Ledger confirmed it: Hardware wallets sold by Southeast Asian reseller CryptoBilis were fitted with hardware implants. More than $86 million is suspected to have been stolen, and hundreds of wallets were drained.
The selling point of a hardware wallet is that “your private keys never go online.” But the problem arose before the devices even left the factory. You buy a safe, and someone installs a backdoor in it during manufacturing.
Supply-chain attacks are nothing new, but they’re especially ironic in crypto: people spend hundreds of dollars on a cold wallet to protect themselves from hackers, only to get robbed not by being hacked, but by the very device they bought.
The selling point of a hardware wallet is that “your private keys never go online.” But the problem arose before the devices even left the factory. You buy a safe, and someone installs a backdoor in it during manufacturing.
Supply-chain attacks are nothing new, but they’re especially ironic in crypto: people spend hundreds of dollars on a cold wallet to protect themselves from hackers, only to get robbed not by being hacked, but by the very device they bought.