Ledger在92M窃取声称的密码钱包中确认隐藏的芯片
在10月10日调查东南亚转售商CryptoBilis涉嫌盗窃案时，列德杰确认发现一个未经授权的硬件植入一个客户的加密货币钱包
- 在调查CryptoBilis期间，Ledger证实一个客户的装置内植入了一个未经授权的硬件。
- CryptoBilis暂停所有硬件钱包的销售，而Ledger则调查报道的涉及亚洲客户的损失。
- Ledger建议使用CryptoBilis设备的客户反对设置，并建议其他人使用新的恢复短语。
- 研究员Mark Karpelès报告说，在马来西亚发现了一台Ledger Nano X屏幕背后的可疑电子产品。
- Bitquery估计311个钱包的9 290万美元密码货币损失，莱杰独立证实的数字。
Ledger Support在一份官方声明中确认了这一发现，称修改后的设备属于受正在进行的调查影响的用户。 称 CryptoBilis公司停止出售所有硬件钱包作为防范，莱杰在与当局合作时正在联系影响客户。 它尚未确定植入是否造成所报告的密码货币损失。
该发现直接证实了至少一个设备的物理篡改，此前曾警告通过转售器分发可疑钱包。
编目器确认未经授权植入客户钱包
在调查期间，Ledger在属于受影响客户的钱包中发现了另一个电子组件。
该公司称该部件是“未经授权的硬件植入”，但没有披露确切的装置模型、部件是如何安装的，或是否传送过任何信息。
根据Ledger10月10日的声明，其安全小组正在审查事件，并与据信受到影响的客户联系。 制造商尚未确认有多少钱包包含类似的修改。
10月9日，在通过CryptoBilis(印度尼西亚、马来西亚和菲律宾的一家转售商)购买Ledger产品的客户中出现了未经批准的交易报告。 投诉后，Ledger对所报告的损失展开调查，并要求经销商暂停销售和装运其装置。
链上称区调查人员随后的一份报告最初发现盗窃嫌疑超过7 200万美元，而另一个估计损失超过8 600万美元。
Ledger没有确认这两个数额。 该公司在最近的声明中强调，它没有发现任何证据表明其内部安全基础设施、系统或服务受到破坏。
该公司说，" 我们没有迹象表明Ledger的安全基础设施、系统或服务受到破坏 "。
制造商正在开发更多防止物理设备被篡改的保护措施，同时调查人员正在努力确定未经授权的部件是如何进入受影响的钱包的。
CryptoBilis 在调查期间停止所有硬件钱包的销售
在Ledger发现后，CryptoBilis确认已暂停其整个硬件钱包库存的销售。
临时停产涵盖经销商销售的所有硬件钱包产品，超出了之前暂停莱德格销售和装运的要求。
根据TokenPost10年10月10日的一份报告，CryptoBilis将维持暂停，直到调查结束。
Ledger 称公司与转售商就调查和今后适当步骤保持积极沟通。 通过 CryptoBilis 购买设备的客户已经接到指示，如果他们还没有开始安装。
对于使用过这些设备的客户，Ledger建议考虑将他们的加密货币转移到一个新硬件钱包上，以全新的恢复短语初始化。 将现有的恢复语移到替换设备上不会解决该词通过原始硬件可能暴露的问题。
该公司进一步要求任何有相关证据的人提供资料，并指示安全研究人员在[电子邮件保护]执行它的赏金方案。 Ledger已联系执法部门
该公司的陈述没有查明任何嫌疑人、宣布逮捕或提供完成调查的时间表。 另外，前CryptoBilis高管Arravind Prabu和Vimalatheethan表示，在2026年早些时候所有权变更后，他们转移了对企业的业务控制权。
在与研究员马克·卡佩莱斯共享并由蒂巴内实验室发布的一份声明中，前高管称于3月完成了管理移交，不再控制公司系统或客户数据库。
他们的陈述没有确定谁修改了受影响的设备，或者所有权的改变是否与事故有任何联系。
安保研究人员报告Ledger屏幕后面隐藏的电子设备
