Crypto thieves sell hardware wallets with secret eSIM
Tampered Ledger Nano X wallets with hidden LTE modems stole seed phrases, draining about $93 million.
Criminals sold modified Ledger Nano X hardware wallets containing a chip that intercepts seed phrases displayed from the Secure Element, plus an LTE modem, eSIM, and antenna that transmit them. The Secure Element itself was not altered. Blockchain observers identified more than 300 drained wallets totaling about $93 million, with broader loss estimates near $100 million, and some proceeds passed through mixers. Tibane Labs described professionally manufactured implants; Ledger warned customers who bought from Malaysian dealer Cryptobilis in the last three months not to use those devices.
- Extra hardware reads seed characters on the path to the screen.
- A hidden LTE eSIM and antenna exfiltrate the seed over mobile networks.
- Observers link more than 300 wallets and about $93 million in losses.
- Ledger warned recent Cryptobilis buyers and paused that dealer's sales.
- Third-generation implants are series-produced and leave the original battery.
Full article699 words · extracted from heise.de · click to collapse
“The Ledger Nano X is the most secure way to manage your cryptocurrency”, the French company Ledger advertises its hardware wallet for cryptocurrencies. Nevertheless, users have lost around 100 million US dollars in cryptocurrencies. This is because unknown individuals have succeeded in intercepting and manipulating the offline wallets on the go.
Each Ledger Nano X has a Secure Element chip that controls a tiny screen. Ledger advertises this as particularly secure. Unfortunately, this only applies if attackers cannot read the screen. This is exactly what the perpetrators are doing. They insert additional hardware into apparently genuine Ledger Nano X and then sell them to unsuspecting crypto speculators.
If buyers use such a modified hardware wallet and create a seed phrase with it, the attackers automatically read along. They haven’t touched the Secure Element chip at all; it remains secure. Instead, they have installed an additional chip that intercepts the transmission from the Secure Element to the built-in screen and recognizes the displayed letters of the seed phrase – embedded Tempest. This is indicated by an analysis by Tibane Labs.
LTE modem calls home
Recognizing the characters alone does not help the perpetrators yet, because the wallets fundamentally work offline. So the perpetrators have also installed an LTE modem, a tiny eSIM module, and a small antenna, all powered by the battery already built into the hardware wallet. The seed phrase is then transmitted via mobile network to the perpetrators, who gain control over the cryptocurrency assets secured by the seed phrase.
Ledger has admitted to one customer that they suffered financial loss and that their hardware wallet was manipulated. However, the company has not yet confirmed the exact process and the full extent of the damage. Blockchain observers state that they have identified over 300 affected wallets so far, which have collectively been drained of approximately 93 million US dollars. The stolen cryptocurrency units are subsequently exchanged and, at least in part, passed through crypto mixers.
Secret change of ownership at dealer
Suspicion is directed at Cryptobilis, a wallet dealer operating mainly in Southeast Asia from Malaysia. Ledger advises anyone who has purchased from Cryptobilis in the last three months not to use these wallets and to quickly move any existing holdings to another wallet. It is temporarily prohibiting Cryptobilis from further sales. All Ledger dealers are prohibited from offering any returns to other customers.
Unfortunately, not every affected buyer knows that they bought from Cryptobilis. Tibane Labs reports a manipulated Ledger device that was purchased via Amazon Japan from a Chinese seller but was mailed from Malaysia.
In the crypto scene, it is said that Cryptobilis recently received new owners without this being announced. The previous owners reportedly state that they have nothing more to do with their old company. According to unverified screenshots, the wallet dealer has belonged to a Chinese man named JiaMing since August. Depending on the pronunciation, this is either a common name in China or it means “wrong name”.
Series production
The recently discovered manipulated Ledger devices are at least the third generation. In May, embedded specialist Joe Grand presented what was apparently a manually manipulated Ledger Nano X at the Hardware.io conference. To make space in the small USB stick, the perpetrators replaced the battery with a much smaller one and left conspicuous wiring – conspicuous, of course, only if you take the USB stick apart, which users do not typically do.
Tibane Labs now describes wallets of two further advanced generations of manipulation. One was already designed more professionally, but still replaced the battery. In the third known generation, added parts are precisely cut in professional series production, and the original battery remains untouched.
The perpetrators have found another, less conspicuous way: Ledger protects the built-in screen from below with foam. The attackers scratch this away and thus create space for their additional hardware. If you open the casing, you will see nothing other than unmanipulated Ledger Nano X, apart from a small antenna wire.
(ds)