Ledger confirmed information about detection of implants (hardware add-ons) embedded in hardware Ledger Nano X crypto wallets not sold through officially recommended suppliers. buyers through the reseller CryptoBilis, operating in Malaysia, Indonesia and the Philippines, took the brunt of the attack. It is assumed that with the help of the identified implant, funds were stolen from 324 crypto wallets amounting to about $102 million.
Researchers studied three variants of implants built into devices purchased through Amazon Japan and Yahoo! Auctions from a Chinese seller who shipped orders from Malaysia. The implants used an ST STM32G431KBU6 microcontroller (ARM Cortex‑M4, 128 KB Flash), an LTE modem and an eSIM connected to the SPI bus to intercept information about button presses and data displayed on the built-in OLED screen. The intercepted information was sent to the attackers via the cellular network and made it possible to intercept the secret seed phrase entered by the user during recovery or generated when initializing a new wallet.
In the first and second options, the battery was replaced to accommodate the additional board in the case, and in the third option, the original battery was left, and the chip was placed in the slots of the foam pad under the screen. In the first option, the modification can be immediately noticed by the abundance of additional wires.
The second option involved a board connected via a flexible cable soldered to the factory pins on the original board.
The third option did not use a homemade one, but a specially designed overlay printed circuit board, mass-produced to order. The only visible sign was the antenna wire, and the implant board itself was placed closely above the original Ledger board and visually merged with it. The markings on the chips were erased.
The implants were replaced at one stage of the supply chain without compromising Ledger’s infrastructure. Since the modification does not affect the original Ledger chip, the standard authentication function does not allow to detect the presence of an implant.