Last week, cryptocurrency hardware wallet company Ledger said it was investigating a hack that drained $90 million from its devices.
As Bloomberg News reported Sunday (Oct. 18), this reprsents the latest example of a vulnerability in what was once believed to be the safest tool for digital assets.
Numerous hacks in recent months have illustrated that physical devices created to protect digital money from cybercriminals can still be compromised, in some cases before they’re even used, the report said.
“This reveals that crypto storage is an operational risk, not just a cryptographic one,” said Esme Pau, head of capital markets and policy at blockchain security company CertiK. “Real-world security depends on the entire process.”
Ledger last week said it was asking resellers and distributors in Southeast Asia and Hong Kong to halt sales of its wallets while it investigates an incident in which someone in the distribution chain tampered with the devices and drained crypto from them.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
“We understand this is concerning, and will continue to provide updates from the Ledger Donjon [Ledger’s security research team] as the investigation progresses. Stay vigilant,” Ledger said in a social media post. “We have no indication that Ledger’s infrastructure, systems or services or direct sales channel have been compromised.”
An earlier Bloomberg report said that spyware had been implanted in some Ledger devices, some of which were purchased from Malaysian reseller CryptoBilis.
According to Sunday’s report, social media detectives have been probing how those implants work. They say that the hardware intercepts passcodes sent to Ledger screens, then transmits those keys to hackers via cellular connections. Hackers then access funds via other devices.
Ledger’s hardware comes with a protection chip, but the attack works around it, those experts said, meaning implants can escape standard security checks until it’s too late.
“Protecting against one type of attack doesn’t eliminate the others,” said Aneirin Flynn, CEO of cybersecurity technology firm FailSafe.
As Bloomberg noted, this is the latest a series of attacks involving “cold wallets,” which store private keys but are not internet-connected. Once believed to be invulnerable to criminals, a software flaw in similar devices from Coinkite this summer revealed their weaknesses.
“The incident did not break bitcoin’s encryption or reverse transactions on its blockchain. It wasn’t a wrench attack where attackers stole a physical device, tricked its owner into revealing a password or installed malware on an internet-connected computer,” PYMNTS wrote in August on the Coinkite hack. “Instead, the failure occurred at the point of a supposedly secure device.”