A hardware implant in Ledger signers is blamed for the theft of at least $86 million in cryptocurrency from multiple users.
Ledger provides users with a secure cryptocurrency wallet that is backed by a signer, an offline hardware device used to securely authorize blockchain transactions.
Ledger signers sold via Southeast Asia reseller CryptoBilis were found to include an unauthorized hardware implant designed to intercept user data and send it to the attackers.
The cryptocurrency theft was disclosed on October 9 and was immediately pinned on devices sold through CryptoBilis. Ledger asked the company to stop selling its devices and instructed customers to stop using them.
“We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed),” the company said.
On October 13, Ledger confirmed that all confirmed fund losses linked to the incident involved a signer sold through CryptoBilis.
It appears that someone along the distribution chain modified the signers to manually solder the hardware implant to the device’s circuit boards.
“The implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM,” Ledger said.
The implant was designed only for information interception and does not modify the device’s OS, transactions, or signatures.
According to on-chain investigator Specter, the total losses associated with the supply chain attack may top $86 million.
Ledger, on the other hand, says it has not confirmed the number of impacted users or the total stolen.
Related: Refrigeration Controller Hack Spoils Food Across European Supermarkets
Related: Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
Related: Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Related: This Key Will Self-Destruct: An Open Standard for Revocable API Keys
