Reports about wallet-draining by Ledger users. Total losses $86M+

[NotATether]

What country is that? Here, banks removed the bullet proof glass a few decades ago, there's no armed security, nobody gets patted down, and they probably barely have money there anyway. Money is transported in armored cars, but without additional security, only "paint suitcases".

My place I'm staying at (Ethiopia).

I was even stopped by a new guard on the way to the office today who was verifying I actually worked there.

Barely have money there anyway? I get there's a huge e-wallet scene in the EU, especially NL, but I am quite surprised by this.

[goldkingcoiner]

What country is that? Here, banks removed the bullet proof glass a few decades ago, there's no armed security, nobody gets patted down, and they probably barely have money there anyway. Money is transported in armored cars, but without additional security, only "paint suitcases".

My place I'm staying at (Ethiopia).

I was even stopped by a new guard on the way to the office today who was verifying I actually worked there.

Barely have money there anyway? I get there's a huge e-wallet scene in the EU, especially NL, but I am quite surprised by this.

I think most of security is in reality security theatre. not meant to actually protect anyone or anything but make it seem too dangerous to rob. Which may or may not be true. But even here in Europe, everytime I see a money transporter it's just two guys. Sure they are armed but not to the teeth.

Or maybe they transport just enough money for it not to be lucrative for criminals? I am not aware.

[pawel7777]

According to this post from X, MediaMarktSaturn is suspending sales of all Ledger devices after a security researcher discovered two devices containing implants.
We are talking about 1000 stores in 11 countries.
The chain leading to the source of the compromise has not yet been built.

Yeah, I posted his X post earlier in this thread. If the guy is telling the truth and he indeed purchased two devices at two different locations, and both of them were infected, then it's reasonable to assume that all devices have been tampered with.
Luckily, Mediamarkt (who also owns Saturn) today decided to pull out all Ledger wallets from their stores:
https://cointelegraph.com/news/mediamarkt-pulls-ledger-wallet-security-incident

There are some other big retailers who also offer Ledger wallets, like UK's Currys, I hope they too are at least aware of the issue. The story is making rounds in the crypto world, but I'm not sure if there's enough coverage in the mainstream media to make everyone aware.

[nikola22]

meanwhile, Trezor is reducing the number of resellers as a preventive measure:

https://x.com/Trezor/status/2110000774314873020

it seems to me that reducing the number of resellers isn't a comprehensive enough measure to secure the supply chain. ideally, there should be a single production location for hardware wallets where everything can be monitored more rigorously. Ledger, for instance, manufactures different models in several countries. this guy (https://x.com/Cyphertux/status/2109695312050765966) managed to find information regarding place of production of Ledger devices:

Nano X - France
Nano S Plus black - Hungary
Stax - Vietnam
Flex - Vietnam
Nano Gen5 - Vietnam

it is hardly surprising that there has been no clear response from Ledger so far, given the scattered production locations and the additional factor of suppliers for individual components.

 

[Dogedegen]

Then let them bypass it, too. Give them 5 obstacles to bypass. 5 is better than 1.

You want to open the device, fake the holographic sticker first. Then fake the box, too. Fake the sticker on the device as well.

There's nothing wrong with putting several layers of security measures for buyers to readily check. A holographic sticker that looked somehow different could have saved one from losing all his/her lifesavings. With Ledger's misplaced confidence, customers are left with nothing to check, either for legitimacy or integrity or whatever. Nobody checks unmarked plastic wrappers seriously. They could be perfectly faked even with a sidewalk vendor.

"Engineered to be tamper-proof" my foot! A can of sardines or a jar of sandwich spread seems more protected.

I've bought 3 hardware wallets so far. It's Ledger that overconfidently offers almost zero packaging protection.

Don't get me wrong, I fully agree with you. I was merely thinking that there is no way that this can be fully prevented at all, at least not that I know of from a hardware perspective. They can only make it harder by including different things, from the hardware validation which seem to have failed in this case, to the stickers that were mentioned, to some supply chain validation and that. The more things are added the better, and I don't think these things add that much cost on a scale. Definitely those stickers are pretty cheap, so that part of the weak protection can be blamed on Ledger.

As a person who works in the field of printing design, it is easy for me to make anti-tampering stickers like this because it can be Custom or made like the original stickers made.

But some Original VOID stickers with Holograms and special codes may be a marker, but some other supporting methods are needed for higher security such as cryptographic verification of devices,
protecting devices from the Design to Distribution stage, because the device distribution chain also needs to be strictly audited.

And the Licensee as a Distributor or Reseller also needs to be strictly audited if the company is acquired by someone else,
but there is no official report from Ledger about further audit on the Cryptobilis Acquisition Process.

