⚡ The cold wallet wasn’t hacked. The route it took to get to you was.
Hardware wallets sell one promise: your private keys never touch the internet. This week, buyers in Southeast Asia discovered there’s a condition attached to that promise—one nobody put in the manual.
On October 9, a group of Ledger users in Indonesia, Malaysia, and the Philippines opened the app to find their balances at zero. They hadn’t made any transfers or clicked any links. The money had left on its own.
That day, Ledger acknowledged on X that it was investigating a batch of devices from Southeast Asian distributor CryptoBilis. It told the store to stop selling them. It advised anyone who’d bought one in the past three months not to turn it on, and existing users to move their assets to a new wallet and create a new recovery phrase. The next day, October 10, Ledger confirmed that an unauthorized hardware implant board had been found inside one victim’s device.
For half a week, people had been guessing. Bitquery traced all six drained wallets across the blockchains and came up with a figure: $93.2 million across 315 wallets. The chains were TRON, Bitcoin, Ethereum, Solana, BNB Chain, and Polygon. The first ten addresses made public accounted for only $86 million. The difference came from several Solana chains and five TRON addresses no one had listed.
The method wasn’t complicated. They spent two weeks practicing: 21 small test transactions on TRON and 20 on Ethereum. Then they struck on October 9. TRON was drained first, and all six chains were empty within 47 minutes. On TRON, 25 wallets signed the same authorization within three seconds. Eight minutes earlier, another 30 wallets had handed control to the same key. Someone already had every key in hand—and moved quickly and smoothly.
The money trail is also clear. Tether froze $10 million in USDT across 20 wallets. Another $10 million in USDD is sitting in the thief’s wallet. That can’t be frozen. Over two days, 2,990 ETH went into Tornado Cash and then came out through Zcash. Of that, $5.35 million ended up as USDC, which Circle can freeze. As of the morning of October 11, about $81 million could still be found on-chain.
How did the implant board steal the keys? Researchers took apart a tampered Nano X. The secure chip was intact, and Ledger’s own system hadn’t been breached. The problem was the screen. A board about the size of a grain of rice had been soldered onto the screen’s data line. As you set up your wallet, it read the 24 words appearing on the screen, pixel by pixel, and sent them out using its own cellular module, SIM card, and antenna. The device worked as usual, with no visible signs of anything wrong.
There’s an even more unsettling detail. Bitquery found that six out of every ten drained wallets had received funds within Ledger’s 90-day warning window, and more than eight out of ten had received funds after June this year. Longtime buyers shouldn’t assume they’re in the clear.
The firmware wasn’t compromised. This wasn’t some never-before-seen attack. The problem was the journey from the factory to the buyer. The secure chip protected its own territory; the supply chain didn’t.
As I write this, four BTC price sources put the price between $83,498 and $83,614, up about 1% in 24 hours. ETH is around $2,543.
Putting your coins in a cold wallet secures the device at your end. This week proved that before the box ever reached you, someone had already had their hands on the keys.
$BTC $ETH
#中本聪国际社区Baoluo币商资本 #Ledger #HardwareWallet
Hardware wallets sell one promise: your private keys never touch the internet. This week, buyers in Southeast Asia discovered there’s a condition attached to that promise—one nobody put in the manual.
On October 9, a group of Ledger users in Indonesia, Malaysia, and the Philippines opened the app to find their balances at zero. They hadn’t made any transfers or clicked any links. The money had left on its own.
That day, Ledger acknowledged on X that it was investigating a batch of devices from Southeast Asian distributor CryptoBilis. It told the store to stop selling them. It advised anyone who’d bought one in the past three months not to turn it on, and existing users to move their assets to a new wallet and create a new recovery phrase. The next day, October 10, Ledger confirmed that an unauthorized hardware implant board had been found inside one victim’s device.
For half a week, people had been guessing. Bitquery traced all six drained wallets across the blockchains and came up with a figure: $93.2 million across 315 wallets. The chains were TRON, Bitcoin, Ethereum, Solana, BNB Chain, and Polygon. The first ten addresses made public accounted for only $86 million. The difference came from several Solana chains and five TRON addresses no one had listed.
The method wasn’t complicated. They spent two weeks practicing: 21 small test transactions on TRON and 20 on Ethereum. Then they struck on October 9. TRON was drained first, and all six chains were empty within 47 minutes. On TRON, 25 wallets signed the same authorization within three seconds. Eight minutes earlier, another 30 wallets had handed control to the same key. Someone already had every key in hand—and moved quickly and smoothly.
The money trail is also clear. Tether froze $10 million in USDT across 20 wallets. Another $10 million in USDD is sitting in the thief’s wallet. That can’t be frozen. Over two days, 2,990 ETH went into Tornado Cash and then came out through Zcash. Of that, $5.35 million ended up as USDC, which Circle can freeze. As of the morning of October 11, about $81 million could still be found on-chain.
How did the implant board steal the keys? Researchers took apart a tampered Nano X. The secure chip was intact, and Ledger’s own system hadn’t been breached. The problem was the screen. A board about the size of a grain of rice had been soldered onto the screen’s data line. As you set up your wallet, it read the 24 words appearing on the screen, pixel by pixel, and sent them out using its own cellular module, SIM card, and antenna. The device worked as usual, with no visible signs of anything wrong.
There’s an even more unsettling detail. Bitquery found that six out of every ten drained wallets had received funds within Ledger’s 90-day warning window, and more than eight out of ten had received funds after June this year. Longtime buyers shouldn’t assume they’re in the clear.
The firmware wasn’t compromised. This wasn’t some never-before-seen attack. The problem was the journey from the factory to the buyer. The secure chip protected its own territory; the supply chain didn’t.
As I write this, four BTC price sources put the price between $83,498 and $83,614, up about 1% in 24 hours. ETH is around $2,543.
Putting your coins in a cold wallet secures the device at your end. This week proved that before the box ever reached you, someone had already had their hands on the keys.
$BTC $ETH
#中本聪国际社区Baoluo币商资本 #Ledger #HardwareWallet