Ledger users inspect wallets after reported $93 million theft

what happened

According to RBC Crypto, Ledger users worldwide have started taking apart their hardware wallets after reports that cryptocurrency worth tens of millions of dollars was stolen remotely from buyers in Asia. The first reports emerged on Friday, October 9: funds were leaving wallets even though the devices were not being used and no transactions had been signed. On-chain analyst Specter said more than $86 million had been moved in a coordinated operation from hundreds of addresses. Bitquery experts wrote on Sunday that about $93 million had been stolen from 315 wallets.

On October 10, Ledger confirmed that an extra chip had been found in one device. The affected users in Southeast Asia had bought their wallets from Ledger’s official reseller, CryptoBilis. The company suspended all sales and shipments of new wallets through that reseller. A user later reported finding a wallet with a chip that had been purchased in Europe. Users also warned that fraudsters sometimes send counterfeit devices and persuade victims to switch to a “new” wallet because of supposed update requirements.

Mark Karpeles, the former chief executive of the collapsed bitcoin exchange Mt. Gox, published a teardown of a Ledger Nano X shipped from Malaysia. He found a concealed module beneath the screen that intercepted displayed data, including the seed phrase during setup, and transmitted it over a cellular network. Modified devices may contain a 4G/LTE modem, an additional processor, wires and a hidden antenna, he said. Following Karpeles’s posts and Ledger’s confirmation, social media filled with hundreds of photos and videos of opened wallets. Ledger advised customers who bought wallets from CryptoBilis during the past three months not to begin setup, while those with configured devices were told to consider moving their assets to a new Ledger with a new seed phrase. Binance founder Changpeng Zhao suggested that hackers may have bought the reseller and forced it to sign a nondisclosure agreement. The Bitcoin Historian reported an unconfirmed version in which a Malaysian store presented itself as an “official authorized reseller,” installed chips in every wallet, repackaged the devices and shipped them to customers. Online users also debated whether Karpeles’s investigation could have triggered the mass attack: before news of the chips spread, the incidents were reportedly isolated.

why it matters

The case raises broader concerns about trust in hardware crypto wallets and could affect demand for Ledger devices, while the scale and mechanics of the compromise remain under discussion.

instruments