Abstract:
Earlier, a distributor of the French cryptocurrency hardware wallet Ledger in Malaysia was found to have tampered with the wallet addition module to steal the mnemonic phrase. This security incident has caused at least US$92 million in crypto asset losses, and it is clear that Ledger will not provide any compensation to users. But this incident doesn’t just affect Southeast Asian users, as wallets sold in Europe have also been tampered with.
Wallets sold in Europe have also been modified:
A crypto wallet user purchased a Ledger Nano This is not an isolated incident, because this user has also purchased wallets at other retail stores and dismantled them, and also found that the wallets have been modified.
Initially, the user assumed that the modified version he bought was a return product, but MediaMarkt employees confirmed that the user purchased a brand new product, because all returns involving Ledger wallets will be sent directly back to the manufacturer rather than resold.
Store records show that the Ledger wallet inventory comes from the German company Aqipa GmbH, which provides distribution of various products throughout Europe. It is currently impossible to confirm at which stage the hacker carried out the modification attack. It is possible that the hacker pretended to be the Ledger company and distributed the modified version to the downstream supply chain.
European version disassembly picture:
Comments