wallet as investigators estimate $93.2 million in suspected cryptocurrency thefts. Bitquery counted losses from 315 wallets across six blockchains, while Galaxy Research estimated about $91 million across 477 addresses. Ledger said it has not established that the implant caused all reported losses.
Why it matters
The case exposes a limitation in Ledger's Genuine Check. The system verifies the authenticity of the secure element, but it cannot detect unauthorized physical modifications when that chip remains intact. Tibane Labs and former Mt. Gox executive Mark Karpelès examined Ledger Nano X devices containing extra microcontrollers, antennas and cellular components designed to read recovery phrases as they passed through display circuitry.
A recovery phrase generated on a compromised device should be treated as exposed. Reusing that phrase on a replacement wallet would not solve the problem because an attacker could retain access to the same credentials. Ledger has advised customers who bought devices from Southeast Asian reseller CryptoBilis not to initialize unused wallets and to move funds from initialized devices using a newly generated phrase on trusted hardware.
Market impact
The suspected thefts included about $64.5 million on Tron, $17.7 million in Bitcoin and $8.8 million on Ethereum-related networks, according to Galaxy's estimate. Bitquery found that 25 Tron wallets approved the same token withdrawal within three seconds, enabling roughly $29 million in USDT to move rapidly. Tether froze about $10 million in stolen USDT, while Circle identified $5.35 million in USDC that could be frozen.
The estimates use different address sets and methods, and neither establishes how many devices were modified. Ledger said its infrastructure and services showed no signs of compromise, while the investigation continues across the reseller channel and affected wallets.
Frequently asked questions
-
What did Ledger confirm about the affected wallet?
Ledger confirmed an unauthorized hardware implant in one affected customer's wallet. It has not established that the implant caused all reported losses.
-
Why did Ledger's Genuine Check miss the implant?
Genuine Check verifies the authenticity of the secure element. It cannot detect unauthorized physical modifications when that secure element remains intact.
-
How could the implants steal recovery phrases?
The modified devices used additional electronics to monitor data moving between the secure element and display, reconstruct the recovery words and transmit them through cellular components.
-
How large were the suspected cryptocurrency losses?
Bitquery estimated about $93.2 million stolen from 315 wallets across six blockchains. Galaxy Research estimated about $91 million across 477 addresses using a different method.
-
What should users do if they used a compromised Ledger device?
Users should move funds to trusted hardware using a newly generated recovery phrase. Reusing the old phrase on a replacement device would leave the wallet exposed.
Lookonchain
CoinTelegraph
WuBlockchain
WatcherGuru
TheBlock
CoinDesk