Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts

Longtime Slashdot reader AmiMoJo shares a report from BleepingComputer: Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia. Some researchers have shown the implant in Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware. [...] In a report over the weekend, Tibane Labs notes that the threat actor made room for the malicious circuitry by replacing the original battery with a smaller one, which powers both the implant and the Ledger X. "Under the battery and antenna sits an ST STM32G431KBU6 (Arm CortexM4, 128 KB flash, UFQFPN32)," the researchers found inside one of the devices. For connectivity, the actor used "a tiny eSIM, an 8pad package just 2x2 mm, next to the MCU, and a shielded LTE module that sends the words out." [...] Ledger is advising users to avoid purchasing from unauthorized resellers as they run an increased risk of getting counterfeit or modified devices. The company is also reminding its authorized resellers and distributors to get the products only through authorized channels and to avoid restocking returned products. Ledger provides a 'Genuine Check' mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device's original Secure Element remains intact.

Read more of this story at Slashdot.