Hacked Ledger devices allegedly found in EU chain. theymos, maybe update ann?

[Rikafip]

From the official Ledger Twitter account. Since MediaMarkt is one of the largest electronics retailers in Europe, some people on this forum may have bought their Ledgers from there.

Update on Ledger devices at MediaMarkt Saturn 🔽

As of Oct. 13th, MediaMarkt Saturn has stopped, with Ledger’s alignment, the sale of Ledger devices in their stores and online while the investigation continues, following the report of an implant from one customer in Germany. No loss of funds were reported.

We have no indication that Ledger's infrastructure, systems or services were compromised. Ledger Support is reviewing user reports, and Ledger’s cybersecurity experts, the Donjon will be examining the devices we receive: support.ledger.com.

If you have questions about a device you bought, contact Ledger Support at support.ledger.com. Ledger will never call you, message you directly or ask for your 24-word recovery phrase.

Many claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger and MediaMarkt Saturn channels for updates. We will share more as the investigation continues.

[MarryWithBTC]

@theymos hacked Ledger devices allegedly found in EU chain-maybe update ann?

@theymos, hacked Ledger devices allegedly found in EU chain-maybe update ann?

I thought theymos became a hacker after reading the title twice lol. That's the power of punctuation.

[libert19]

I thought theymos became a hacker after reading the title twice lol. That's the power of punctuation.

I thought following:

• Theymos was hacked.
• Theymos's ledger was hacked.
• Theymos hacked the ledgers of people.

May be op is in hurry after finding a breaking news. The title only makes sense after removing Theymos from it (or may be it should be at end, so there is no confusion —... maybe update ann? @Theym_s).

[Doan9269]

I know more will still be uncovered.

Ledger will never have a second chance because they have already messed up. Some of us have been seeing this signal for a long time, even before this compromise, and this is when there is an issue that has to do with their wallet privacy. Isn't it related to each other now that we see their thought-party-approved retailers eventually scam users? The fact is, that is just the bigger truth. They should know the procedures for privacy and safety by now without giving any flimsy excuse.

[Lucius]

From the official Ledger Twitter account. Since MediaMarkt is one of the largest electronics retailers in Europe, some people on this forum may have bought their Ledgers from there.
~snip~

Update should be: Ledger compromised - we recommend not to use their devices.

I already wrote in the main topic that there is a possibility that the devices are modified by someone at the source, in the factory or perhaps by the main supplier who delivers to resellers. What is the probability that a modified device can be found at two different resellers that are thousands of kilometers away from each other?

[doggywin]

From the official Ledger Twitter account. Since MediaMarkt is one of the largest electronics retailers in Europe, some people on this forum may have bought their Ledgers from there.
~snip~

Update should be: Ledger compromised - we recommend not to use their devices.

I already wrote in the main topic that there is a possibility that the devices are modified by someone at the source, in the factory or perhaps by the main supplier who delivers to resellers. What is the probability that a modified device can be found at two different resellers that are thousands of kilometers away from each other?

I don't think the evidence supports that conclusion yet.

If devices were being modified at the factory, we would expect tampered units bought directly from Ledger as well. Finding them at two resellers far apart suggests someone is targeting resellers or distributors.

[snipie]

Update should be: Ledger compromised - we recommend not to use their devices.

I believe theymos is reluctant to write this sentence like that but I assume people who saw his latest remark about this subject understood that one day this statement is coming.
This is not the first time bad thing happens with Ledger and I believe the time to use risky devices methods has gone.

[Basels]

This news broke since last week, and the Ledger X update says it's connected to southeast Asia. It seems to be spreading and no longer localized to one reseller. If Theymos wanted to write an update about it, he should have done so by now. I think he's more concerned with widespread events that affects or could affect all crypto users simultaneousloy.

[Gravitypull$]

Ledger said that there wasn't any prove that their wallet was tampered in Germany and they have inspected the device from their reseller. I don't know if that guy is saying the truth because no funds have been reported stolen from a ledger wallet user in Germany.

Following reports from one person in Germany, our  team inspected devices from retail and distributor stock across the country, including units from the stores named. None showed any sign of tampering. No loss of funds related to implants has been reported anywhere in Europe.

