A significant breach involving Ledger signers has led to the theft of at least $86 million in cryptocurrency, affecting numerous users. Ledger's devices, which serve as secure cryptocurrency wallets, were compromised through a hardware implant. This implant was found in devices sold by the Southeast Asian reseller, CryptoBilis. The unauthorized implant intercepted user data and transmitted it to attackers, facilitating the theft. Ledger quickly responded by alerting customers on October 9, advising them to cease using devices purchased from CryptoBilis and to transfer their assets to new devices. The company has confirmed that all known fund losses were tied to signers sold by this reseller. The tampering involved manually soldering a component to the device's circuit board, allowing it to capture the 24-word recovery phrase displayed during setup. This component then transmitted the information via an LTE connection. Although the implant did not alter the device's operating system or transactions, its role in data interception was critical to the attack. Investigators estimate the total losses from this supply chain attack could surpass $86 million, though Ledger has not confirmed the exact number of affected users or total amount stolen.
Massive Crypto Theft Tied to Ledger Signer Tampering
Hardware implant on Ledger Signer stolen user data and enabled attackers to drain wallets, linked to an $86 million heist.
Executive Summary
A hardware implant in Ledger signers sold by CryptoBilis led to the theft of at least $86 million in cryptocurrency. The implant intercepted user data, enabling attackers to drain wallets.
Actionable Insights
- Immediately stop using Ledger devices purchased from CryptoBilis.
- Transfer all assets to a new Ledger signer with a new seed phrase.
- Inspect hardware devices for unauthorized modifications before use.
Original source
securityweek.com

