“The Ledger Nano X is the most secure way to manage your cryptocurrency,” advertises the French company Ledger, its hardware wallet for cryptocurrencies. Nevertheless, users have lost around 100 million US dollars in cryptocurrencies. This is because unknown individuals have succeeded in intercepting and manipulating the offline wallets while on the go.
Each Ledger Nano X has a Secure Element chip that controls a tiny touchscreen. Ledger praises this as particularly secure. Unfortunately, this only applies if attackers cannot read the screen. This is exactly what the perpetrators are doing. They insert additional hardware into apparently genuine Ledger Nano X and then sell them to unsuspecting crypto speculators.
If buyers use such a modified hardware wallet and create a seed phrase with it, the attackers automatically read along. They haven’t touched the Secure Element chip at all; it remains secure. Instead, they have installed an additional chip that intercepts the transmission from the Secure Element to the built-in screen and recognizes the displayed letters of the seed phrase – embedded Tempest. This is indicated by an analysis by Tibane Labs.
LTE modem calls home
Recognizing the characters alone doesn’t help the perpetrators yet, because the wallets fundamentally work offline. So the perpetrators have also installed an LTE modem, a tiny eSIM module, and a small antenna, all powered by the accumulator already built into the hardware wallet. Thus, the seed phrase is transmitted via mobile phone to the perpetrators, who thus gain control over the cryptocurrency assets secured by the seed phrase.
Ledger has admitted to one customer that they suffered financial loss and that their hardware wallet was manipulated. However, the company has not yet confirmed the exact circumstances and the full extent of the damage. Blockchain observers state that they have identified over 300 affected wallets so far, which have been collectively depleted of approximately 93 million US dollars. The stolen cryptocurrency units are subsequently exchanged and, at least in part, laundered through crypto mixers.
Secret change of ownership at dealer
Suspicion is directed at Cryptobilis, a wallet dealer operating primarily in Southeast Asia from Malaysia. Anyone who has purchased from Cryptobilis in the last three months should not use these wallets and should quickly move any existing holdings to another wallet, Ledger advises. It prohibits Cryptobilis from making further sales for now. All Ledger dealers are prohibited from offering any returns to other customers.
Unfortunately, not every affected buyer knows that they bought from Cryptobilis. Tibane Labs reports a manipulated Ledger device that was purchased via Amazon Japan from a Chinese seller but was mailed in Malaysia.
In the crypto scene, it is said that Cryptobilis recently received new owners without this being announced. The previous owners reportedly state they have nothing more to do with their old company. According to unverified screenshots, the wallet dealer has belonged to a Chinese man named JiaMing since August. Depending on the pronunciation, this is a common name in China or means “wrong name”.
Series production
The recently discovered manipulated Ledger devices are at least the third generation. In May, embedded specialist Joe Grand presented at the Hardware.io conference, apparently Ledger Nano[ ]X still manipulated by hand. To make space in the small USB stick, the perpetrators replaced the accumulator with a much smaller one and created conspicuous wiring – conspicuous, of course, only if you take the USB stick apart, which users don’t usually do.
Tibane Labs now describes wallets of two further advanced manipulation generations. One was already more professionally designed but still replaced the battery. In the third known generation, added parts are precisely cut in professional series production, and the original battery is untouched.
The perpetrators have found another, less conspicuous way: Ledger protects the built-in screen from below with foam. The attackers scratch this away and thus create space for their additional hardware. Anyone who opens the casing will see nothing other than unmanipulated Ledger Nano X, except for a small antenna wire.
(ds)