A hardware implant in Ledger signers is blamed for the theft of at least $86 million in cryptocurrency from multiple users.
Ledger provides users with a secure cryptocurrency wallet that is backed by a signer, an offline hardware device used to securely authorize blockchain transactions.
Ledger signers sold via Southeast Asia reseller CryptoBilis were found to include an unauthorized hardware implant designed to intercept user data and send it to the attackers.
The cryptocurrency theft was disclosed on October 9 and was immediately pinned on devices sold through CryptoBilis. Ledger asked the company to stop selling its devices and instructed customers to stop using them.
“We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed),” the company said.
On October 13, Ledger confirmed that all confirmed fund losses linked to the incident involved a signer sold through CryptoBilis.
It appears that someone along the distribution chain modified the signers to manually solder the hardware implant to the device’s circuit boards.