A Bug in the Crypto Wallet: Ledger Confirms a Hardware Implant

Set Trending Topics as a preferred source on Google.

The suspicion is now official, and for Ledger it is a heavy blow: The French hardware wallet maker has confirmed that one affected customer’s device contained an “unauthorized hardware implant.” Ledger’s support team made the announcement on X. It is now clear that at least some of the devices used to rob customers in Southeast Asia of crypto assets worth tens of millions of dollars had been physically tampered with.

What a Hardware Implant Is

A hardware implant is an additional electronic component that is secretly built into a device after the fact. It leaves the software untouched and grabs data directly from the electronics. For a hardware wallet, that is especially dangerous, because the device displays the recovery phrase during setup. Those 24 words are usually enough to recreate the wallet elsewhere and drain the crypto assets without the device itself.

That is most likely how the attack worked. Shortly after the thefts became known, Mark Karpelès, the former head of Mt. Gox, took apart a still-sealed device bought in Malaysia and found a hidden second circuit board inside. According to a technical analysis by Tibane Labs, the board sits behind the display of the Ledger Nano X and consists of a microcontroller and cellular hardware wired to the screen’s internal data lines. This allows the implant to read what is displayed during setup and send the recovery phrase over a mobile network. Ledger’s own firmware does not notice, because the secure chip itself is left untouched. Ledger has not yet confirmed how the implant works.