Malware · Threat Intelligence
Ledger Finds Hardware Tampering in Wallets Sold by CryptoBilis After $86 Million Theft Reports
Ledger has paused sales through CryptoBilis after discovering a hardware implant in some wallets, following reports of $86 million in stolen cryptocurrency. The incident affects users in Southeast Asia.
Ross Grant3 min read
The short version
Ledger, a company that makes hardware wallets for cryptocurrency, found that some devices sold by reseller CryptoBilis had been tampered with. This tampering let attackers steal over $86 million from users in Southeast Asia. If you bought a Ledger wallet from CryptoBilis recently, do not use it. Always make sure your recovery phrase is created by your device and never shared.
By the numbers
- $86 millionestimated cryptocurrency stolenThe Hacker News
What happened?
Ledger has paused sales through reseller CryptoBilis after reports of stolen cryptocurrency from users in Southeast Asia. The company found an unauthorised hardware implant in at least one device sold by CryptoBilis. Losses are said to total more than $86 million, according to a blockchain investigator. Ledger and CryptoBilis are investigating and have issued warnings to affected users.
What Ledger Discovered
Ledger, a well-known maker of cryptocurrency hardware wallets, has paused all sales through its reseller CryptoBilis. This follows reports that users in Southeast Asia lost over $86 million in cryptocurrency after using devices bought from CryptoBilis. According to The Hacker News (opens in a new tab), Ledger found that at least one affected device contained an unauthorised hardware implant. This means someone had physically tampered with the wallet before it reached the customer.
Timeline and Company Response
Ledger began investigating after users reported missing funds. The company quickly advised anyone who bought a Ledger device from CryptoBilis in the last 90 days not to set it up. For those who had already set up their wallets, Ledger recommended moving assets to a new device with a new recovery phrase. Ledger also confirmed that all known cases so far involve devices sold through CryptoBilis. The company is contacting affected users and working to understand the full scope of the incident.
CryptoBilis has stopped selling all hardware wallets until the investigation is finished. Both Ledger and CryptoBilis have warned users never to use a device if it comes with a pre-written recovery phrase or if anyone else has seen the phrase. They also reminded customers that no staff member will ever ask for their recovery phrase or PIN.
How the Attack Worked
The attack involved a hardware implant. This means the device was physically modified, likely before reaching the customer. Such implants can allow attackers to steal the recovery phrase or private keys, giving them access to the user's cryptocurrency. Ledger stressed that a recovery phrase should only be generated by the device itself during setup and should never be provided in advance or seen by anyone else.
Supply Chain Risks and Advice
Ledger advised resellers to buy only from authorised channels and never to restock returned products. The company also warned users against purchasing from unauthorised resellers, as these devices may be counterfeit or tampered with. This incident shows the risks of supply chain attacks, where products are compromised before reaching the end user.
What Users Should Do
If you bought a Ledger wallet from CryptoBilis in the last 90 days and have not set it up, do not use it. If you have already set it up, move your assets to a new device and generate a new recovery phrase. Always make sure your recovery phrase is created by your device during setup and is never shared or written down by anyone else. Be cautious of anyone offering to recover lost funds, as these are often scams.
What Is Still Unclear
So far, only The Hacker News has reported on this incident. There is no confirmation yet from Ledger or any government agency. The full number of affected users and the exact method used to implant the hardware are not yet known. The story may develop as more information comes to light.
Claimed vs confirmed
- Unconfirmed
Ledger wallets sold by CryptoBilis contained unauthorised hardware implants.
Reported by The Hacker News; not yet confirmed by Ledger or authorities.
- Unconfirmed
Over $86 million in cryptocurrency was stolen from users in Southeast Asia.
Figure attributed to blockchain investigator Specter, reported by The Hacker News.
The impact
- Money
- Losses are estimated at over $86 million. If Ledger is found responsible for supply chain failures, regulators could impose fines. For context, GDPR fines can reach up to €20 million or 4% of global turnover.
- Reputation
- Ledger's reputation may be damaged, especially if the tampering is linked to its supply chain. Trust in hardware wallets and resellers could be affected.
- Customers
- Customers who bought from CryptoBilis risk losing all funds stored on tampered devices. They should move assets to a new device and generate a new recovery phrase.
Why it matters
Anyone who bought a Ledger wallet from CryptoBilis could have their cryptocurrency stolen. This shows the risks of buying security devices from unauthorised sellers and the dangers of supply chain attacks. Users need to be careful about where they buy hardware wallets and how they set them up.
How does it work?
The attack involved a hardware implant, meaning the wallet device was physically tampered with before reaching the customer. This could allow attackers to steal the recovery phrase or private keys, giving them access to the user's cryptocurrency.
Key points
- Ledger paused sales through CryptoBilis after reports of tampered wallets.
- Over $86 million in cryptocurrency was stolen from affected users.
- The attack involved a hardware implant, a form of supply chain attack.
- Ledger and CryptoBilis have warned users not to use pre-set recovery phrases.
- Only one source has reported this incident so far; details may change.
Sources
The Hacker News
Reference
