Ledger Implant Shows How Genuine Hardware Wallets Can Be Tampered With

A hardware implant in one genuine Ledger wallet captured its owner's 24-word recovery phrase during setup, creating a route to access crypto without altering the device's security chip or operating system. The implant was confirmed in one affected device on Oct. 10. It read the phrase from the screen during setup, decoded the words with a microcontroller and transmitted them over LTE through an embedded SIM. The implant left the Secure Element, operating system, transactions and signatures unchanged, allowing the wallet to keep working normally. The devices were acquired over several months, fitted with hidden components and returned to reseller channels in Southeast Asia. The tampering occurred after the devices left Ledger's control; the Secure Element, operating system and Ledger's servers were not compromised.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to TokenPost.