Is the Ledger supply chain controversy continuing to escalate? Analyst: Over 20 distributors may pose potential risks
October 12 — Analyst Darkfost wrote yesterday that following the disclosure of a security incident involving distributor CryptoBilis, discussions in the community have raised concerns about other distributors that may be involved, including some sellers on Lazada.
He compiled a list of “potentially risky Ledger distributors” involving more than 20 suppliers, warning users to pay attention to the security of devices purchased through these channels.
The source of this wallet security incident can be traced back to distributor CryptoBilis. Ledger’s investigation confirmed that an affected user’s device contained an unauthorized hardware implant, and an investigation related to the distributor is also underway.
However, Darkfost believes it is still difficult to determine the scope of the impact. On the one hand, it is unclear whether CryptoBilis is the only affected channel; on the other, some distributors are regionally connected, so the possibility of multiple points of compromise in the supply chain cannot be ruled out.
Darkfost also stressed that these assessments are currently based only on speculation about supply chain connections and are not established facts. Whether the distributors in question have actually been affected remains subject to further investigation.
For ordinary users who have purchased a Ledger hardware wallet from a relevant distributor in the past six months, migrating assets to a new, secure device may be worth considering until the investigation results are clear.
Users who are capable of checking their devices themselves can refer to the inspection guide published by security researcher MagicalTux to identify signs of tampering.
*Security reminder: Hardware wallet users should purchase devices through official or authorized channels and verify the firmware before first use.
When transferring large amounts of assets, users should be sure to do so offline in a trusted environment, and beware of phishing and spoofed websites.
#冷钱包安全事件
October 12 — Analyst Darkfost wrote yesterday that following the disclosure of a security incident involving distributor CryptoBilis, discussions in the community have raised concerns about other distributors that may be involved, including some sellers on Lazada.
He compiled a list of “potentially risky Ledger distributors” involving more than 20 suppliers, warning users to pay attention to the security of devices purchased through these channels.
The source of this wallet security incident can be traced back to distributor CryptoBilis. Ledger’s investigation confirmed that an affected user’s device contained an unauthorized hardware implant, and an investigation related to the distributor is also underway.
However, Darkfost believes it is still difficult to determine the scope of the impact. On the one hand, it is unclear whether CryptoBilis is the only affected channel; on the other, some distributors are regionally connected, so the possibility of multiple points of compromise in the supply chain cannot be ruled out.
Darkfost also stressed that these assessments are currently based only on speculation about supply chain connections and are not established facts. Whether the distributors in question have actually been affected remains subject to further investigation.
For ordinary users who have purchased a Ledger hardware wallet from a relevant distributor in the past six months, migrating assets to a new, secure device may be worth considering until the investigation results are clear.
Users who are capable of checking their devices themselves can refer to the inspection guide published by security researcher MagicalTux to identify signs of tampering.
*Security reminder: Hardware wallet users should purchase devices through official or authorized channels and verify the firmware before first use.
When transferring large amounts of assets, users should be sure to do so offline in a trusted environment, and beware of phishing and spoofed websites.
#冷钱包安全事件