Spy Chips Hidden in Hardware Wallets: How $80 Million Was Stolen
CZ just reposted a security alert, and it sent a chill down my spine:
A long-time official authorized Ledger reseller in Malaysia was bought out by hackers. They implanted tiny spy chips in the wallets, repackaged them, and shipped them out. The “brand-new, genuine” wallets customers received had been leaking their private keys from day one. The amount stolen exceeded $80 million. Even worse, the hackers forced the reseller to sign a confidentiality agreement, keeping the incident under wraps for a long time before it came to light.
Let’s break down the attack chain:
1. The entry point wasn’t a shady exchange or a phishing link—it was the supply chain. The hardware you bought was fake.
2. The chip sent the private key away the moment you generated your recovery phrase. Anything you transferred in afterward was just making money for someone else.
3. The packaging, shrink-wrap, and anti-counterfeit stickers were all reproduced exactly. There was no way an ordinary person could tell by looking.
Three things to check right now:
1. Where did you buy your hardware wallet? If it wasn’t directly from the official store—if it came from a third-party reseller or a secondhand marketplace—your risk level is at its highest.
2. Ledger has an authenticity check for its devices (Genuine Check in Ledger Live). If you haven’t run it, do it now.
3. Don’t keep all your high-value assets on a single device. Spread them out. It’s advice you’ve heard a thousand times, but when something goes wrong, it’s the only thing that works.
My take: The scariest thing isn’t the $80 million—it’s that this shatters the belief that “hardware wallet = absolute security.” Cold wallets protect against online attacks, but they can’t protect you if someone tampered with the device before it left the factory. From now on, I’ll only buy hardware wallets directly from the official store. I’m willing to pay a little extra.
#安全 $BTC
CZ just reposted a security alert, and it sent a chill down my spine:
A long-time official authorized Ledger reseller in Malaysia was bought out by hackers. They implanted tiny spy chips in the wallets, repackaged them, and shipped them out. The “brand-new, genuine” wallets customers received had been leaking their private keys from day one. The amount stolen exceeded $80 million. Even worse, the hackers forced the reseller to sign a confidentiality agreement, keeping the incident under wraps for a long time before it came to light.
Let’s break down the attack chain:
1. The entry point wasn’t a shady exchange or a phishing link—it was the supply chain. The hardware you bought was fake.
2. The chip sent the private key away the moment you generated your recovery phrase. Anything you transferred in afterward was just making money for someone else.
3. The packaging, shrink-wrap, and anti-counterfeit stickers were all reproduced exactly. There was no way an ordinary person could tell by looking.
Three things to check right now:
1. Where did you buy your hardware wallet? If it wasn’t directly from the official store—if it came from a third-party reseller or a secondhand marketplace—your risk level is at its highest.
2. Ledger has an authenticity check for its devices (Genuine Check in Ledger Live). If you haven’t run it, do it now.
3. Don’t keep all your high-value assets on a single device. Spread them out. It’s advice you’ve heard a thousand times, but when something goes wrong, it’s the only thing that works.
My take: The scariest thing isn’t the $80 million—it’s that this shatters the belief that “hardware wallet = absolute security.” Cold wallets protect against online attacks, but they can’t protect you if someone tampered with the device before it left the factory. From now on, I’ll only buy hardware wallets directly from the official store. I’m willing to pay a little extra.
#安全 $BTC