I would not expect a company of this scale to use basic anti-tampering stickers if they were going to add them, but they should do something more after this case.

meanwhile, Trezor is reducing the number of resellers as a preventive measure:

https://x.com/Trezor/status/2110000774314873020

it seems to me that reducing the number of resellers isn't a comprehensive enough measure to secure the supply chain. ideally, there should be a single production location for hardware wallets where everything can be monitored more rigorously. Ledger, for instance, manufactures different models in several countries. this guy (https://x.com/Cyphertux/status/2109695312050765966) managed to find information regarding place of production of Ledger devices:

Nano X - France
Nano S Plus black - Hungary
Stax - Vietnam
Flex - Vietnam
Nano Gen5 - Vietnam

it is hardly surprising that there has been no clear response from Ledger so far, given the scattered production locations and the additional factor of suppliers for individual components.

It is not enough but every step helps.

[BitMaxz]

I'm actually thinking about how the SIM has unlimited data internet?  My mind tells me if I have this, I might use that SIM card for unlimited internet if it exists. What do you think? It's free data lifetime.

It's likely for a limited amount of data or time. I have never seen an unlimited forever for sale.

Well, I have never seen any with unlimited forever unless it is enterprise postpaid plans where they can subscribe for annual unlimited data.
Since they know the SIM number, they can reload and subscribe to a new plan.

Since new SIM cards need to register the owner's name, maybe those who are affected can try to find a phone technician to connect that SIM card to a phone where they can read all SMS and get the exact SIM number. So that you know what network the SIM card is on or who is the provider.
I think we can ask for the name of the owner if it was a fully registered SIM card. If the SIM provider registered his name, we will need law enforcement here to investigate.

I think the only ones who can request to this are those who are affected by lost funds.

[Forsyth Jones]

I would not expect a company of this scale to use basic anti-tampering stickers if they were going to add them, but they should do something more after this case.

These seals shouldn't be the main way for detecting tampering (seals are more present in Trezor devices), they also confuse some users, as devices sometimes arrive with misaligned or inconsistent seals, I’ve seen many people requesting replacements. Additional security checks that are relatively simpler than opening the device should be considered, the only other real options are downloading a software wallet and using it on an airgapped PC.

I own both a Ledger nano X and a Trezor Model T, I’ll keep using them but will reduce the amounts held on them. I won't open the devices myself, as I lack the technical skills to do so.

[Dogedegen]

I would not expect a company of this scale to use basic anti-tampering stickers if they were going to add them, but they should do something more after this case.

These seals shouldn't be the main way for detecting tampering (seals are more present in Trezor devices), they also confuse some users, as devices sometimes arrive with misaligned or inconsistent seals, I’ve seen many people requesting replacements.

Well we have to make up our minds whether it is better that they include stickers or that they don't. There will be some downsides like you mention, but if it only affects a very small percent of people I think that it is worth it. We can't really make decisions based on what a small number of people do. The companies could refuse replacements if the issue is not really present.

Additional security checks that are relatively simpler than opening the device should be considered, the only other real options are downloading a software wallet and using it on an airgapped PC.

But how exactly do you think an airgapped PC would protect you from this attack or are you talking about other attacks? In the case that we have here, airgapping does not protect you at all since there is an embedded esim that is directly communicating from the hardware wallet. Ledger has some kind of implementation in the software already that checks if the wallet is genuine, but that does not help with something like this either and their other claims of being tamper proof has also fallen flat. I am just not sure if you could develop a software that runs on a desktop and that could detect any kind of tampering of this kind. I think it has to be at the firmware level or the physical hardware.

I own both a Ledger nano X and a Trezor Model T, I’ll keep using them but will reduce the amounts held on them. I won't open the devices myself, as I lack the technical skills to do so.

I am worried about hardware wallets because of these recent events too..

[JeffBrad12]

I would not expect a company of this scale to use basic anti-tampering stickers if they were going to add them, but they should do something more after this case.

These seals shouldn't be the main way for detecting tampering (seals are more present in Trezor devices), they also confuse some users, as devices sometimes arrive with misaligned or inconsistent seals, I’ve seen many people requesting replacements. Additional security checks that are relatively simpler than opening the device should be considered, the only other real options are downloading a software wallet and using it on an airgapped PC.

I own both a Ledger nano X and a Trezor Model T, I’ll keep using them but will reduce the amounts held on them. I won't open the devices myself, as I lack the technical skills to do so.

What about anti tampering lockers that can be opened if users scanned it with specialized app to activate and this can be one time thing otherwise if opened with force it breaks? i bet many of us wouldn't mind paying some more to get devices that come with this kind of advanced anti tampering measure, is this kind of thing even exist? for cheaper solution they could make the case transparent and publish official image of what it should look like.

[Mitchell]

[...]

I own both a Ledger nano X and a Trezor Model T, I’ll keep using them but will reduce the amounts held on them. I won't open the devices myself, as I lack the technical skills to do so.

[...]

I am worried about hardware wallets because of these recent events too..

Opening a Ledger Nano X is extremely simple (you just need a spudger, see Opening and closing a Ledger Nano X). This is somewhat on purpose, since Ledger themselves tells you to verify the hardware integrity if purchased from an unsecure source. The expected hardware components can be found here: Check hardware integrity (make sure to click on the right tab for the device you have).