在Ledger公开确认硬件植入之前，前Mt. Gox首席执行官马克·卡佩莱斯(Mark Karpelès)报告检查了从马来西亚获得的可疑的Ledger Nano X设备。 10月9日，Karpelès描述在通常用来保护屏幕的材料中，发现了隐藏在设备显示器后面的另一个电子组件。
他报告说，钱包已运抵外观完好无损的包装中，令人怀疑客户是否可以通过例行的视觉检查来识别一个被修改的装置。 在公开分享的照片中，该组件似乎包含独立于钱包原硬件的电子电路。
随后，Karpelès报告说进一步审查了修改情况，并检查了其他受影响用户提供的图像。
Tibane Labs公司公布的一个技术账户描述了涉及微控制器、蜂窝通信硬件和连接屏幕内部数据线的安排。 分析表明，沿屏幕连接定位的组件有可能捕捉钱包设置时显示的信息。
回收短语一般由24个单词组成，允许钱包所有人恢复对密码货币持有量的访问。 如果攻击者获得这些单词，攻击者可能可以重新创建钱包并授权传输而不拥有原硬件设备。
研究者提出，一个能够读取发送到显示器的信息的植入物，在钱包初始化时有可能捕捉到恢复词。
然而，Ledger没有独立地证实发现的植入物履行了这一功能，也没有证实它对报告的盗窃负责。
该公司的官方公告证实，在一个受影响的装置中进行物理篡改，但没有确定用于获取客户资金的技术方法。 Ledger的历史安全研究曾经研究过未经授权修改钱包硬件的情况。
在2018年的一次安全响应中，制造商讨论了有实际访问权限的攻击者如何修改钱包并使用额外的电子干扰其运行。 早期的研究涉及不同的攻击情景，没有与CryptoBilis调查建立关联。
链上研究人员估计有数百万起盗窃嫌疑
在调查人员检查受影响的硬件时，区块链分析研究者试图计算从疑似受害人钱包转移的密码货币值。
在10月9日的一次调查中，Bitquery估计，从跨越Bitcoin,Ethereum,TRON,BNB Chain和Polygon的311个钱包中移除了约9,290万美元。
估计数超过了以前关于可疑损失的报告，从7 200万美元到8 600多万美元不等。 Bitquery将此差异归因于其分析中包含的额外钱包和区块链网络。 其研究人员报告说，所怀疑的损失中，最大的部分涉及TRON上的USDT交易，其次是Bitcoin和Ethereum转账。
报告查明，从TRON钱包转移的资产约为7 050万美元，比特币为1 680万美元。 Bitquery利用交易时间和地址关系，认为该活动与已经控制多个钱包的攻击者一致。
研究公司查明了几个网络的密切时间交易，并检查了转移后资产在何处移动。 Bitquery报告说，与涉嫌盗窃有关的地址冻结了约1 000万美元。
它还查明了涉及密码货币互换和转入 " 旋风现金 " 的交易，" 旋风现金 " 是一种用来掩盖数字资产交易历史的服务。 分析仍然是独立的评估。 Bitquery估计损失、受害者人数或攻击者结论
公共反洗钱中心最近的链上报告介绍了10月10日涉嫌盗窃的以太的其他动向，包括转入 " 旋风现金 "。 分析估计，尽管研究人员的钱包归属和损失计算仍然与莱杰确认的调查结果分开，但在另一系列转账中，900 ETH达到了 " 旋风现金 "。
Ledger 敦促用户保护恢复短语
Ledger的调查引起了关于犯罪分子利用公众对转卖事件的关注的可能性的警告。 该公司提醒客户依靠官方通信渠道了解受影响的装置、调查和可能的安全措施。 其公开声明提醒客户，莱杰支援人员永远不会要求他们的24字复原短语。
早先对欺诈的Ledger网站的研究记录了试图通过假钱包验证请求获取回收短语的网民网页。
报告于10月11日发表，讨论恶意的Google广告，钓鱼运动尚未与CryptoBilis硬件调查联系起来。 Ledger 称在其最新通知中准备采取额外措施，以使未经授权的物理修改更难进行。
该公司没有宣布这些保护的发布日期，也没有提供任何硬件重新设计的细节。 对于客户寻求指导，Ledger将查询导向其官方支持网站 support.ledger.com.
