A coordinated theft of roughly $102 million in cryptocurrency has been linked to hardware backdoors planted inside Ledger wallets sold through legitimate retail channels. According to reporting by Kim Zetter of ZERO DAY, the implants were first found in an unknown number of Ledger Nano X wallets sold by CryptoBilis, a Malaysia-based authorized Ledger reseller.
Ledger said on Friday that the compromised devices came from a limited batch sold by the same seller, and asked CryptoBilis to stop all sales and shipments while an investigation is underway. Blockchain research firm Bitquery estimates that crypto was stolen from about 315 accounts tied to compromised CryptoBilis devices, with losses including Bitcoin, Ethereum and Tron.
Ledger wallet backdoor: what was found and where
The backdoors were not limited to a single seller. A Ledger owner in Europe, who goes by Johannes on X, said he found an implant inside a Nano X he bought in August at a MediaMarkt store in Germany, and then found another implant in a second wallet purchased this weekend at a different store in the same chain. MediaMarkt is Germany's largest electronics retailer, with around 1,000 stores across ten European countries, and is listed as an authorized Ledger reseller in Austria, Germany, Spain and Turkey.
Johannes initially suspected the devices might have been returned items resold as new, but a MediaMarkt employee told him they were new units and that returns are sent back to Ledger rather than restocked. Users and researchers have also reported implants in Ledger Flex and Ledger Stax wallets, two of the company's newer models. Ledger did not respond to an inquiry from ZERO DAY.
This is not the first time implants have been found in Ledger wallets. Hardware hacker Joe Grand discovered them in several Nano X devices earlier this year and notified Ledger in March, raising questions about how quickly the company acted. The more recent implants appear to be more sophisticated versions of the ones Grand found.
