protos.comarticleGerman Ledger reseller pauses sales following $86M draining incident
Protos reports that German retailer MediaMarkt pulled all Ledger products after teardowns of Ledger hardware wallets showed physical spyware implants, tied to an $86M drain of wallets bought from Malaysian reseller CryptoBilis. Ledger's investigation concluded the implant recorded the 24-word recovery phrase and sent it out over an attached eSIM. Mark Karpelès has helped identify implants in dismantled devices from MediaMarkt, LazMall (Philippines), CryptoBilis and Metapod (Singapore airport). Ledger has so far confirmed only the CryptoBilis devices and says it is reviewing reports of implants elsewhere.
TL;DR Tampered Ledger wallets sold through resellers carried eSIM implants that exfiltrated seed phrases, causing an $86M drain and MediaMarkt pulling the product.
Organisations named here
- LazMall
- Mark Karpelès
- MediaMarkt
- Metapod
Technologies named here
- Ledger
Techniques named here
- Hardware implant / supply chain tampering
Threat actors named here
- CryptoBilis
Related in Hardware & RF
eprint.iacr.orgpaperHAETAE on a Diet: Less Stack, Less Time on Low-End Microcontrollers
github.comrepogeo-tp/ESP32-Bit-Pirate
github.comrepo