hack or exploit

Ledger confirms unauthorized hardware implant; losses may exceed $86M

0Importance
closedStatus
2News media
3Pieces
Published
Updated
Since then
2 new reports
In
Wallets and custody

Ledger said unauthorized hardware implants affected user devices, and distributor CryptoBilis paused sales of the affected inventory. Ledger also said the incident appeared to be confined to one reseller and its Southeast Asian market, while later coverage described a hidden LTE chip that read 24-word recovery phrases during setup without changing the Secure Element or software.

Share on X Share on Telegram Share on Reddit Share on WhatsApp

Key claims & sources

✓
Ledger said the incident appeared to be isolated to a single reseller and its Southeast Asian market.
Ledger confirms unauthorized hardware implant; losses may exceed $86M
✓
Ledger said unauthorized hardware implants affected user devices.
Ledger Confirms Hardware Implant Attack as Losses May Exceed $86 Million
✓
Distributor CryptoBilis paused sales of the affected inventory.
Ledger Confirms Hardware Implant Attack as Losses May Exceed $86 Million
✓
Ledger said the hidden chip read the 24-word recovery phrase from the screen during setup while the Secure Element and its software stayed untouched.
Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain

What it means

People using Ledger devices and the reseller channel are the most immediate group affected today, because the affected inventory was taken off sale and the issue was described as touching user devices. Customers in the Southeast Asian market also have a specific reason to notice this now, since the incident was described as isolated there and to one reseller.

What remains open is the full scope of the affected inventory and the final size of the losses, which were described as possibly exceeding $86 million. It is not known from these items whether the incident stayed limited to the reseller and region already named, and the details that would settle that are a complete inventory review and a broader device-by-device accounting. (per cointelegraph.com)

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market
first headline
0.0% 2 h before
-0.9% 4 h after
$2.8Tmarket cap at publication
12data points

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 11 09:01
+2 d 2 h
Oct 13 11:53
Decrypt adds
Brings into the story: LTE, with quotes
+3 d 4 h
Oct 14 13:47
Decrypt context
Its angle: electronics, mediamarkt, resellers

Thefts of a similar size

WhenWhat happenedFigure
1.4 years ago Nobitex · Malware incident $90M
3.0 years ago Heco Bridge · Hot Wallet Key Compromised incident $86.6M
1.8 years ago Phemex · Hot Wallet Key Compromised incident $85M
6.2 years ago Coinbit · Scam incident $85M
1.4 years ago Nobitex · Malware incident $82M

4282 incidents stored · 87 were as large as this one or larger ($86M)