When your company’s bread-and-butter is selling crypto devices advertised as having “industry leading” security, you better keep a close eye on your supply chain.
That’s a hard lesson learned by Ledger, a company specializing in secure blockchain wallets, after news broke that some of its devices had been infiltrated by a mysterious “hardware implant.” According to Bleeping Computer, the malicious implant was designed to monitor inputs made onto each wallet via on-board buttons, along with changes in output on the devices’ e-ink screens.
By monitoring this data, the hardware implant could reportedly identify the use of a seed phrase — a sequence of words used to generate static wallet addresses on the blockchain — which it would then transmit to hackers using an eSIM.
As a result of the implants, a number of Ledger users had their crypto wallets drained, prompting an investigation by the company. After probing a number of devices, Ledger concluded that the compromised wallets originated from an electronics reseller out of Malaysia named CryptoBilis.
Though it remains to be seen where CryptoBilis obtained the hacked devices, Ledger put out a statement recommending customers avoid purchasing and activating any of its hardware purchased from the reseller.
“As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices,” the company warned in a statement on X-formerly-Twitter.
Though Ledger stated that they “have no indication that Ledger’s security infrastructure, systems or services have been compromised,” the interception does raise some crucial questions around the security of the devices and Ledger’s oversight of its hardware supply chain.
If a supposedly world-beating crypto wallet can be easily cracked to drain users’ wallets, how can customers trust any supplier — CryptoBilis or otherwise — to sell secure devices?
More on data privacy: Meta’s Muse Is Spying on All Your Friends and Family