Binance founder CZ commented that the evidence points toward a localized supply chain attack targeting a single vendor, rather than a flaw affecting Ledger's entire product line.
3. Unusual Changes at CryptoBilis
3.1 Change of Ownership
Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.
The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.
3.2 Link to the Attack Not Established
At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.
4. Mark Karpelès's Discovery of an Implanted Module
Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.
4.1 Technical Details
The module was concealed in the location of the screen's original padding, and included the following components:
· An LTE communication component
· An antenna
· An eSIM
· A microcontroller, connected to the Ledger's SPI bus
4.2 Attack Principle
According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.
Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.
3. Unusual Changes at CryptoBilis
3.1 Change of Ownership
Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.
The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.
3.2 Link to the Attack Not Established
At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.
4. Mark Karpelès's Discovery of an Implanted Module
Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.
4.1 Technical Details
The module was concealed in the location of the screen's original padding, and included the following components:
· An LTE communication component
· An antenna
· An eSIM
· A microcontroller, connected to the Ledger's SPI bus
4.2 Attack Principle
According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.
Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.
