YHK - yet another hacker news clone

Who Is Planting Backdoors in Ledger Crypto Wallets?

43 points hacb 3 hours ago 46 comments

artisinal 59 minutes ago | parent

The bigger question is, who is still buying Ledger Crypto Wallets? Wasn't this their fourth breach?

thenthenthen 52 minutes ago | parent

All hw wallets are being breached. Big, easy target. I think a lot of people are interested in this breach and the people behind it. 100 million worth? This might works both ways.. curious about the further investigations. My hunch… after major crackdowns on scam centers in the golden triangle, this is their latest dab to wealth?

motionlessveloc 49 minutes ago | parent

Ledger the company was not breached (this time around). The devices here were modified by a middleman in the distribution chain and sold to unsuspecting buyers.

artisinal 44 minutes ago | parent

From what I read, an official reseller was breached. It was the decision of Ledger to use that reseller in the first place and to not do a check on their distribution chain. They could have sold straight to the customer instead.

dfadsadsf 34 minutes ago | parent

You need to have reseller in most countries otherwise your customers will have to deal with long shipping time, customs, etc. The same for selling in physical stores.

artisinal 30 minutes ago | parent

It was the decision of Ledger to use a reseller and to increase their attack vector just so the customer wouldn't be inconvenienced with three more days of shipping. Bad decision in my opinion.

It was also the decision of the customers to still buy a Ledger device despite being breached multiple times.

aa-jv 55 minutes ago | parent

The crypto lunatic fringe have long frustrated me with their assertions of sovereign this and that.

There is no sovereignty in crypto if YOU ARE NOT BUILDING YOUR OWN HARDWARE.

Any claims of sanctity or reliability in the software stack are rendered null and void until someone with a tunneling electron microscope has completed an audit of your chips.

THIS is why Taiwan matters so much, people: there is NO sovereignty for as long as your chips are being imported. You can trust all you want - but trust is nothing without verification. We are all serf-subjects of the wafer-producing overlords.

Ledger clearly drank the koolaid. Crypto people: invest in hardware. NOT software. Anything less is utter futility.

dingaling911 51 minutes ago | parent

Seems like maybe crypto having a single point of failure (keys) is a problem rather than hardware.

You will never be completely secure against failure, the only way to protect yourself is to be able to robustly recover from failure.

I'd rather be able to say "every single government is in my hardware and they still can't touch it."

Perhaps possible with multisig, but now you're basically back to trusting banks.

rhyperior 39 minutes ago | parent

Keys don’t have to be a SPoF though. Multi-signature schemes are the baseline for security today.

dingaling911 4 minutes ago | parent

Right, but who is the multi in the multisig and what happens if they die.

thenthenthen 50 minutes ago | parent

Not sure what you mean? Taiwan, imported, isnt taiwan the biggest exporter of high end chips? 100% these have not been hacked in Taiwan. You mean setting up your own fab? I am confused

aa-jv 37 minutes ago | parent

Yes, Taiwan is the biggest exporter of chips. Have you audited your chips today?

dada216 20 minutes ago | parent

I wonder if even people like Intel or AMD or Nvidia do.

There might be a strict hardware audit process for cryptographic accelerators on IBM Z machines though, I'm not sure, I'm gonna ask though.

aa-jv 18 minutes ago | parent

It is standard practice in many industries to do hardware audits, including random controls of chip supplies.

These industries are just not sexy enough for the crypto folks to want to learn from, or about.

RugnirViking 44 minutes ago | parent

not your keys, not your crypto

not your hardware, not your keys

not your chips, not your hardware

not manufactured in house, not your chips

not your designs, not manufactured by you

not designed by you personally, not your designs

ad infinitum. To be truly secure, you must first learn to survive alone in the wilderness and smelt tin

aa-jv 36 minutes ago | parent

Yes, that is true.

orsorna 34 minutes ago | parent

This is why the assertion that crypto allows you and you alone to control your capital is a fallacy. Depends on your threat model of course...

stymaar 34 minutes ago | parent

Every cryptographic system has a trust assumption somewhere

flir 22 minutes ago | parent

Hm. Computation with paper and pencil?

(I agree in general, I'm just exploring the statement).

gpderetta 33 minutes ago | parent

big bang or bust.

riffraff 24 minutes ago | parent

ah the good old C-x M-c M-smelting

karel-3d 22 minutes ago | parent

Crypto people keep rediscovering we live in a society.

ourmandave 3 minutes ago | parent

... and smelt tin

I'll just order my crucible and tongs off Alibaba.

