Key Takeaways
- • Ledger is investigating an attack involving modified hardware wallets containing hidden surveillance components, with estimated losses exceeding $90 million, according to the Investing.com report.
- • The investigation centers on Malaysian cryptocurrency retailer CryptoBilis, where customers began reporting missing funds on October 9.
- • Ledger said an organised criminal group installed concealed hardware inside some of its wallets, and it is also examining reports of compromised devices purchased elsewhere.
- • Independent researchers say the modified devices could intercept information shown on wallet screens and relay it to attackers over cellular connections, bypassing the primary security chips.
- • The incident follows other hardware wallet security failures this year, including a reported $130 million Bitcoin loss tied to a Coinkite device software vulnerability.
Summary
Cryptocurrency hardware wallet maker Ledger, based in Paris, is investigating an attack involving modified devices with hidden surveillance components, according to Investing.com. Blockchain researchers estimate that more than $90 million in digital assets has been stolen. The investigation has focused on Malaysian cryptocurrency retailer CryptoBilis, where customers began reporting missing funds on October 9. Ledger said an organised criminal group installed concealed hardware inside some of its wallets. CryptoBilis has temporarily closed its physical stores in Kuala Lumpur, and Ledger said it is working with local law enforcement. The retailer has not commented publicly.
Independent security researchers suggest the modified devices contain components capable of intercepting sensitive information transmitted to wallet screens and relaying it to attackers through cellular connections. Such modifications could allow criminals to access holdings without directly compromising the devices' primary security chips. The findings point to supply-chain vulnerabilities, particularly where devices pass through third-party distributors or refurbishment channels.
The investigation has extended beyond Malaysia. An examination of a Ledger Flex purchased at Singapore's Changi Airport reportedly identified a modified display connector, cellular chip, and SIM card. Ledger is also investigating reports of compromised devices purchased elsewhere, raising concerns that the attack may extend beyond CryptoBilis. The company has yet to establish the full extent of the attack or disclose how many devices may have been affected.
The incident adds to a series of security events affecting hardware wallet providers. Earlier this year, a software vulnerability affecting devices manufactured by Coinkite reportedly resulted in approximately $130 million in Bitcoin losses. Separately, a breach involving a shipping provider used by Trezor exposed personal information belonging to about 67,000 customers.
Independent security researchers suggest the modified devices contain components capable of intercepting sensitive information transmitted to wallet screens and relaying it to attackers through cellular connections. Such modifications could allow criminals to access holdings without directly compromising the devices' primary security chips. The findings point to supply-chain vulnerabilities, particularly where devices pass through third-party distributors or refurbishment channels.
The investigation has extended beyond Malaysia. An examination of a Ledger Flex purchased at Singapore's Changi Airport reportedly identified a modified display connector, cellular chip, and SIM card. Ledger is also investigating reports of compromised devices purchased elsewhere, raising concerns that the attack may extend beyond CryptoBilis. The company has yet to establish the full extent of the attack or disclose how many devices may have been affected.
The incident adds to a series of security events affecting hardware wallet providers. Earlier this year, a software vulnerability affecting devices manufactured by Coinkite reportedly resulted in approximately $130 million in Bitcoin losses. Separately, a breach involving a shipping provider used by Trezor exposed personal information belonging to about 67,000 customers.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.