$100M across 500+ addresses so far. Crypto hardware wallet owners are freaking out because of a new supply chain attack. Let’s see how we could make it worse!
People are opening their hardware wallets to look for hardware implants. REMINDER: 5 years ago I converted a Ledger into a malicious wallet WITH NO VISIBLE CHANGES. So visual inspection isn’t everything.
The attack seen today is a hardware backdoor that reads the seed phrase right off the screen & sends it to the attacker using its own cellular radio. And it seems the attacker may have purchased an official Ledger reseller so they could ship backdoored wallets to customers. (It’s all still unfolding, not everything is confirmed, new implants are showing up, etc)
A Chinese company bought an official reseller of Ledger, & possibly used an NDA to prevent it from being made public. I will say that even if the new owner wasn’t complicit, mergers & acquisitions are very attractive times to target a company. Lots of stuff is changing quickly, lots of new names, lots of urgent needs, etc.
In theory, the reseller is where they inserted the implants. They opened legit Ledger wallets and added an extra PCB with extra components. The implant tapped the lines of the Ledger’s screen & was able to read the seed phrase exactly as shown to the user. This phrase was then sent out over a slow cellular radio designed for low traffic IOT.
Tapping the screen has been a known attack. Joe Grand did a talk on it earlier this year. We have seen more “primitive” looking implants that do it.
But buying a company is a big step forward from prior attempts. I wouldn’t be surprised if there was some state funding here. I guess we will find out as people dig into the corporate paper trail of the business, the account associated with the cell service, etc.
Hardware wise, they cleaned things up a lot to make it less noticeable to a wallet owner who opens the case. But I can’t help but wonder why they didn’t improve a few areas… I’ll go into that in replies to this post.
🧵1