More examples of Ledger wallets being tampered with and fitted with physical spyware have allegedly been identified across Asia, Europe, and South America.

Ledger users who bought hardware wallets from Malaysia-based reseller CryptoBilis were drained of over $86 million last week.

Former Mt. Gox CEO Mark Karpelès discovered that spyware implanted in some Ledger devices was being used to read their screen output. It could record any seed phrase while remaining undetected by Ledger’s Genuine Check security protocol.

Ledger confirmed yesterday that the incident on October 9 affected a “limited” number of devices sold by CryptoBilis. 

“We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products,” it said.

Self-proclaimed semi-professional airdrop farmer “@0xJohannes_” claimed to have unpacked a Ledger device with a spy implant that was bought directly from Ledger’s official German reseller MediaMarkt.

The device did not appear to redirect any funds to an exploiter, with the X user noting, “Either the device didn’t work or they were waiting for a more widespread usage of the comprised devices.”

They also claimed that “there are reported cases in Asia, South America, and now Europe as well.”

PSA the ledger incident isn't limited to Asia

This is a device purchased in store from an official reseller in Europe (a legitimate device doesn't have any of these cables as can be seen in picture 2)

This even seems to be an old version of the 'spy implant' even though the… pic.twitter.com/bLWrN9aooK

Source link