Bugged wallets: Ledger calls it an “attack on the whole industry”

Contents

Bugged hardware wallets for cryptocurrencies have cost users dearly. From Oct. 9 to 13, the total haul amounted to at least $102 million. The affected manufacturer, Ledger, had little to say, even though it has been known since May at the latest that bugged wallets were in circulation. On Thursday, Ledger finally spoke up and tried to reassure customers: “This was not a systemic supply chain attack, it was a localized distribution attack.”

“A highly organized criminal group carried out one of the most sophisticated attacks our industry has seen. Over many months, they bought genuine Ledger devices, opened them, fitted custom-built components (...) and put them back into distribution through resellers in Southeast Asia,” Leder writes.

Unfortunately, Ledger does not say which distributors sold the tampered wallets. Sales in Asia have been confirmed, but a German customer reported buying bugged Ledger wallets at MediaMarkt Saturn in August and again last week. An Austrian distributor is said to have supplied them; heise online has contacted the distributor for comment. MediaMarkt Saturn has temporarily stopped selling Ledger products.

Patient attackers with a multimillion-dollar budget

Ledger says the attackers “built their own logistics and technology infrastructure with seeds collector servers, draining and laundering” the proceeds. “They were patient, they spent millions, and they struck in one coordinated operation.”

Ledger says test purchases of its own devices from retailers, including in Germany, did not turn up any more bugged wallets. Spot checks of warehouse stock and extensive spot checks of its own inventory also found all devices to be clean.

No details yet on product improvements

This attack was against our users and, let’s not kid ourselves, against the whole industry,” the French company says. It reminds its distributors and authorized retailers never to offer returned products to other customers. Any irregularities reported by customers must be reported immediately.

From now on, Ledger devices are not to be displayed on shelves or in cases. Instead, they should be stored out of sight and handed over only when purchased. This is intended to stop attackers from planting tampered products on other retailers’ shelves as bait.

Ledger hopes competitors will impose the same restrictions and is willing to share its experience. “We have also been working on additional measures to thwart this kind of attack at the product level.” The company has not provided further details.

How the attack works

The attackers obtain genuine hardware wallets, open them and add a tiny chip that captures what appears on the screen. They also install an LTE modem with an eSIM that sends the seed phrase displayed on the screen during wallet setup to the attackers. This gives them control over the cryptocurrency holdings “secured” by that seed phrase.

The tampered devices reach authorized retailers by unknown means, and then make their way to users. The bugged Ledger wallets look factory-sealed, and usually nothing looks amiss on the outside, either. The basic method has been publicly known since May, when the modifications were comparatively crude. By now, the operation is so professional that even when devices are opened, nothing suspicious is visible except for an antenna that should not be there.

The haul is usually substantial, since high-volume speculators are more likely to pay for a hardware wallet. An analysis by Bitquery identified 324 affected wallets from which the attackers took cryptocurrency worth a total of $102 million from Oct. 9 to 13 — an average of €282,000 per wallet.

(ds)