A Ledger crypto wallet bought at Singapore's Changi Airport contained a hidden spy implant, former Mt. Gox CEO Mark Karpelès said on Oct. 13 after taking the device apart.
Ben Yorke of crypto platform WOO said he bought the device, a Ledger Flex, from a Metapod store at Changi in June, Gizmodo reported.
He never plugged it in and, after noticing scratches on the casing, sent it to Karpelès. Ledger has not confirmed the finding.
Paris-based Ledger has asked resellers in seven Asian markets to pull its crypto hardware wallets from shelves after spy implants were found inside devices sold in the region, Bleeping Computer reported.
The Oct. 13 request, which also covers distributors, applies in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong while the company investigates.
Ledger said "the only confirmed incidents remain contained to Southeast Asia," that it had not verified a drain linked to a device bought elsewhere, and that it had no sign its own systems or direct sales channel had been compromised.
A hardware wallet stores the private keys to a user's cryptocurrency offline, out of reach of online hackers.
Ledger opened its investigation on Oct. 9 after users reported stolen funds. All confirmed losses involve devices sold through CryptoBilis, a Malaysia-based reseller, and Ledger confirmed on Oct. 10 that one affected user's device contained an unauthorized hardware implant.
CryptoBilis has stopped selling Ledger devices while the investigation continues, the company said.
 |
|
A Ledger Nano X hardware wallet. Illustration photo by Unsplash/Amjith S |
According to Ledger's security team, Donjon, the implant sits inside the casing and reads what appears on the screen. When the wallet displays its 24-word recovery phrase during setup, a microcontroller decodes the words and sends them out over a mobile network using an eSIM.
Anyone holding that phrase can restore the wallet and move its funds. Because the implant leaves the device's secure chip and software untouched, Ledger's own "Genuine Check" tool cannot detect it, The Hacker News reported.
The outlet said researchers at Tibane Labs have documented three versions of the implant, the most advanced of which was bought on Amazon Japan from a China-based seller and shipped from Malaysia.
Pseudonymous blockchain investigator Specter estimated that more than $86 million had been stolen, and analytics firm Bitquery has since traced $102 million drained from 324 wallets across six blockchains.
Ledger said it had not confirmed the number of affected users or the total lost, and that figures circulating online came from third parties.
Besides the Changi device, a second tampered Ledger was reportedly bought from a Challenger store at VivoCity mall in Singapore, according to The Straits Times.
Ledger, which began selling through Challenger's VivoCity and Bugis stores in March, has not said whether the Singapore devices are linked to the CryptoBilis cases. It said it is reviewing reports of implants in other devices and locations.
In Europe, electronics retailer MediaMarktSaturn stopped selling Ledger devices in its stores and online on Oct. 13 after a customer in Germany reported an implant, Ledger said.
On Oct. 14, Ledger said its team had inspected devices from retail and distributor stock across Germany, including units from the stores named in the reports, and found no sign of tampering. No loss of funds linked to implants has been reported anywhere in Europe, it said.
Ledger's devices are made and assembled in France, Hungary and Vietnam, according to its website.
Ledger has told anyone who bought a device from CryptoBilis not to set it up, and those who already have to move their assets to a new device with a new recovery phrase.