Ledger probes theft of over $86m after tampered hardware wallets discovered

Hardware wallet manufacturer Ledger is investigating reports of the theft of more than $86 million in crypto from customers in South-east Asia. The victims are said to have bought their devices from CryptoBilis, an official Ledger reseller. An examination of a modified device shows how criminals may be able to gain access to secret recovery phrases without Ledger’s usual checks noticing anything suspicious. Ledger has now asked the seller to temporarily halt all sales and shipments.

Hidden chip can intercept recovery phrases

The case came to light when Mark Karpelès, known for his role at the former Bitcoin exchange Mt. Gox, examined a modified Ledger Nano X.

In the device, which came from Malaysia, he found an additional circuit board behind the screen. According to his findings, it contains an LTE modem and an eSIM.

The design is particularly dangerous. When a user sets up a new wallet, the 24 words of the recovery phrase appear on the screen. The hidden electronics could intercept this information and forward it via a mobile connection.

With those words, an attacker can restore the wallet on another device and gain access to the crypto.

Ledger’s usual authenticity check does not necessarily detect such a modification, because the original security chip remains intact. The device can therefore appear authentic while containing additional hardware.

x.com

Millions disappear after striking takeover

Attention then turns to CryptoBilis, a shop that has sold hardware wallets for years in Malaysia, Indonesia and the Philippines, among other markets.

According to the shared research information, the company has been registered as an official Ledger reseller since at least 2022.

This spring, the original owners sold the business. The takeover is said to have involved a non-disclosure agreement that prohibited disclosure until 19 October.

In August, according to the cited company records, a new owner from the Chinese province of Heilongjiang emerged, holding 100% of the shares.

However, a direct link between this change of ownership and the tampered devices has not been established.

Shortly after Karpelès’s discovery became public, large crypto transactions took place. According to the shared blockchain analysis, 203 BTC and around $58 million in USDT via Tron were among the funds that disappeared.

The total losses are estimated at more than $86 million. A separate calculation even puts the figure at around $91 million. These amounts have not yet been independently confirmed, and Ledger does not state a definitive loss amount in its statement.

Ledger warns CryptoBilis customers

Ledger confirms that it is investigating reports of missing crypto funds among customers who bought devices via CryptoBilis.

As a precaution, Ledger has asked the reseller to halt all sales and shipments.

Customers who bought a device from CryptoBilis in the past 90 days and have not yet set it up are advised to wait for now.

Anyone already using the device is advised to move their crypto to a new wallet with a completely new recovery phrase, generated on a trusted device.

x.com

At this stage, the available information points to a possible problem with devices from this reseller’s sales channel, not a hack of Ledger’s own security systems.

The case does raise questions about oversight of official sales partners. A shop can operate reliably for years, but after a change of ownership it may come under different control.

It remains unclear whether Ledger is aware of the alleged takeover and how exactly the modified devices are reaching customers. The investigation should shed more light on this.