Ledger Wallets: Researchers Estimate $90M Lost to Physical Implants
Hidden Hardware Implants Drain Crypto Wallets
At a small cryptocurrency shop in Kuala Lumpur, a sheet of paper taped to the shutters on Oct. 10 announced that physical stores were temporarily closed until further notice. Malaysian retailer CryptoBilis, a reseller of hardware crypto wallets, became a focal point of an investigation into thefts from offline storage devices after customers began reporting missing funds on Oct. 9. Blockchain researchers have estimated losses of over $90 million.
-
The Tech TL;DR:
- Hardware wallets purchased through third-party resellers face physical tampering risks that bypass offline cryptographic isolation.
- Investigators discovered custom connectors, cellular chips, and SIM cards intercepting passcodes directly from device displays.
- Supply chain compromises have expanded beyond software vulnerabilities, forcing a reevaluation of physical retail security in digital asset management.
Criminals Fit Ledger Wallets with Passcode Intercepting Hardware
Paris-based Ledger SAS stated that a highly organized criminal group fitted some of its hardware wallets with hidden components. While Ledger initially linked the issue to CryptoBilis, the company is reviewing reports of implants found in wallets purchased elsewhere, indicating the problem extends beyond a single vendor. Social-media investigators examined the hardware and reported that the secret additions intercept passcodes sent to Ledger screens. The device then transmits those keys over cellular connections to external operators, allowing unauthorized access to funds.
“This reveals that crypto storage is an operational risk, not just a cryptographic one,” said Esme Pau, head of capital markets and policy at blockchain security firm CertiK. “Real-world security depends on the entire process.”
Ben Yorke purchased a Ledger Flex at a Metapod shop in Singapore’s Changi Airport. Before setting it up, he noticed subtle markings indicating someone may have tried to pry open the back of the case. Yorke sent the hardware to Mark Karpelès, a crypto founder-turned-researcher who runs Tibane Labs in Japan. Karpelès previously headed Mt. Gox, a digital asset exchange that suffered one of the industry’s most devastating hacks, and received a suspended sentence in 2019 for tampering with financial records related to that collapse, alongside an acquittal on embezzlement charges.
Hardware Modifications Versus Prior Software Flaws
Examination of Yorke’s device revealed a custom connector tapping into the display, alongside a cellular chip and SIM card. Karpelès noted that the engineering demonstrated an advanced level of physical intervention. This hardware-level compromise contrasts sharply with earlier vulnerabilities across the cold-wallet market. Over the summer, a software flaw in devices made by Coinkite Inc. exposed vulnerabilities resulting in an estimated $130 million in Bitcoin thefts. Soon after, Trezor experienced a data breach through a shipping provider that exposed personal information belonging to approximately 67,000 customers.
Flynn noted that users buy hardware wallets to reduce online exposure, but remain dependent on the software, services, and individuals involved in managing assets. Ledger continues an investigation that includes engaging with local law enforcement, while CryptoBilis has not responded to requests for comment.