I've opened my Ledger Nano X and, luckily, found no chip. Not that I actually use it after Ledgers past fuckups.

[greysonz]

A diagram of the Ledger production chain has emerged. I think they'll now be checking processes from the manufacturing stage onward and further down the supply chain to determine the point at which the spy chip was implanted.


https://x.com/ParadigmaEdu/status/2110115952524431487

[suzanne5223]

While the discussion about what the Ledger hardware wallet team should do to prevent more circulation of counterfeit/tamper wallet.
Everyone in Germany that's using Ledger needs to be careful; there's a phishing mail spreading lately there which allege claiming there's a new regulations requiring customers to register their Bitcoin wallets using a service called ZenLedger by October 31.
The letter has official Ledger branding information, contacts to German financial regulators, and a QR code referring victims to a supposed mandatory registration process.
https://x.com/jayr_crypto/status/2109961017681723517?s=20

[Faisal2202]

I think a list of each device's total weight is already on the Ledger website (here), Trezor has those, too, but listing the weight individually per product (example). Also, just as you said, a lot of users suggested that transparent cases/body should now be mandatory. There's also a suggestion on X to deliver the device unassembled, meaning the user would need to piece it together to be able to use it. Going that route, each part would need to be modular so average users could easily assemble them. Not a bad idea, but the devices would probably come with a higher price tag. Ultimately, I'd wish these manufacturers would build tamper-proof devices, maybe fill the entire empty spaces inside the device with resin? Or is that too much to ask? 

These are some good suggestions, but all have loopholes. I still shared them even though I knew they were not so unique or helpful, and it's not like I am the only one with such ideas. But it's also true that all of these suggestions could be ignored by the wallet makers because they now have to think outside the box if they really want to promote themselves.

Unlike Coldcard, Ledger's days are also numbered. I can see them going down. If this hack had happened in the EU or the US, the consequences for Ledger would have been a lot bigger than they are now.

Unassembled parts could also be tampered with. That's why I don't think it's a good idea, but I am not an expert on this. Maybe they can find a better way, but I know that when you receive the parts, they can just swap the chip with their own, and people won't even be aware of what they are doing

[LuckyCrypto777]

How long ago were the implants installed in the Ledgers?
Joe Grand received a message about a similar incident a year ago. Last August, he received a message from a man in Thailand who discovered a foreign implant in his Ledger.

More confirmation that the whole Ledger chip story started last year:
I came across a post on Reddit where a guy wrote that he'd had a Ledger wallet since the end of last year, which, it turns out, had been compromised all this time. The wallet was purchased in Vietnam.



At the same time, the community of people describing the disappearance from their Ledgers did not believe them and accused them

[Livingleged]

Don’t know if someone already mentioned this here. I just saw that ledger already made this move by asking all resellers in Asia to pull their product from the shelves while their investigation continues.


 This is definitely a good move
https://www.reddit.com/r/ledgerwallet/s/dqX4xNigrZ

[Gravitypull$]

This is what I posted in this thread  https://bitcointalk.org/index.php?topic=5596752.msg67240412#msg67240412 in Meta.

Ledger said that there wasn't any prove that their wallet was tampered in Germany and they have inspected the device from their reseller. I don't know if that guy is saying the truth because no funds have been reported stolen from a ledger wallet user in Germany.

Following reports from one person in Germany, our  team inspected devices from retail and distributor stock across the country, including units from the stores named. None showed any sign of tampering. No loss of funds related to implants has been reported anywhere in Europe.

We have not yet been able to examine the devices shown online. We invite their owner to send them to our security team so we can analyze them and share our findings.

https://x.com/i/status/2110416915835338942

[Forsyth Jones]

According to some reports, there are some people who buy these devices from marketplaces like Amazon, which offer a 10-day return window and take advantage of that time to implant the tampered chip, they then return the device to the marketplace, simply waiting for the next victim to buy it...

In other words, it isn't always the resellers themselves doing the tampering, it could be malicious customers making purchases with that specific intention.

That is why I never recommend buying these devices from marketplaces, the risk of tampering is huge, even official resellers are no longer safe. This could be Ledger's fault for allowing this by design, specifically their "genuine check" isn't effective enough, as it allows devices containing malicious implants to still be identified as genuine...

Link: https://x.com/AddictCryptoBoy/status/2110066395455369456

[Wind_FURY]

How long ago were the implants installed in the Ledgers?
Joe Grand received a message about a similar incident a year ago. Last August, he received a message from a man in Thailand who discovered a foreign implant in his Ledger. The man simply wanted to replace the battery in his device, but instead discovered circuit boards, batteries, wiring, and antennas.


https://x.com/BitcoinNewsCom/status/2110018558100910458

"They graciously allowed me to keep it".

Laughable because the attackers graciously wanted to take all that man's cryptocurrencies. They probably would have wanted to pay the man to keep it if he forced for a return of the product.

Furthermore, Mark Karpeles made a website through Github of all Ledger implants that he has personally seen. Because everyone is probably paranoid, I will not post the link. You can search for it yourself.