其安全小组称受到影响的用户将随着调查的进行而继续收到直接的通信，而有关事件的信息可以通过其赏金程序提交。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Ledger confirms hidden chip in crypto wallet amid $92M theft claims
Ledger has confirmed finding an unauthorized hardware implant inside one customer’s cryptocurrency wallet during its October 10 investigation into reported thefts involving Southeast Asian reseller CryptoBilis, as blockchain researchers estimate suspected losses exceeding $86 million.
- Ledger confirmed an unauthorized hardware implant inside one affected customer’s device during its CryptoBilis investigation.
- CryptoBilis suspended sales of all hardware wallets while Ledger investigates reported losses involving Asian customers.
- Ledger advised customers with CryptoBilis devices against setup and recommended fresh recovery phrases for others.
- Researcher Mark Karpelès reported finding suspicious electronics behind a Ledger Nano X screen in Malaysia.
- Bitquery estimated $92.9 million in cryptocurrency losses across 311 wallets, figures unconfirmed independently by Ledger.
Ledger Support confirmed the discovery in an official statement, saying the modified device belonged to a user affected by the ongoing investigation. The company said CryptoBilis had stopped selling all hardware wallets as a precaution and that Ledger was contacting affected customers while working with authorities. It has not established whether the implant caused the reported cryptocurrency losses.
The discovery provides direct confirmation of physical tampering in at least one device, following earlier warnings about suspicious wallets distributed through the reseller.
Ledger confirms unauthorized implant in customer’s wallet
During its investigation, Ledger identified an additional electronic component inside a wallet belonging to an affected customer.
The company described the component as an “unauthorized hardware implant” but did not disclose the exact device model, how the component was installed or whether it had transmitted any information.
According to Ledger’s October 10 statement, its security team is examining the incident and contacting customers believed to have been affected. The manufacturer has not confirmed how many wallets contain similar modifications.
Reports of unauthorized transactions emerged on October 9 among customers who purchased Ledger products through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines. Following the complaints, Ledger opened an investigation into the reported losses and asked the distributor to suspend sales and shipments of its devices.
A subsequent report from The Block said on-chain investigators had initially identified suspected thefts exceeding $72 million, while another estimate placed the losses above $86 million.
Ledger has not confirmed either amount. The company emphasized in its latest statement that it has found no evidence suggesting its internal security infrastructure, systems or services were compromised.
“We have no indication that Ledger’s security infrastructure, systems or services have been compromised,” the company stated.
The manufacturer is developing additional protections against physical device tampering while investigators work to determine how the unauthorized component entered the affected wallet.
CryptoBilis halts all hardware wallet sales during investigation
Following Ledger’s discovery, CryptoBilis confirmed that it had suspended sales of its entire hardware wallet inventory.
The temporary halt covers all hardware wallet products sold by the distributor, extending beyond the earlier request to pause Ledger sales and shipments.
According to an October 10 report from TokenPost, CryptoBilis will maintain the suspension until the investigation concludes.
Ledger said it remained in active communication with the reseller regarding the investigation and appropriate next steps. Customers who purchased a device through CryptoBilis have been instructed not to begin setting it up if they have not already done so.
For customers who have used the devices, Ledger recommends considering a transfer of their cryptocurrency to a new hardware wallet initialized with a completely new recovery phrase. Moving an existing recovery phrase onto a replacement device would not address possible exposure of that phrase through the original hardware.
The company further requested information from anyone with relevant evidence and directed security researchers to its bounty program at [email protected]. Ledger has contacted law enforcement and acknowledged assistance from the Security Alliance’s SEAL_911 incident response initiative.
The company’s statement did not identify any suspects, announce arrests or provide a timetable for completing the investigation. Separately, former CryptoBilis executives Arravind Prabu and Vimalatheethan stated that they had transferred operational control of the business following an ownership change earlier in 2026.
In a statement shared with researcher Mark Karpelès and published by Tibane Labs, the former executives said they completed their management handover in March and no longer controlled company systems or customer databases.
Their statement does not establish who modified the affected device or whether the ownership change had any connection to the incident.
