Tainted Ledger crypto wallets: Problem bigger than thought
Someone is secretly installing LTE modems in new crypto wallets. Buyers have lost over 100 million dollars. Manufacturer Ledger communicates little.
A model of a hardware wallet from Ledger
(Image: andersphoto / Shutterstock.com)
Hardware wallets for cryptocurrencies are intentionally offline to reduce security risks. However, unknown parties are modifying these offline wallets from the French provider Ledger before they go on sale. An additional chip captures screen content, an LTE modem with eSIM transmits the information to the perpetrator, who thus gains control over the cryptocurrency assets “secured” with the wallet’s generated seed phrase. The Secure Chip Element remains untouched. The extent of the problem is greater than initially assumed: longer, higher, more, and wider – Germany is also affected.
Several Ledger models are impacted, not just the Ledger Nano X. Tainted devices have been in circulation for some time, and the extent of the damage is greater. Furthermore, the perpetrators' reach is wider: manipulated Ledger wallets have now appeared in Singapore and Germany, distributed by different retailers, supplied by various suppliers.
There is hardly any information about this on Ledger’s website. Advertising claims like “Hackers cannot access your keys via the internet because they are stored offline” remain unchanged. Only at https://support.ledger.com/article/15158192560157-zd can a paragraph from October 9th be found, stating that Ledger “is investigating reports of losses among users in Southeast Asia” and advises customers who have purchased Ledger wallets from Cryptobilis in the last 90 days not to use these devices. If they have already done so, they should “consider” transferring their cryptocurrency to other wallets.
Longer than 90 days
In fact, tainted devices have likely been in circulation for much longer than 90 days and have not only been distributed via Cryptobilis. Bitquery analyzed public data from six different blockchains and estimates the total damage up to October 13th at the equivalent of 102 million US dollars, stolen from 324 different wallets. Tether has frozen USDT stablecoins worth ten million US dollars; the perpetrator can still access the rest. The damage is so considerable because large speculators are more inclined to bear the cost of a hardware wallet. This naturally makes their users more attractive targets.
According to Bitquery’s analysis, 40 percent of the wallets known to be drained received their first transfer more than 90 days ago, meaning they have existed for longer. A significant portion in June, but there are even two dozen wallets that became active for the first time in 2024 or 2025. Ledger’s warning about devices purchased from Cryptobilis in the last 90 days is obviously too limited.
Videos by heise
As early as May, an American embedded specialist publicly presented a manipulated device. It was an early, cruder modification, but it was also undetectable from the outside. In other discovered wallets, the additional components come from professional series production. There are several iterations; the crime has been planned for a long time.
This is also shown by two further discoveries by Bitquery: at the end of September/beginning of October, the perpetrator first practiced with small test transfers for two weeks. And the large-scale access was then at least partially automated. For example, it released 25 foreign TRON wallets for transfers within just three seconds. Within six seconds, USDT worth 29 million US dollars were gone.
Germany and Singapore
A German reported online that he had purchased a Ledger wallet at MediaMarkt Saturn back in August, which has now turned out to be tainted. On Monday, he bought a second device at another MediaMarkt Saturn branch, which is also manipulated. His short video shows the opening of an originally packaged hardware wallet with telltale add-ons inside. The supplier was an Austrian distributor, not Cryptobilis. MediaMarkt Saturn will not sell Ledger wallets for now.
Two other individuals have stated that they purchased manipulated Ledger Flex hardware wallets in Singapore. Ledger Flex is larger than Ledger Nano X and therefore easier to tamper with. One device was reportedly bought in a shopping mall, the other from a vending machine at the city-state’s airport. The vending machine operator is, like Cryptobilis, an official Ledger reseller and also operates in other Asian countries.
The crypto wallet taken from the vending machine shows a small scratch, which led the buyer to suspect a previous opening. He sent the product to Frenchman Mark Karpelès, who is known as the convicted founder of the former crypto exchange Mt. Gox. Karpelès has released a video showing him opening a Ledger Flex and also finding an implant inside. Thus, Ledger’s warning about devices purchased from Cryptobilis in the last 90 days is also too limited in terms of dealers and distributors.
Empfohlener redaktioneller Inhalt
Mit Ihrer Zustimmung wird hier ein externes YouTube-Video (Google Ireland Limited) geladen.
Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (Google Ireland Limited) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.
(ds)
