As reported by Bloomberg News on Sunday (Oct. 18), this incident highlights growing concerns over vulnerabilities in what was once considered the most secure option for safeguarding digital assets.
Recent breaches have demonstrated that even physical wallets intended to shield digital currencies from cybercriminals can be compromised, sometimes even before they are utilized, according to the report.
“This exposes the fact that crypto storage carries an operational risk, not just a cryptographic one,” commented Esme Pau, who leads capital markets and policy at the blockchain security firm CertiK. “True security in the real world relies on the entire process.”
In response to the incident, Ledger has requested that resellers and distributors in Southeast Asia and Hong Kong suspend sales of its wallets while they investigate how devices from the distribution chain were tampered with and subsequently drained of cryptocurrency.
We’d love to be your preferred source for news.
For the latest updates, please add us to your preferred sources list to ensure our news, data, and interviews appear in your feed. Thank you!
Ledger reassured users through social media, stating, “We recognize that this situation is troubling and will keep you informed via updates from the Ledger Donjon [Ledger’s security research team] as our investigation unfolds. Please stay alert.” They also mentioned, “There’s no evidence that Ledger’s infrastructure, systems, services, or direct sales channels have been compromised.”
A previous Bloomberg article indicated that some Ledger devices had spyware implanted, with some of these products being purchased from the Malaysian reseller CryptoBilis.
The Sunday report detailed that social media investigators are examining how these implants function. It appears that the hardware intercepts passcodes sent to Ledger’s screens and transmits these keys to cybercriminals using cellular networks, allowing them to access funds through alternative devices.
Although Ledger’s hardware includes a protective chip, this tactic bypasses it, experts explained, which means the implants can evade standard security measures until it’s too late.
“Defending against one kind of attack doesn’t eliminate other possibilities,” remarked Aneirin Flynn, CEO of cybersecurity firm FailSafe.
According to Bloomberg, this incident is the latest in a series of attacks involving “cold wallets,” which are designed to securely store private keys without being connected to the internet. Once deemed impervious to threats, a software vulnerability in similar devices from Coinkite earlier this summer brought their flaws to light.
“The incident didn’t break Bitcoin’s encryption or reverse any transactions on its blockchain. It wasn’t a wrench attack wherein criminals would steal a device, trick its owner into revealing a password, or install malware on a connected computer,” reported PYMNTS in August regarding the Coinkite breach. “Instead, the failure occurred at the level of a supposedly secure device.”
