In its latest update, Ledger confirmed that the victims of the recent exploit had wallets with an ‘unauthorized implant.’ As part of their ongoing investigation, the reseller has reached out to impacted users and paused sales of its remaining inventory.
Additionally, users who already acquired a wallet from the reseller are advised to avoid setting up and linking their addresses.
AMBCrypto had earlier reported that the wallets from CryptoBillis had implanted spyware that captured and sent seed phrases to a server. As such, the attacker can easily drain wallets without a multi-sig setup.
Ledger pledged better security to match the evolving threat landscape.
Security is a constantly evolving landscape; Ledger is continuously adding security mitigations and is working on further, enhanced anti-tampering solutions.
Ledger supply chain attack: More resellers, regions compromised?
Unfortunately, there were speculations that the supply chain incident may not be isolated to CryptoBillis only.
According to CryptoQuant analyst Darkfost, the risks could be far-reaching. According to him, more than seven resellers and e-commerce platforms could be at high risk, citing regional proximity.
Some other reseller names have also come up in discussions, such as Lazada merchants.
He cautioned that,
If you bought a Ledger less than 6 months ago from one of these resellers, it may be wise to move your assets to safety until the matter is resolved.
As of the 9th of October, $91M had been siphoned from affected devices, affecting over 470 addresses. If the supply chain attack goes beyond what some speculate, then losses could rise even higher.
Back in July, renowned security researcher ZachXBT warned that “all hardware wallets are complete garbage.” Going by the recent events, his take is being validated. Coldcard lost over $100M after a firmware exploit.
Trezor experienced a major data leak that exposed shipping details, names, and physical addresses of users. SafePal also suffered a data breach, and Ledger has joined the security crisis.
Simply put, hardware wallet users are either losing money through hacks or facing the risk of kidnapping and ransom threats after data breaches. A lose-lose situation that could kill self-custody, according to Ark Invest’s Lorenzo Valente.
That said, some hardware wallet firms like OneKey have taken the incident as a lesson to include tamper-proof and other extra security features.
However, Zach Herbert, CEO of Foundation, another wallet provider, warned that most hardware wallets made in China or the broader Asian region could be targeted, including Ledger.
Asian-based wallets like Keystone and OneKey could even have a higher threat risk, per Herbert. But even Europe is at risk.
Final Summary
- Ledger confirmed that some devices sold by CryptoBillis had spy implants.
- Speculation is rife that the supply chain attack may go beyond just one reseller or e-commerce platform.
