protos.comarticleLedger spyware scare spreads beyond Southeast Asia
Protos reports additional alleged Ledger hardware wallets with physical spyware implants, found in devices from a German MediaMarkt reseller, a Philippine LazMall reseller and a Stax model bought from CryptoBilis. Mark Karpelès found that the implants read the device's screen output to capture seed phrases and evade Ledger's Genuine Check. The earlier CryptoBilis-linked incident of Oct 9 drained over $86M. Ledger told resellers to use only authorized channels and never restock returned units, and teardowns have also shown many devices to be clean.
TL;DR Physically implanted spyware in Ledger wallets, which reads screen output to steal seed phrases and passes Genuine Check, is reported beyond the CryptoBilis reseller case, which drained over $86M.
Organisations named here
- LazMall
- MediaMarkt
- seed phrase theft
Technologies named here
- Ledger Genuine Check
- Ledger Stax model
- Ledger
Techniques named here
- Hardware supply chain tampering
- Resale of returned/restocked products as a possible channel
- Hardware implants
Threat actors named here
- CryptoBilis
Also named here
- Genuine Check
- Mark Karpelès
Related in Hardware & RF
eprint.iacr.orgpaperHAETAE on a Diet: Less Stack, Less Time on Low-End Microcontrollers
github.comrepogeo-tp/ESP32-Bit-Pirate
github.comrepo