A hardware implant has been confirmed on one customer’s device. I’m not treating the estimated $102 million as the same confirmed figure.
On October 10, Ledger confirmed that an unauthorized hardware implant had been found in a customer’s wallet. Earlier, a customer in Southeast Asia discovered that their crypto assets had been stolen. In a report by NS3, Bitquery estimated that the attackers took assets worth $102 million from 324 wallets across six networks. Ledger has not confirmed that total, nor attributed all the losses to implanted devices.
I’ve noted the route based on Ledger’s own account: the attackers modified genuine devices, which were then resold through a Southeast Asian reseller and re-entered the sales channel. The implanted electronic component copied the recovery phrase during setup and sent it out over a mobile connection. As a result, authorized sellers in Southeast Asia and Hong Kong were asked to suspend sales. For devices already initialized on CryptoBilis, Ledger recommended moving funds to a new signing device and using a new recovery phrase.
One implanted device is confirmed. The 324 wallets and $102 million remain estimates. I’m keeping those two figures separate.
#安全事件 #硬件钱包
On October 10, Ledger confirmed that an unauthorized hardware implant had been found in a customer’s wallet. Earlier, a customer in Southeast Asia discovered that their crypto assets had been stolen. In a report by NS3, Bitquery estimated that the attackers took assets worth $102 million from 324 wallets across six networks. Ledger has not confirmed that total, nor attributed all the losses to implanted devices.
I’ve noted the route based on Ledger’s own account: the attackers modified genuine devices, which were then resold through a Southeast Asian reseller and re-entered the sales channel. The implanted electronic component copied the recovery phrase during setup and sent it out over a mobile connection. As a result, authorized sellers in Southeast Asia and Hong Kong were asked to suspend sales. For devices already initialized on CryptoBilis, Ledger recommended moving funds to a new signing device and using a new recovery phrase.
One implanted device is confirmed. The 324 wallets and $102 million remain estimates. I’m keeping those two figures separate.
#安全事件 #硬件钱包