Security researcher reports hidden electronics behind Ledger screen
Before Ledger publicly confirmed the hardware implant, former Mt. Gox CEO Mark Karpelès reported examining a suspicious Ledger Nano X device obtained from Malaysia. On October 9, Karpelès described finding an additional electronic component hidden behind the device’s display, inside material normally used to protect the screen.
He reported that the wallet had arrived in packaging that appeared intact, raising questions about whether customers could identify a modified device through a routine visual inspection. In photographs shared publicly, the component appeared to contain electronic circuitry separate from the wallet’s original hardware.
Karpelès subsequently reported examining the modification further and inspecting images provided by other affected users.
A technical account published by Tibane Labs described an arrangement involving a microcontroller, cellular communication hardware and connections to the screen’s internal data lines. The analysis suggested that a component positioned along the screen connection could potentially capture information displayed during wallet setup.
A recovery phrase typically consists of 24 words that allow a wallet owner to restore access to cryptocurrency holdings. If an attacker obtains those words, the attacker may be able to recreate the wallet and authorize transfers without possessing the original hardware device.
Researchers have suggested that an implant capable of reading information sent to the display could potentially capture recovery words when a wallet is initialized.
However, Ledger has not independently confirmed that the discovered implant performed that function or that it was responsible for the reported thefts.
The company’s official announcement confirms physical tampering in one affected device without establishing the technical method used to access customer funds. Ledger’s historical security research has previously examined situations involving unauthorized modifications to wallet hardware.
In a 2018 security response, the manufacturer discussed how attackers with physical access could modify a wallet and use additional electronics to interfere with its operation. The earlier research concerned different attack scenarios and did not establish a connection to the CryptoBilis investigation.
On-chain researchers estimate millions in suspected thefts
As investigators examine the affected hardware, blockchain analytics researchers have attempted to calculate the value of cryptocurrency moved from suspected victim wallets.
In an October 9 investigation, Bitquery estimated that approximately $92.9 million had been removed from 311 wallets across Bitcoin, Ethereum, TRON, BNB Chain and Polygon.
The estimate exceeded earlier reports of suspected losses ranging from $72 million to more than $86 million. Bitquery attributed the difference to additional wallets and blockchain networks included in its analysis. Its researchers reported that the largest portion of the suspected losses involved USDT transactions on TRON, followed by Bitcoin and Ethereum transfers.
The report identified approximately $70.5 million in assets transferred from TRON wallets and $16.8 million in Bitcoin. Using transaction timing and address relationships, Bitquery argued that the activity was consistent with an attacker already possessing control over multiple wallets.
The research company identified closely timed transactions across several networks and examined where the transferred assets subsequently moved. Bitquery reported that approximately $10 million in USDT had been frozen in addresses linked to the suspected thefts.
It further identified transactions involving cryptocurrency swaps and transfers to Tornado Cash, a service used to obscure the transaction history of digital assets. The analysis remains an independent assessment. Ledger has not confirmed Bitquery’s estimated losses, number of victims or conclusions about the attacker.
More recent on-chain reporting from PublicAML described additional movements involving suspected stolen Ether on October 10, including transfers to Tornado Cash. The analysis estimated that 900 ETH reached Tornado Cash during another series of transfers, although the researchers’ wallet attribution and loss calculations remain separate from Ledger’s confirmed findings.
Ledger urges users to protect recovery phrases
Ledger’s investigation has prompted warnings about the possibility of criminals exploiting public concern surrounding the reseller incident. The company cautioned customers to rely on official communication channels for information about affected devices, investigations and potential security measures. Its public statement reminded customers that Ledger support personnel will never request their 24-word recovery phrase.
Earlier research into fraudulent Ledger websites documented phishing pages that attempted to obtain recovery phrases through fake wallet verification requests.
The report, published October 11, discussed malicious Google advertisements that directed users toward imitation Ledger websites and applications. The phishing campaign has not been linked to the CryptoBilis hardware investigation. In its latest notice, Ledger said it was preparing additional measures intended to make unauthorized physical modifications harder to carry out.
The company did not announce a release date for those protections or provide details of any hardware redesign. For customers seeking guidance, Ledger directed inquiries to its official support website at support.ledger.com.
Its security team said affected users would continue receiving direct communication as the investigation proceeds, while information about the incident can be submitted through its bounty program.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.