Ledger Reseller Attack Raises Questions About Hardware Wallet Supply Chains

A hardware wallet’s strongest cryptography offers little protection when an attacker can interfere with the device before its owner even switches it on. That is the uncomfortable lesson from the CryptoBilis case now facing Ledger customers in Southeast Asia. TL;DR: Investigators have linked roughly $90 million or more in reported crypto losses to tampered wallet devices sold through a reseller channel. Ledger says its own systems were not compromised and has warned affected customers to move to newly generated recovery phrases. The incident involves physical modifications rather than an ordinary phishing message. Reports describe implants that could capture a recovery phrase during device setup and transmit information to attackers. Once someone else possesses that phrase, they may be able to recreate the wallet without needing physical access to the device.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Bitcoinist.