Hardware wallets from the French company Ledger are marketed as "the most secure way to manage your cryptocurrency," yet users have lost around $100 million in cryptocurrencies. Unknown individuals have been intercepting and manipulating offline wallets, exploiting a weakness that the Secure Element chip's protections do not cover.
The attackers insert additional hardware into apparently genuine Ledger Nano X devices and sell them to unsuspecting crypto speculators. The Secure Element chip itself remains untouched. Instead, an extra chip intercepts the signals sent to the built-in screen and recognizes the letters of the seed phrase, a technique known as embedded Tempest, according to an analysis by Tibane Labs. An LTE modem, a tiny eSIM module and a small antenna, powered by the device's own battery, then transmit the seed phrase to the perpetrators via mobile phone, giving them control of the assets it protects.
Ledger has acknowledged to one customer that funds were lost and the device was manipulated, but it has not confirmed the full extent of the damage. Blockchain observers have identified more than 300 affected wallets, from which about $93 million has been drained. The stolen funds are exchanged and, at least partly, laundered through crypto mixers.
Suspicion falls on Cryptobilis, a wallet dealer operating mainly in Southeast Asia from Malaysia. Ledger advises anyone who bought from the dealer in the past three months to stop using those wallets and move their holdings to a new wallet. The company has barred Cryptobilis from further sales and prohibited all Ledger dealers from offering refunds to other customers. Unverified screenshots suggest the dealer changed ownership in August without any announcement.
Source: Hacker News · Summarized by HeadlinesBriefing