Ledger confirms a hidden spy chip behind crypto thefts from resold wallets

A hardware wallet is a small device that keeps the secret keys to your crypto away from the internet. You approve every payment on the device itself. Ledger, a French company, is one of the best known makers.

Here is how the week unfolded, based on Ledger's own posts as quoted by BleepingComputer and Gizmodo:

• October 9: Ledger said it was investigating reports of lost funds from users in Southeast Asia who bought devices from CryptoBilis. It asked the reseller to pause all sales and shipments.
• October 10: Ledger confirmed hardware tampering. "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant," the company said.
• October 11: Ledger said all reports of unexpected drains were linked to devices sold through CryptoBilis, and described the affected volume as "limited."

CryptoBilis is a large Malaysia based retailer that Ledger lists as a reseller for Indonesia, Malaysia and the Philippines, according to Gizmodo. It has stopped selling all of its hardware wallet stock while the investigation runs.

Why it matters: Ledger says it has "no indication that Ledger's security infrastructure, systems or services have been compromised." The weak spot was not the code. It was the box, somewhere between the factory and the buyer.

Nobody knows yet. BleepingComputer says it is still unclear exactly how or when the devices were tampered with. Ledger is working with authorities to identify whoever did it, and it is contacting affected users.

Ledger has not accused CryptoBilis of tampering, Gizmodo notes, and nothing public shows the shop altered any device. Someone else could have interfered with devices moving through that sales channel.

Ledger also sent a reminder to its whole network. Authorized resellers and distributors should get products only through authorized channels and should never put returned products back on the shelf.

The clearest pictures come from two independent teardowns. Neither has been tied to a CryptoBilis device, but they show the kind of hardware involved.

Mark Karpeles, the former head of the Mt. Gox exchange, posted photos of a Ledger he says he bought in Malaysia. "My spy-implanted ledger came from Malaysia, and had flawless shrink wrap," he wrote, as quoted by Gizmodo. BleepingComputer quotes him saying it came from "a well known platform via a Chinese seller."

Inside, he found a second board hidden where the screen's foam padding should be. He described:

• An LTE module with a data eSIM: a tiny cellular modem, like the one in a phone, so the implant can send data without any computer.
• An antenna on a single wire: the one visible giveaway once the case is open.
• Screen reading: Karpeles says the chip recognizes the Ledger font on the 128 by 64 pixel display, spots the setup screen, and sends the recovery phrase out as text.

Think of it as someone standing behind you, reading your banking password over your shoulder. The lock on the door is real. The person behind you just never needed to pick it.

In real life When you set up a new Ledger, it shows you 24 words to write down. Those words are the master key to your crypto. Anyone who sees them can rebuild your wallet on any device and empty it.

Tibane Labs, a crypto research and development studio, confirmed Karpeles' finding and found two versions of the implant inside Ledger Nano X wallets. One came from Amazon Japan, sold by a China based seller and shipped from Malaysia. The other came from Yahoo! Auctions in Japan.

• Version one: the original battery was swapped for a smaller one to make room. Under it sat an STMicroelectronics STM32G431 microcontroller (an Arm Cortex-M4 chip with 128 KB of flash storage), a 2 by 2 mm eSIM and a shielded LTE module.
• Version two: more advanced. It kept the original battery and fit into the space under the OLED screen. The part numbers on its chips had been scraped off.

Gridinsoft, describing the Tibane report, says the extra circuit taps the wires that carry the image to the screen. The researchers warned that the second board was "a designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off." In plain words: someone paid a factory to make these.

BleepingComputer adds that some researchers had shown the implant since September 16, and that tampered devices were selling for nearly half the price of a real one.

Ledger has a feature called Genuine Check that confirms a device is authentic. But Ledger itself warns it cannot detect added implants when the device's original Secure Element is intact.

The Secure Element is the locked chip that creates and guards your keys. In these teardowns, that chip was never touched. It did its job perfectly, then showed the 24 words on a screen that someone else was also watching.

Karpeles says the firmware cannot detect the attack either, because the implant only listens when the screen refreshes. The genuine chip passes every test, and a second computer sitting next to it copies what it displays.

Ledger has not published a loss total. Blockchain analysts have, and the numbers grew over the week:

By the numbers: Arkham's count included about $29.4 million in ether, $17.5 million in bitcoin, $13.6 million in USDD and $10.8 million in USDT, Gizmodo reports. Bitquery counts losses across six blockchains, including Bitcoin, Ethereum and Tron.

These are on chain counts, not a Ledger confirmed figure, and a wallet is not the same as a customer.

Possibly, but there is no evidence yet. Trending Topics notes that CryptoBilis also sells wallets from Trezor, Tangem, SafePal, OneKey and other makers. Rob Hamilton, chief executive of the crypto insurer AnchorWatch, advised anyone who bought from the reseller to move their funds right away.

Security researcher Taylor Monahan urged calm. She said it does not look like a zero-day, a previously unknown flaw in Ledger's technology. The bigger danger now, she warned, is phishing links, fake Google ads and counterfeit apps aimed at people rushing to move their money.

The big picture: BleepingComputer says there is no sign that other Ledger resellers shipped altered wallets, though many users are now questioning the reseller network. It is also not Ledger's first scare this year: in January, payment processor Global-e exposed names and contact details of some Ledger.com buyers. No crypto was taken in that case. For another recent look at attacks on money, see our story on South Korea's bank hacking probe.

• Bought from CryptoBilis and not set up yet: don't set it up. Ledger says to leave it untouched.
• Already set it up: move your funds to a new device bought from Ledger or an authorized seller, with a brand new recovery phrase. Restoring your old 24 words on new hardware brings the old, possibly exposed keys with it.
• Buying any hardware wallet: buy from the maker or an authorized seller. A deal at half price on a marketplace is a warning sign, not a bargain.
• Watch for scams: Ledger says it will never call you, message you or ask for your 24 words. Anyone who does is not Ledger.