Ledger has confirmed an unauthorized hardware implant in one affected customer's wallet as independent investigators estimate $93.2 million in suspected cryptocurrency thefts.

In an Oct. 10 statement, the hardware wallet manufacturer said the discovery involved a device belonging to one of the affected users. It added that CryptoBilis, an authorized reseller operating in Southeast Asia, had suspended sales of all hardware wallet inventory pending the investigation's conclusion.

The investigation began after customers reported losing cryptocurrency after buying Ledger devices from the reseller. Ledger has not said how many devices were modified or established that the implant caused all the reported losses.

Ledger said it had found no indication that its security infrastructure, systems or services had been compromised.

Former Mt. Gox chief executive Mark Karpelès has been examining suspicious Ledger Nano X devices through Tibane Labs, which has documented three generations of Ledger Nano X implants designed to intercept recovery phrases. Its report combines Joe Grand's teardown of an earlier implant with two specimens Tibane examined in September.

According to the research, the implants work by monitoring electronic signals sent between a wallet's secure element and its display.

During initial setup, a Ledger device generates a 24-word recovery phrase that lets its owner restore access to cryptocurrency holdings. Although the words originate inside a secure chip, they must pass through the device's display circuitry to appear on the screen.

Tibane Labs found that the modified devices contained additional microcontrollers that could read the screen's data, reconstruct the recovery words, and transmit them via cellular modems with SIM components.

Source link