Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?

Mark Karpelès (0:00)

Typically, this kind of attacks, inserting implants into wallets, used to be very expensive, so it would be done on very specific targets. For example, you would create 10 or 20 spy units, and then you would ship those to addresses you've got from a leak, to people telling them, oh, sorry, your information was leaked, or the device you've got has an issue, please use this one instead.

And that's something that actually happened. The one thing that has changed is that this new implant is made for mass production and the ease of installation. Let me say that we're likely going to see a lot more of it in the future.

Laura Shin (0:41)

Hey, everyone. Just a quick note about today's episode. Shortly before we streamed, Ledger released two announcements that we didn't see until after the show, and so didn't get to discuss. One was an announcement by Ledger about the investigation into this incident. Their blog post said that a highly organized criminal group over months bought, quote, genuine Ledger devices, opened them, fitted custom-built hidden components designed to capture the recovery phrase during setup, and put them back into distribution through resellers in Southeast Asia. Everything Mark and Jonty and I discussed in this episode is still relevant. But notice Ledger only admits that the reseller issue existed in Southeast Asia. Contradictory reports that devices bought in Europe also had issues. The Ledger blog post says quote, We followed every lead, including sending teams to local markets, including Germany, to spot buy and open a number of devices from stores. We also examined samples from warehouses. Every unit examined was clean. So Ledger itself has not found corroborating evidence that devices being sold by resellers in Europe were also compromised, which you'll hear us discuss in the show. After that post, the company then announced their new device, the Ledger Atom, which is being marketed as Quantum Ready, has a secure element chip, a privacy switch, AI agent features and the ability to access DeFi protocols. However, with the timing of the announcement, the tweet was getting ratioed hard with comments like, whoever thought it's a good idea announcing a new product right after everything that took place recently needs to be fired ASAP. Although we didn't get to discuss this development, it'll be interesting to see what the reception is to this device going forward. Given the awkward timing of the launch. Other than that, enjoy the show.

Hi, everyone. Welcome to Unchained, your no-hive resource for all things crypto. I'm your host, Laura Shin. Thanks for joining this livestream. First, we'll take a quick bird from the sponsors who make this show possible. This episode is brought to you by Nexo, the premier digital assets wealth platform, earn daily interest on your crypto or borrow funds, all through one platform trusted by more than 10 million clients. Find out more at nexo.com. Geo-destrictions, eligibility, and terms apply. Before we get started, I want to ask you for something. We're making a bunch of decisions right now about Unchained, what we make next, when we go live, what we should be doing more of, and I'd rather hear from you before we make them than after. So we put together a survey. It takes just a few minutes, it's anonymous, and there's a box where you can tell me what we could be doing better. I read all the responses. The link is in the show notes, or you can snap the QR code on-screen, or go to unchainedcrypto.com/survey.

Thanks.

Today's topic is the Ledger reseller hacks. Here to discuss are Mark Karpelès, Chief Executive Officer at Karpelès Labs, and Jonty, Seal 911 contributor and founder of Pangolin Intelligence. Welcome Mark and Jonty. Hello. Thank you. This past week, the crypto community has been stunned by a series of hacks that appears to have been months, if not a year or more in the making. An estimated $100 million or more has been stolen from Ledger hardware wallets, purchased from a reseller in Southeast Asia known as CryptoBilis. Jonty, as far as I can tell, you were the first person to tweet about the hack just as it started. Tell us how you became aware of it. Yeah.

Jonty (4:14)

Hi, Laura. Yeah. Thanks for having us.

As you said, aside from my day job, I'm a contributor to a project called Seal 911 If you don't know us, we're a group of about 25 vetted security researchers who essentially operate a 24-7 free emergency hotline for anybody experiencing a crypto emergency to get some expert advice. That's anything from big companies who've lost hundreds of millions of dollars all the way to, I don't know, your granddad who's suffered a phishing attack or something. So naturally, as soon as these thefts started coming through, people started reporting to Seal 911, saying, hey, my ledger's been drained. And when we get an influx of about five reports that say exactly the same thing, we start getting concerned. And my main role at Seal 911 and more generally, my experience, I'm an on-chain analyst, so I look at the blockchain data to try and work out what's happened. So I immediately started looking at these thefts and noticed that the inflows to the theft addresses were significantly larger than the amounts that were being reported as lost from the victims who reached out to Seal 911