Encrypted hardware wallet company Ledger discovered a disturbing detail in its investigation into a suspected crypto theft incident: it was found that at least one hardware device had an suspicious external component inserted into it.
Ledger The latest update was released on October 10th, stating that this suspicious hardware was found in the device of an affected user. This device is related to a recent CryptoBilis security incident. CryptoBilis is an authorized distributor in Southeast Asia.
This is the first time specific evidence of hardware tampering has been discovered during the investigation process. This means that some Ledger wallets may have been manipulated before they were even delivered to the users.
It is not yet clear whether this implant is related to these alleged thefts, nor is it known how many devices may be affected.
In addition, Ledger indicates that, as a preventive measure, CryptoBilis has suspended the sale of all hardware wallets until the investigation is completed.
Ledger also indicates that the company is in contact with the affected users and is cooperating with law enforcement authorities to investigate the individuals involved in the case.
This suspected attack is particularly concerning because the attackers may not even need to infiltrate the security components—namely, the chips within the Ledger devices that are used to generate and protect private keys. The so-called suspicious external hardware is said to be intended to connect to the communication lines between different parts of the wallet and the screen.
Mt Gox CEO investigates mysterious spy implants
While conducting investigations into this purportedly mysterious hardware at Ledger, the former defunct cryptocurrency exchange Mt. The CEO of Gox, Mark Karpel, is also investigating this type of suspicious hardware found in Ledger wallets.
Karpel posted on October 10th stating that he had independently identified these hardware changes. At that time, he was reviewing images sent to him by affected users.
"I also confirmed this from the images sent to me by affected users," Karpel stated on X.
He encourages those who own these devices and are willing to donate them for analysis to contact him directly.
In subsequent updates, Karpel indicated that he had actually disassembled a suspicious hardware component found in a hardware wallet for analysis.
"Disassembling a spy implant from an encrypted wallet is probably the most cyberpunk thing I've done this year," he joked.
Previously, Karpel reported that a Ledger Nano X device from Malaysia that he had inspected contained a hidden electronic component, although it still appeared to be in its intact heat-shrinked packaging.