Wait a second...

agentdev001 45 minutes ago | parent

Some chollima, its always a chollima.

dwh452 34 minutes ago | parent

how can the implant send the seed words to an attacker? doesn't a crypto wallet have to talk an application on the host computer? wouldn't the communication between the wallet and the host computer never allow for the seed words to be sent from the wallet to the outside world? in other words how could an "implant" tampering of the wallet make the host computer suddenly start sending seed phrases to third parties?

lxgr 33 minutes ago | parent

The attackers added their own tiny 4G or 5G board.

ovi256 33 minutes ago | parent

The implant could fabricate a reason to connect to a host computer. Like "Cannot display seed words, connect to a computer to debug"

trillic 32 minutes ago | parent

They put an eSIM in the device…

kg 29 minutes ago | parent

Though it's not what happened in this case, you could tamper with a crypto wallet to make it emulate a USB keyboard and once connected, send a series of keystrokes to download and run an exploit.

karel-3d 23 minutes ago | parent

There is an eSIM with worldwide data in the device.

littlecranky67 11 minutes ago | parent

They sniffed the LCD interface and OCR'ed the seed words when they were displayed using an implanted tiny CPU. This is a very sophisticated attack.

sorenjan 32 minutes ago | parent

Shouldn't it be possible to track who bought the esim, where the data is sent, and who owns the wallets where the stolen crypto is transferred?

karel-3d 24 minutes ago | parent

They tracked the traffic (not the eSIMs) to some servers in Hong Kong, managed by Alibaba.

flotzam 7 minutes ago | parent

It's easy to buy eSIMs anonymously. Either directly with cryptocurrency, or with a prepaid virtual credit card bought with cryptocurrency.

coliveira 16 minutes ago | parent

Every bitcoin in existence will eventually be hacked. It's just a matter of time.

littlecranky67 13 minutes ago | parent

Yet we trust our daily money system to be based on printed colorful paper that no one can reproduce.

hvb2 10 minutes ago | parent

It's very hard to steal a lot of physical currency.. Even with the biggest bills, it becomes unmanageable. Digitally it obviously doesn't matter if your transferring 1 Bitcoin or 10K

dbspin 10 minutes ago | parent

Because it works... The level of counterfeit currency is readily measurable. Currency can be withdrawn and replaced. Individual stolen notes can be tracked. Counterfeiting of the dollar and the euro today is a relatively minor problem

https://www.ecb.europa.eu/press/pr/date/2025/html/ecb.pr2502... https://www.bankofengland.co.uk/statistics/banknote https://www.cranecurrency.com/news-insights/85-decline-in-us...

StilesCrisis 4 minutes ago | parent

You sound sarcastic but it's true. Unless you have government-level resources, you can't make a perfect $20 bill. They don't use paper--water would destroy it--they use a special fabric with a single supplier that only sells to the government. They don't print; they stamp. There are watermarks, security strips, and other features that can't easily be reproduced. Doing it right would be a massive investment, at the risk of being caught and losing everything.

Trustable8 16 minutes ago | parent

I just opened a ledger up, its stupid easy to do. Why wouldn't they make this a sealed unit with and glue it to make it impossible to open without damaging? Also why would you not glue the entire circuit board? The entire board is covered in test pads which make it super easy to solder dodgy stuff onto.

vincnetas 14 minutes ago | parent

why not make it transparent?

Create 2 minutes ago | parent

SRF-39FP, has a transparent case, designed to thwart contraband concealment. The radio often appears on the commissary lists of U.S. federal prisons, hence the "FP" suffix https://en.wikipedia.org/wiki/SRF-39

phh 9 minutes ago | parent

At the price of an eSIM and a LTE modem (and of the stolen 100$M), destroying a glued casing and making your own costs next to nothing. Looking at the photos, even without the test pads soldering directly on the components seem pretty easy.

bayindirh 2 minutes ago | parent

I believe epoxy-filling them a-la IronKey is a good idea, but for longevity reasons, I'd prefer the rechargeable battery to be replaced.

Maybe it increases the price quite a lot, IDK.

ricardobeat 2 minutes ago | parent

This idea sounded wronged to me from the start. Why would you trust some random hardware, that has the sole purpose of holding your money, over a general purpose computer you control entirely?