Ledger Wallet Implants Spread to Authorized Resellers Across Europe and Asia

Implants Found in Wallets Sold by Authorized Resellers

Hardware implants discovered in Ledger crypto wallets sold by authorized resellers in Germany and Southeast Asia have been linked to the theft of approximately $102 million in cryptocurrency. According to blockchain research company Bitquery, crypto was stolen from about 315 accounts connected to compromised devices sold by CryptoBilis, an authorized Ledger reseller based in Malaysia. The stolen funds include Bitcoin, Ethereum, Tron and other cryptocurrencies.

A Ledger device owner in Germany who goes by the name Johannes said he found an implant on a Nano X wallet he purchased at a MediaMarkt store in August, and a second implant on another device he bought from the same chain. MediaMarkt is listed as an authorized reseller of Ledger wallets in Austria, Germany, Spain and Turkey and operates 1,000 stores across ten European countries. Johannes said a store employee told him the devices were new and that returns are sent back to Ledger rather than resold.

Evolving Implant Designs

Hardware hacker Joe Grand first discovered implants on several Nano X wallets earlier this year and notified Ledger in March. The implants contained an extra board, antenna, LTE module and eSIM designed to capture recovery seed phrases as they appeared on the device screen and transmit them to attackers via nearby cell towers. Grand purchased eight additional wallets from online sellers in Thailand and found that four were compromised.

Mark Karpelès, former CEO of the collapsed bitcoin exchange Mt. Gox, later obtained two Ledger wallets and found more advanced iterations of the implants. The latest generation uses a custom-built flexible circuit coated in black to blend with the legitimate board, with part numbers scraped off and a silk-screened identifier reading AC-A2016-NANO-V1.1 on the antenna. Karpelès described the design as evidence of planning, a real budget and a goal of mass production.

Supply Chain Concerns and Industry Response

Ledger suggested the implants may stem from authorized resellers obtaining wallets from illegitimate sources or reselling returned devices that had been compromised. The company reminded its authorized resellers to source products only through authorized channels and never restock returned products. A security researcher in Japan who examined ten compromised Nano X devices found five different implant versions and traced data transmissions to servers hosted at an Alibaba-managed data center in Hong Kong, where at least 90 infected devices were sending seed phrases in June.

There is also evidence that attackers have begun targeting Ledger Flex and Stax devices. In response to the findings, competitor Trezor announced it is dramatically reducing its list of approved sellers as a preventive measure, stating there is no evidence that Trezor devices have been compromised.

Sources: zetter-zeroday.com