4.3 Possible Chain Reactions Some speculate that Karpelès's | CryptoForge on Binance Square

Post

--

4.3 Possible Chain Reactions

Some speculate that Karpelès's public warning (approximately 90,000 views) may have alerted the attacker, prompting them to accelerate the transfer of funds from multiple wallets. However, this link has not been confirmed.

5. Recommendations for Users

For users who purchased a device from CryptoBilis within the last 90 days:

1. Not yet configured: do not proceed with initialization
2. Already configured: consider transferring assets to a new device, using an entirely new recovery phrase
3. Suspected tampering: avoid entering an existing recovery phrase into any unverified software or website

General advice: purchase hardware wallets through authorized official channels, and verify the authenticity of the device according to official procedures upon receipt.

6. Scope of the Incident

If the $86 million estimate is confirmed, this would be one of the most serious incidents ever linked to a hardware wallet's distribution chain. The essential difference, however, lies in the fact that this is an attack at the reseller level, and not a flaw affecting Ledger's entire systems or product line.

Ledger states that the investigation is ongoing and that it will publish updates as it progresses.

CryptoForge

·

--

Binance founder CZ commented that the evidence points toward a localized supply chain attack targeting a single vendor, rather than a flaw affecting Ledger's entire product line.

3. Unusual Changes at CryptoBilis

3.1 Change of Ownership

Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.

The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.

3.2 Link to the Attack Not Established

At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.

4. Mark Karpelès's Discovery of an Implanted Module

Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.

4.1 Technical Details

The module was concealed in the location of the screen's original padding, and included the following components:

· An LTE communication component
· An antenna
· An eSIM
· A microcontroller, connected to the Ledger's SPI bus

4.2 Attack Principle

According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.

Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.