Hackers Hid a Cellular Spy Inside a Ledger Wallet #hack #security #crypto
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: Hackers Hid a Cellular Spy Inside a Ledger Wallet #hack #security #crypto · Channel: Better Stack · 01:41 · Watch on YouTube
Topics: Cybersecurity and software security
Summary
Section titled “Summary”Researchers found tampered Ledger Nano X wallets with hidden cellular hardware installed around the secure element. The implant allegedly monitored the screen and button presses to infer a seed phrase, then sent it to attackers over LTE. Because Ledger’s genuine check verifies only the secure element, an added implant could go undetected. The video says tampered units were traced to a Malaysian reseller and advises affected buyers not to set up the device—or to move funds to a new device with a new seed if they already did.
Key points
Section titled “Key points”- A hardware wallet is intended to keep a seed phrase away from the internet.
- Researchers at Trezor Labs examined tampered Ledger Nano X units.
- One device had a smaller battery, a microcontroller, a 2 by 2 mm eSim, and a shielded LTE module.
- The implant allegedly tracked what appeared on the screen and which buttons were pressed.
- The attackers could use that information to work out the seed phrase and send it over LTE.
- Ledger’s genuine check verifies the secure element chip, so it may not detect added hardware if that chip is untouched.
- The devices were traced to Crypto Billis, a reseller based in Malaysia, and were bought on Amazon Japan and Yahoo auctions.
- Bit Query estimated about 93 million dollars in suspected thefts from 315 wallets.
- Ledger’s advice is not to set up a device bought from the reseller; if already set up, move funds to a new device with a new seed.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | A hidden cellular implant | Researchers opened tampered Ledger Nano X wallets and found cellular hardware hidden beneath a smaller replacement battery. |
| 00:35 | How the implant allegedly stole seed phrases | The implant allegedly monitored the screen and button presses, while Ledger’s check could miss hardware added outside the secure element. |
| 01:07 | Reseller findings and safety advice | The video describes where researchers found the devices, estimates suspected thefts, and shares Ledger’s advice for affected buyers. |
Quotes
Section titled “Quotes”they added hardware around it. — 00:00
That’s enough to work out your seed phrase — 00:35
these bugged wallets can pass as genuine. — 00:35
If you already did, move your funds to a new device with a new seed. — 01:07
The real attack is usually somewhere around it. — 01:07
Concepts and entities
Section titled “Concepts and entities”hardware wallet, seed phrase, LTE, Trezor Labs, Ledger Nano X, Ledger, Crypto Billis, Amazon Japan, Yahoo auctions, Bit Query, Better Stack
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 Hardware wallets are supposed to be the one place hackers can’t touch your crypto, but some ledgers just shipped with a tiny cell phone hidden inside. Now, a hardware wallet has one job, keep your seed phrase, the words that control your money, away from the internet. So, the attackers didn’t try to break the crypto, they added hardware around it. Researchers at Trezor Labs opened up tampered Ledger Nano X units. In one, the attacker swapped the battery for a smaller one to make room. And under it sat a microcontroller, a 2 by 2 mm eSim
00:35 and a shielded LTE module. According to the former Mount Gox CEO, the implant watched what the screen showed and which buttons you pressed. That’s enough to work out your seed phrase, then it sent it straight to the attackers over LTE. Ledger’s genuine check only verifies the secure element chip. If that chip is untouched, it can’t detect an added implant. So, these bugged wallets can pass as genuine. The devices were traced to Crypto Billis, a reseller based in
01:07 Malaysia. Researchers bought tampered units on Amazon Japan and Yahoo auctions. Some listed at nearly half price. The analytics firm Bit Query estimated about 93 million dollars in suspected thefts from 315 wallets. Ledger’s advice is this, if you bought from that reseller, don’t set the device up. If you already did, move your funds to a new device with a new seed. And Hackable only covers the part being checked. The real attack is usually somewhere around it. If you want more security breakdowns like this, be sure
01:41 to subscribe to the Better Stack channel.