Ledger, a leading provider of cryptocurrency hardware wallets, has reported the discovery of unauthorized hardware modifications in a device linked to a recent security incident. The company found a rogue component inside a user’s wallet purchased via the authorized Southeast Asian reseller CryptoBilis.
Hardware tampering raises security concerns
The investigation uncovered, for the first time during this case, physical evidence that at least one Ledger device had been tampered with prior to reaching the customer. The modified device contained a foreign hardware implant, raising fears about the potential exposure of user funds and the distribution reach of the compromised wallets.
The specific function and impact of the implanted component remain unclear, and Ledger has yet to determine how many wallets might be affected. However, the company has confirmed it is working with law enforcement agencies and contacting users who may have been impacted by the incident.
Ledger stated in its latest update that it discovered rogue hardware inside a user device tied to the CryptoBilis security incident and is actively cooperating with law enforcement and affected users.
According to Ledger, attackers may not have required direct access to the secure element responsible for generating and protecting users’ private keys. Instead, the unauthorized hardware component appears to intercept and monitor communication lines within the device, potentially compromising sensitive information displayed on the wallet’s screen.
CryptoBilis has halted all hardware wallet sales as a precaution until the investigation concludes.
Mini dictionary: CryptoBilis is an authorized distributor of Ledger hardware wallets based in Southeast Asia, responsible for retailing secure devices used to store cryptocurrencies offline.
Mark Karpelès launches independent investigation
Mark Karpelès, former CEO of Mt. Gox, the collapsed Bitcoin exchange, has also been investigating the case independently. Using photographs provided by affected users, Karpelès confirmed earlier reports of anomalous components found inside Ledger wallets suspected to be compromised.
Karpelès reached out via social media, requesting that individuals in possession of suspicious devices donate them for further technical analysis. He revealed that he had personally dismantled and examined one of these implants, hoping to better understand its structure and operation.
Dismantling a spy implant from a crypto wallet is probably the most cyberpunk thing I did this year, Karpelès remarked, reflecting on the unusual nature of his findings.
In previous updates, Karpelès reported detecting hidden electronic parts inside a Ledger Nano X device originating from Malaysia, even though the package appeared factory-sealed with shrink-wrap.
The cross-involvement of major industry figures and resellers has intensified scrutiny on hardware wallet integrity, shining a spotlight on the ongoing risks of supply chain attacks targeting cryptocurrency users globally.
