Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts

Ledger, a well-known cryptocurrency hardware wallet manufacturer, has confirmed that certain devices purchased from an unauthorized Southeast Asian reseller have been tampered with. The compromised hardware implants within these devices have been draining users' cryptocurrency wallets. The investigation began after reports surfaced of users losing funds from wallets acquired through a prominent Malaysian hardware wallet retailer, CryptoBilis.

Researchers have uncovered the existence of the implant since September 16, revealing that the tampered devices were being sold at a significantly lower price compared to the original hardware. The threat actor managed to fit the malicious circuitry by replacing the original battery with a smaller one, allowing the implant to power both the device and the Ledger X. Underneath the battery and antenna, the researchers discovered an ST STM32G431KBU6 microcontroller, complete with 128 KB of flash memory, housed within a 32-pin surface-mount device package.

To transmit the stolen data, the attacker utilized a tiny eSIM module, just 2x2 mm in size, alongside a shielded LTE module. Ledger has issued a warning to users, urging them to purchase devices exclusively from authorized resellers to avoid the risk of acquiring counterfeit or modified equipment. Additionally, the company advises its authorized resellers and distributors to source products solely through legitimate channels and to refrain from restocking returned items.

Ledger has incorporated a "Genuine Check" mechanism to help users confirm the authenticity of their devices; however, the company explicitly states that this feature cannot detect the presence of added implants if the device's original Secure Element remains intact. Users are strongly encouraged to exercise caution when purchasing cryptocurrency hardware wallets to protect their digital assets.