Who Is Planting Backdoors in Ledger Crypto Wallets?

After crypto wallet maker Ledger announced Friday that a backdoor embedded in a handful of Ledger wallets sold in SouthEast Asia allowed thieves to hijack around $102 million in crypto from their owners, news has emerged of other Ledger wallets sold in Germany also having implants.

The hardware implants were originally found on an unknown number of Ledger Nano X wallets sold by an authorized Ledger reseller called CryptoBilis based in Malaysia. Ledger said the implants were found on a limited number of devices, all sold by the same seller. But a Ledger device owner in Europe has since said that he found an implant on a Nano X that he purchased at a large European electronics chain store in August and a second one he purchased this weekend at another store in the same chain. He believes these indicate that Ledger’s supply-chain has been compromised.

Since then, users and researchers have also reported finding implants in Ledger Flex and Ledger Stax devices – two of Ledger's more recent line of devices used for securely storing keys used to access a device owner's crypto accounts.

The implants are not the first to be found on Ledger wallets. Famed hardware hacker Joe Grand found implants on several Nano X wallets earlier this year and notified Ledger about them in March, raising questions about Ledger's urgency in addressing the issue. Many of the implants discovered more recently appear to be more sophisticated iterations of the ones that Grand found.