Ledger Identifies Chip Used in $86M Recovery Phrase Hack

Ledger Pinpoints Root Cause of $86M Hack

Hardware wallet manufacturer Ledger has identified a malicious LTE implant as the culprit behind a recent security breach that resulted in an estimated $86 million in cryptocurrency losses. The firm detailed that the chip, inserted into the supply chain, was capable of intercepting a user’s 24-word recovery phrase during the initial device setup process.

How the Exploit Worked

According to Ledger, the implant operates by reading the recovery phrase directly from the device screen as it is displayed during setup. Crucially, the Secure Element – the chip responsible for securely storing private keys – and its associated software remained untouched, making detection significantly more difficult. This suggests a highly targeted and sophisticated attack, focusing on the physical supply chain rather than a software vulnerability.

Impacted Devices and Mitigation

Ledger has not yet specified which models were affected, but is urging users who purchased devices since May 2023 to exercise extreme caution. The company is offering guidance on how to identify potentially compromised devices and has emphasized the importance of using a new recovery phrase when setting up a replacement wallet. The incident highlights the growing risk of supply chain attacks in the cryptocurrency ecosystem, where physical security is paramount.

Broader Implications

This incident raises questions about the security of hardware wallets, often considered the most secure method for storing digital assets. While the Secure Element itself wasn’t compromised, the attack demonstrates that vulnerabilities can exist at other stages of the hardware lifecycle. The $86 million loss underscores the potential financial damage from such sophisticated exploits and may prompt increased scrutiny of hardware wallet manufacturing processes.

Source: Decrypt