Ledger Finds Unauthorized Hardware Implant in Crypto Bilis-Sold Wallet Amid Fund Theft Reports

Summary: Ledger paused sales through reseller CryptoBilis after reports of stolen funds from users in Southeast Asia, with losses said to exceed $86 million according to pseudonymous investigator Specter. Ledger later confirmed one impacted user's device contained an unauthorized hardware implant that reads the 24-word recovery phrase from the screen during setup and transmits it over LTE via a provisioned eSIM, without modifying the Secure Element or Ledger's operating system.
Why it matters: The implant defeats the assumption that an intact Secure Element means an intact device - Ledger itself warned its Genuine Check cannot detect unauthorized physical modifications to the hardware. With more than $86 million in reported losses and confirmed cases contained to Southeast Asia and Hong Kong, the tampering happened somewhere in the distribution chain before the device reached the buyer.

Read the original at The Hacker News ↗