Modified Ledger Nano X Wallets with Hidden eSIM Steal Crypto Seed Phrases

Unknown attackers are selling manipulated Ledger Nano X hardware wallets that secretly record the seed phrases of their buyers and transmit them to the criminals via mobile phone. According to an analysis by Tibane Labs, the modified devices have already been used to drain cryptocurrency worth around 100 million US dollars. Blockchain observers have identified more than 300 affected wallets that were collectively depleted of approximately 93 million US dollars. The stolen coins are subsequently exchanged and at least in part laundered through crypto mixers.

How the manipulation works

Each Ledger Nano X contains a Secure Element chip that controls a small touchscreen. Ledger describes this architecture as particularly secure, but that only holds if attackers cannot read the screen. The perpetrators achieve exactly that. They insert additional hardware into apparently genuine devices and sell them to unsuspecting crypto speculators.

The added chip intercepts the transmission from the Secure Element to the built-in screen and recognizes the letters of the seed phrase displayed there, a technique referred to as embedded Tempest. The Secure Element itself is not touched and remains secure. Since hardware wallets fundamentally work offline, the perpetrators also install an LTE modem, a tiny eSIM module, and a small antenna, all powered by the wallet's built-in battery. This allows the seed phrase to be transmitted via mobile phone, giving the attackers control over the secured cryptocurrency assets.

Suspected dealer and losses

Suspicion is directed at Cryptobilis, a wallet dealer operating primarily in Southeast Asia from Malaysia. Ledger advises anyone who purchased from Cryptobilis in the last three months not to use these wallets and to move existing holdings to another wallet quickly. The company has prohibited Cryptobilis from making further sales for now and barred all Ledger dealers from offering returns to other customers. Not every affected buyer knows they purchased from Cryptobilis. Tibane Labs reports a manipulated Ledger device bought via Amazon Japan from a Chinese seller that was mailed from Malaysia.

According to unverified screenshots, Cryptobilis has belonged to a Chinese man named JiaMing since August. The previous owners reportedly state they have nothing more to do with their old company. Ledger has admitted to one customer that they suffered financial loss and that their hardware wallet was manipulated, but the company has not confirmed the exact circumstances or the full extent of the damage.

Third generation of tampered devices

The recently discovered manipulated Ledger devices are at least the third generation. In May, embedded specialist Joe Grand presented apparently hand-manipulated Ledger Nano X devices at the Hardware.io conference. To make space in the small USB stick, the perpetrators replaced the battery with a much smaller one and created conspicuous wiring, visible only to those who take the device apart.

Tibane Labs describes two further advanced manipulation generations. One was more professionally designed but still replaced the battery. In the third known generation, the added parts are precisely cut in professional series production and the original battery remains untouched. The perpetrators found another, less conspicuous way to create space: Ledger protects the built-in screen from below with foam, which the attackers scratch away. Anyone who opens the casing sees nothing other than an unmanipulated Ledger Nano X, except for a small antenna wire.

Sources: heise.de