There’s a phone-calling chip hidden inside a hardware wallet 📱
After reading this, I got a chill down my spine
Ledger has officially confirmed it:
Some devices sold by Southeast Asian distributor CryptoBilis
were fitted with unauthorized implants
As you initialize your device, the 24 recovery words that flash on the screen
are watched by the implant the entire time
Once decoded, they’re sent out directly over LTE using a built-in eSIM
The secure chip itself wasn’t tampered with
And the signing process wasn’t altered
This didn’t bypass cryptography at all
It bypassed the screen you trust most
The company has asked distributors in several Southeast Asian countries and Hong Kong to suspend sales
Some major retailers in Europe have also pulled the products from shelves
On-chain researchers estimate the related losses at over $86 million
But Ledger says that figure hasn’t been verified, so I’m taking it with a grain of salt for now
I’ve always felt that half the security of a cold wallet comes down to where you buy it
Buy directly from the official website, check the seal when it arrives, and don’t initialize it if its origin is unclear
These things used to seem like obsessive caution
Now they look like habits that can save your life
Did you buy your hardware wallet through an official channel?
$BTC $ETH #Ledger #硬件钱包 #SupplyChainSecurity
Not investment advice. DYOR. Trading involves risk.
After reading this, I got a chill down my spine
Ledger has officially confirmed it:
Some devices sold by Southeast Asian distributor CryptoBilis
were fitted with unauthorized implants
As you initialize your device, the 24 recovery words that flash on the screen
are watched by the implant the entire time
Once decoded, they’re sent out directly over LTE using a built-in eSIM
The secure chip itself wasn’t tampered with
And the signing process wasn’t altered
This didn’t bypass cryptography at all
It bypassed the screen you trust most
The company has asked distributors in several Southeast Asian countries and Hong Kong to suspend sales
Some major retailers in Europe have also pulled the products from shelves
On-chain researchers estimate the related losses at over $86 million
But Ledger says that figure hasn’t been verified, so I’m taking it with a grain of salt for now
I’ve always felt that half the security of a cold wallet comes down to where you buy it
Buy directly from the official website, check the seal when it arrives, and don’t initialize it if its origin is unclear
These things used to seem like obsessive caution
Now they look like habits that can save your life
Did you buy your hardware wallet through an official channel?
$BTC $ETH #Ledger #硬件钱包 #SupplyChainSecurity
Not investment advice. DYOR. Trading involves risk.