We have not yet been able to examine the devices shown online. We invite their owner to send them to our security team so we can analyze them and share our findings.

https://x.com/i/status/2110416915835338942

[PrivacyG]

The biggest curiosity and fear I have right now is how old are these devices.  Are these recent batches that are 'infested' or has this happened in multiple parts of the World for years unnoticed and many thousands of customers currently have a trojan horse sitting in their safe?

[alegotardo]

I know more will still be uncovered.

Ledger will never have a second chance because they have already messed up. Some of us have been seeing this signal for a long time, even before this compromise, and this is when there is an issue that has to do with their wallet privacy. Isn't it related to each other now that we see their thought-party-approved retailers eventually scam users? The fact is, that is just the bigger truth. They should know the procedures for privacy and safety by now without giving any flimsy excuse.

I agree that it is serious and that Ledger bears a lot of responsibility for its reseller network.
But saying that "they would not get a second chance" is quite debatable... I do not want to minimize the problem, after all, a physical implant in devices from an official reseller is not something irrelevant, but it is also not a breach of Ledger's Secure Element or firmware.

Now Ledger will need to prove that it can control its resellers and also detect tampering (honestly, I am even curious to know how they will do that), but even Trezor has had serious incidents involving customer data through third parties, and to this day many people still trust them.
So no hardware wallet brand is above criticism, and Ledger will probably be able to adjust its protocols and regain the market's trust.

[stompix]

I have a better idea for an update:
"Pull your damn coins from any sort of wallet anyone had or has access to it and move it to your own created cold storage"

Hardware wallets are done for, nobody who is unsure what two solderings on a board do should ever completely trust them again!




 

[Catenaccio]

I have a better idea for an update:
"Pull your damn coins from any sort of wallet anyone had or has access to it and move it to your own created cold storage"

Hardware wallets are done for, nobody who is unsure what two solderings on a board do should ever completely trust them again!

From Coldcard to Ledger, it's hard to believe hardware wallet manufacturers and resellers again. Each company has its own reputation but the generic reputation of hardware wallet branch industry has been damaged a lot recently.

If they don't have any seal to allow customers checking that a hardware wallet was tampered or not, it's impossible for customers to know that a wallet is intact from the manufacturer to the reseller then delivery service and along the way.

Using software wallets, verify them, and set up an airgap wallet looks more secure and safe after hardware wallet can be excluded from consideration list.

[LoyceV]

I have a better idea for an update:
"Pull your damn coins from any sort of wallet anyone had or has access to it and move it to your own created cold storage"

The large majority of all Bitcoin "owners" holds it on exchanges. Proof of this statement: estimates for the number of Bitcoin owners worldwide are several times larger than the number of funded Bitcoin addresses. So the ones using self-custody are already a minority. Out of those people, I have no doubt the large majority won't be able to properly setup secure cold storage. Many people just use their phone.

Hardware wallets are done for, nobody who is unsure what two solderings on a board do should ever completely trust them again!

I never fully trusted hardware wallets in the first place. It's a black box to me, that says it all. However, I'd still recommend a Trezor to Newbies as the best compromise between convenience and security. It's just not realistic to expect the average person to be able to do better on their own.

[satscraper]

Here is the blatant example of how easily the original chips in Ledger nano s can be replaced with the  genera purpose microcontroller loaded with malicious firmware. Truth be told, that device was acquired onChinese market but no one guarantees that the similar one won't be found here in Europe.

P.S. the better choice would be to forget about Ledger forever and purchase PCI grade wallet.

[promise444c5]

has this happened in multiple parts of the World for years unnoticed and many thousands of customers currently have a trojan horse sitting in their safe?

Yes and ledger knew about it.. they were using fake sites to sell these tampered ledger devices then,  but this time around , they’ve decided to bring it to their doorstep by compromising their resellers.

For example, I came across this post on Reddit while researching days back : Compromised Ledger Nano X That *Passed* “Genuine Check” Drained $214,186 - How Is This Even Possible!?.. and he’s not the only one, there’s another one from 2024 but i can’t recall the source anymore.

Just wondering what they did after, make their hardware wallet harder to tamper with? No..  Or they never thought it could get to this extent.