A Hidden Chip in a Hardware Wallet? Your Questions on the Ledger Reseller Tampering Case
Ledger confirmed a device bought through a Southeast Asian reseller carried an unauthorized hardware implant, as losses estimated at over $86 million are investigated. Here’s what is known and what it teaches about buying security hardware.
Hardware crypto wallets are supposed to be the safe option, a physical device that keeps secret keys off your computer. This week that promise ran into a supply chain problem: Ledger has confirmed that at least one wallet sold through a reseller carried an extra circuit board that was never supposed to be there.
The answers below are based on Michael Millard’s report for Cointelegraph, with details on how the implant reportedly works from The Verge.
What exactly did Ledger confirm?
That one impacted user’s device contained an unauthorized hardware implant. Ledger has been investigating reports of funds drained from wallets bought through CryptoBilis, a reseller in Southeast Asia, and says it is contacting users as the investigation continues.
How much money is involved?
Investigator Specter estimates losses may top $86 million across Bitcoin, Ethereum and Tron. The Verge reported that hundreds of wallets were affected. Ledger itself has not confirmed how many customers were hit or the total amount lost.
How would an implant steal from a wallet?
Photos and videos shared on social media appear to show a small circuit board tucked under the device’s screen. According to The Verge, the implant allegedly captures whatever appears on the display, including the recovery phrase shown during first-time setup, and sends it to the attacker over an embedded SIM card. With that phrase, the attacker can empty the wallet.
Who sold the affected devices?
CryptoBilis, which had been listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. The reseller has stopped selling all of its hardware wallet stock until the investigation ends.
Was Ledger itself hacked?
Ledger says no. It told Cointelegraph that the incident appears limited to the one reseller and its market, and that its own infrastructure, systems and services were not compromised. The Verge noted there is no sign that wallets bought directly from Ledger are affected.
What is Ledger telling customers?
- If you bought a device from this reseller and haven’t set it up, don’t start setup.
- If you already set it up, consider moving your assets to a new Ledger device with a brand-new recovery phrase.
- Anyone with information can contact Ledger’s bounty program, and customers should reach support only through official channels.
What this means for your company
You may not hold cryptocurrency, but you almost certainly buy security hardware: firewalls, security keys, routers and laptops. This case is a reminder that a device is only as trustworthy as the path it took to reach you.
- Buy security hardware directly from the manufacturer or from distributors you have verified, and keep the purchase records.
- Inspect devices on arrival. Check seals and packaging, and use any genuineness or attestation check the vendor provides.
- Treat setup secrets as the crown jewels. Recovery codes and keys generated during setup should be stored offline and seen by as few people as possible.
- Have a rotation plan. If a device’s origin is ever in doubt, know how you would replace it and reissue its keys quickly.
- Add supply chain questions to vendor reviews, especially for anything that stores credentials or sits at your network edge.
Need help building a purchasing and setup process for security hardware you can actually trust? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
