Store-bought hardware crypto wallets had secret chips installed that enabled stealing crypto recovery phrases

Cryptocurrency enthusiasts are often advised to acquire a hardware wallet like one of the Ledger models, theoretically adding the ultimate layer of security. And yet not even that approach is 100% safe, as a currently unfolding investigation revealed that Ledger resellers in Southeast Asia and Europe are carrying hacked wallets laden with eSIM and LTE modules for exfiltration of recovery phrases. At least $93 million (and going) has already reportedly been siphoned off users' balances. Hardware sold directly by Ledger is so far unaffected.

The first booby-trapped wallet originated from reseller Cryptobilis, which has currently ceased all sales of hardware wallets of all brands. The offending unit came from a store in Malaysia, though Cryptobilis also sells in Indonesia and the Philippines. Researcher Mark Karpelès has been looking into hacked wallets for a while now, and one of them came via Amazon Japan, bought from a Chinese seller and shipped from Malaysia. Cryptobilis also sells other brands of wallets such as Trezor, Coolwallet, and Tangem, though so far there is no news of contamination beyond Ledger.

Ledger recommends that users who bought wallets from Cryptobilis in the past 90 days do not perform their initial setup, as that's where the private key exfiltration reportedly occurs. To those who have already done so, Ledger recommends moving their assets to a new wallet with a new seed. The data theft is performed by hiding a flexible PCB under the display assembly to capture the pixels showing the private key entered during the first setup. The information then heads off to the aforementioned eSIM+LTE combination for exfiltration.

Meanwhile, new reports have come in from Europe, as techie Johannes, seemingly located in Germany, found at least two hacked wallets at MediaMarkt, a well-known tech and appliances retailer. He bought one unit and found that it had the same exact hardware modifications as its Asian counterparts, suggesting that the Asian and European events may be related. Johannes then bought a second one at a different MediaMarkt location, and sure enough, it was also modded.

Notably, most hacked wallets found so far are confirmed to be brand-new units instead of returns. Malfeasants will often buy new hardware and return it to the store with modifications, so that the next unsuspecting customer gets bit.

Johannes had a MediaMarkt employee at one of the stores look up the wallets' stock information, and at least the one unit came from Aqipa GmbH, a Europe-wide distributor — meaning the blast radius may be much wider than MediaMarkt or Germany. Since this is a recent development, Ledger hasn't published any guidance, though we imagine it'll be similar to the aforementioned steps.

In his blog post, Mark Karpelès notes that earlier iterations of hacked wallets with eSIM cards had hand-made implants, but that, concerningly, the hardware bolt-ons inside the latest finds appear to be manufactured to order. If true, this might mean that there's a production line somewhere intercepting Ledger wallets and manufacturing hacked wallets in bulk.

Ledger publishes instructions detailing how users can verify the physical integrity of their wallets, including pictures of every component, for every model of wallet the company offers, so they can closely inspect for add-ons. Likewise, prospective users should only download software from the official Ledger website URL — a task made harder by numerous scam sites with booby-trapped software, pretending to be the official ones.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.