‘Spy Chips’ in Cold Wallets: How Crypto Vanished From Tampered Ledger Devices

A hardware wallet bought to keep cryptocurrency safe instead became a conduit for theft. A criminal group dismantled the devices, concealed malicious components inside and put them back into circulation. The case underscores that keeping private keys offline is not enough to guard against risks in manufacturing and distribution.

Bloomberg reported on October 17 that theft complaints tied to products from French hardware wallet maker Ledger began on October 9. Blockchain researchers estimate the losses at more than $90 million. CryptoVilis, the Malaysian retailer identified in the probe, has halted operations. A notice dated October 10 at its Kuala Lumpur store said it would close temporarily until further notice.

Ledger said in an official statement on October 15 that a highly organized criminal group inserted custom-made parts into genuine devices. The attackers obtained the products over several months, tampered with them and distributed them through resale channels in Southeast Asia. The company said the group also built servers to collect recovery phrases, along with separate infrastructure to steal and launder assets.

The attack targeted the recovery phrase displayed on the wallet screen. That phrase is the key information used to restore a wallet on another device if the original one is lost. The hidden component intercepted the phrase during the initial setup process and transmitted it externally over a mobile network. Attackers could then use it to restore the victim’s wallet and drain the assets.

The attackers did not need to hack the security chip itself. They bypassed the protection by using a separate device to read information being sent to the screen. Ledger said its secure chip, operating system and servers were not compromised. Even so, the case exposed a weakness: A device with altered components can still pass existing authenticity checks even if the security chip is functioning normally.

Reports of suspected tampering also emerged from other sales channels. Ben York, who works in the crypto industry in Kuala Lumpur, said he found suspicious marks on the side of a Ledger Flex he bought at a Metapod store in Singapore Changi Airport. The marks suggested someone had tried to force open the back.

York sent the device to Mark Karpeles, the former chief executive officer of Mt. Gox who now runs Tibanne Labs. Karpeles said he found a custom connector attached to the screen, along with a mobile communications chip and a SIM card. “This isn’t something an individual put together in a garage,” he said. “It’s on a scale you would expect only in a spy movie.” Ledger is also reviewing reports of tampering involving products bought from other retailers.

This is not the first security incident involving hardware wallets. CoinKite products were previously linked to the theft of an estimated $130 million worth of Bitcoin because of a software flaw. Trezor also exposed the personal data of about 67,000 customers after a leak involving a delivery company. Asset theft and personal data breaches are different kinds of incidents, but both show that software and outside service providers can be weak links, not just the device itself.

Esme Pau, head of capital markets and policy at CertiK, said cryptocurrency custody is tied not only to cryptography but also to operational risk across the board. Failsafe Chief Executive Officer Enerin Flynn said blocking one type of attack does not eliminate other risks.

Ledger has asked official sales and distribution partners in Southeast Asia and Hong Kong to suspend sales and is investigating the matter with local law enforcement agencies. It has barred the resale of returned products and tightened distribution controls so stores keep devices separately and hand them over only at the time of purchase.