Every confirmed case in a burst of drained crypto wallets points to hardware sold by one Southeast Asia reseller, Ledger says, and at least one tampered unit held an unauthorized hardware implant. Blockchain researchers estimate the suspected haul at more than $93 million.
Mark Karpeles, who once ran Mt. Gox, offers the fullest description so far. The Ledger he bought, he says, came from Malaysia already tampered with, and his photos appear to reveal a compact circuit board concealed beneath the screen, where display padding normally sits. A microcontroller, an antenna, an LTE chip and an embedded SIM card sit on that board, by his account.
Screens are what the board watches, in Karpeles’s telling: it notes the recovery phrase at the moment the display shows it, then sends it out over the cellular link. Whoever holds that phrase can rebuild the wallet on any hardware and empty it at will, never touching the original device. The coordinated spate of drains reported on October 9 fits that method.
Detection is hard. Unbroken shrink wrap and a passing Genuine Check greeted Karpeles’s unit, because the genuine security chip within it was authentic. Opening the case, he says, is the sole dependable way to find the added board.
Ledger maintains that neither its own systems nor its direct sales channels were compromised, and that it is cooperating with authorities and reaching out to affected customers. The company has stayed silent on an unverified claim that devices sold in Europe through a different reseller could also be affected.
Anyone who obtained a Ledger from a third-party reseller, particularly in Southeast Asia, should treat the device as untrustworthy and shift funds to a newly generated wallet on hardware bought direct. Never trust a seed phrase on a screen you do not control.
