Who Is Planting Backdoors in Ledger Crypto Wallets?

After crypto wallet maker Ledger announced Friday that a backdoor embedded in a handful of Ledger wallets sold in SouthEast Asia allowed thieves to hijack around $102 million in crypto from their owners, news has emerged of other Ledger wallets sold in Germany also having implants.The hardware implants were originally found on an unknown number of Ledger Nano X wallets sold by an authorized Ledger reseller called CryptoBilis based in Malaysia. Ledger said the implants were found on a limited number of devices, all sold by the same seller. But a Ledger device owner in Europe has since said that he found an implant on a Nano X that he purchased at a large European electronics chain store in August and a second one he purchased this weekend at another store in the same chain. He believes these indicate that Ledger’s supply-chain has been compromised.Since then, users and researchers have also reported finding implants in Ledger Flex and Ledger Stax devices – two of Ledger's more recent line of devices used for securely storing keys used to access a device owner's crypto accounts.The implants are not the first to be found on Ledger wallets. Famed hardware hacker Joe Grand found implants on several Nano X wallets earlier this year and notified Ledger about them in March, raising questions about Ledger's urgency in addressing the issue. Many of the implants discovered more recently appear to be more sophisticated iterations of the ones that Grand found. The implants Grand discovered were also all in wallets sold by unauthorized online sellers who seemingly ran fly-by-night operations that weren’t in business for long. But the implants found in wallets sold by CryptoBilis and the European electronics chain indicate the attackers have switched tactics and may be deliberately compromising wallets sold by authorized resellers now. Ledger and its competitor Trezor have cautioned users for years to buy wallets only from their web sites or from authorized resellers. But the recent compromises indicate that attackers are deliberately targeting authorized sellers to exploit customer trust in them and to get wider distribution for implanted devices. What’s more, the attackers have become more skilled and systematic in their method for compromising the wallets, making it more difficult to detect the implants, Grand and other researchers say.It's not clear how long the implants have been sitting in the sold devices, but last week a coordinated heist resulted in millions of dollars in crypto being stolen from the device and accountholders. According to blockchain research company Bitquery, crypto was stolen from about 315 accounts connected to compromised CryptoBilis Ledger devices alone, and is currently valued at around $102 million. The stolen funds include Bitcoin, Ethereum and Tron and other cryptocurrencies. Some of the funds have reportedly been frozen in the accounts to which the thieves transferred it, and other funds appear to be in accounts that have been flagged for fraud. And it's not clear if funds were also stolen from Ledger owners who purchased their devices from other sellers. Ledger, based in France, wrote in statement posted to X that it had asked CryptoBilis to halt all sales and shipments of Ledger devices until it could conduct an investigation. CryptoBilis — which is authorized to sell Ledger wallets in Malaysia, Indonesia and the Philippines — wrote on its web site that it is cooperating with Ledger’s investigation.But a user going by the name Johannes wrote on X over the weekend that he had purchased a Ledger Nano X wallet in person from a MediaMarkt store that had an implant. MediaMarkt is Germany’s equivalent to BestBuy and has 1,000 stores in ten European countries. It’s listed as an authorized reseller of Ledger wallets in Austria, Germany, Spain and Turkey.Johannes told Zero Day he purchased the wallet in August in a MediaMarkt store in Germany but only took the device apart this weekend following reports that implants had been found. He posted photos of an antenna and implant in his device. Johannes said that he has had no crypto stolen.Images posted to X by Johannes, who says he found implants in two Ledger wallets he purchased in person from MediaMarkt stores in Germany.In an update to X this weekend, Ledger suggested the implant problem may stem from authorized resellers obtaining Ledger wallets from illegitimate sources or reselling wallets that were bought and returned to them — after being compromised.“We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products,” Ledger wrote. “This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users…. Raising the bar on physical supply-chain integrity benefits the entire ecosystem.”But Johannes, who purchased a second Ledger wallet from another MediaMarkt store on Monday and found an implant in it as well thinks this suggests that Ledger’s supply chain has been compromised.“This indicates a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe,” he wrote on X. He says he initially thought his two compromised devices might have been return items that the store then resold as new, but a MediaMarkt employee told him they were new devices and that returns are sent back to Ledger, not re-sold.Ledger did not respond to an inquiry from Zero Day, but the company wrote on X that there is currently "no indication that Ledger's security infrastructure, systems or services have been compromised.The issue raises questions about Ledger’s response to the implants and its transparency to customers. After Grand notified the company last March about implants he found in Ledger wallets, the company told him it would investigate to determine who was behind the implants. But Grand says he never received any followup until months later when he asked about it, and someone at Ledger told him they had found no evidence that someone had used the implants to steal crypto from device owners.But the situation began to change after this. If you find this article valuable, you can leave a one-time tip to express appreciation to the author.