86 Million Crypto Heist Exposes Ledger Signer Hardware Vulnerability

Post Views: 9

A hardware-based intrusion in Ledger cryptocurrency wallets has been identified as the cause of a significant financial loss, with at least $86 million in digital assets stolen from affected users.

Hardware-Based Intrusion and Financial Loss

The breach involved unauthorized modifications to Ledger signers, which are hardware devices designed to securely authorize blockchain transactions. These compromised devices were distributed through a Southeast Asia-based reseller, CryptoBilis, and contained a malicious component embedded within their physical architecture.

Distribution Through CryptoBilis

The incident was first disclosed on October 9, with immediate suspicion directed at devices sold through CryptoBilis. Ledger, the manufacturer of the signers, issued a warning to users who purchased from the reseller within the preceding 90 days, advising them not to proceed with device setup if they had not already done so.

Ledger’s Response

For those who had already configured their devices, the company recommended transferring funds to a newly acquired Ledger signer using a fresh recovery seed. On October 13, Ledger confirmed that all verified financial losses tied to the breach originated from signers distributed via CryptoBilis.

Technical Details of the Attack

The attack involved a physical tampering process where an individual in the supply chain manually soldered a hardware implant onto the circuit boards of the devices. This component, housed within the device’s enclosure, was capable of capturing data displayed on the screen during the setup phase.

Physical Tampering Process

Specifically, the implant intercepted the 24-word recovery phrase generated by the signer, which is critical for accessing and managing cryptocurrency holdings. Once the implant detected the recovery phrase, its microcontroller decoded the information and transmitted it over an LTE connection using a pre-configured eSIM.

Data Exfiltration Mechanism

Notably, the malicious component did not alter the device’s operating system, transaction processes, or digital signatures, indicating a focus solely on data exfiltration. An on-chain analysis conducted by investigator Specter suggested that the total financial impact of the supply chain attack could exceed $86 million.

Implications and Industry Response

However, Ledger has not independently verified the number of affected users or the precise amount of cryptocurrency stolen. The company emphasized that the breach was confined to devices modified during the distribution process, with no evidence of broader vulnerabilities in its standard product line.

Risks of Supply Chain Compromises

The incident highlights the risks associated with physical supply chain compromises, where attackers exploit trusted distribution channels to deploy malicious hardware. It also underscores the importance of verifying the integrity of hardware devices, particularly those used for high-value digital asset management.