No matter whether you like or hate or don't care about cryptocurrencies, this is incredible stuff...
Now basically: every single attack that's been described as "theoretical" or "far-fetched" or "only existing in the mind of a paranoid person" did actually happen.
We're talking here about a tiny eSIM implant and a little CPU doing OCR on the fonts appearing on the hardware wallet's screen to read the secrets during set up. So the secure element ain't tampered with.
Not long ago the Coldcard hardware wallet had an issue where it'd fallback to a 32-bit only RNG that could be cracked and so many people got their coins stolen.
Now it's Ledger that sees tampered devices all around the world (in Asia for sure but now there are reports about reseller in the EU selling backdoored/eSIM'ed devices).
For people who own Bitcoin at this point one of the only thing kinda sensible to do is to use multisig schemes, like 2-of-2 or 3-of-3 multisig, where your split the secret over two or three different hardware wallet brands (meaning being able to sign a 2-of-2 wallets requires hardware wallets from two different vendors).
When Ledger hardware wallets came out and people said that seed (the list of words) could be intercepted and relayed by a channel bypassing the computer (here by using an eSIM), people would post explaining that people were nuts if they thought such an attack could be pulled off.
Yet here we are.
And Ledger is responsible for very poor security practices: for example it's impossible to use a Ledger hardware wallet in a fully airgapped/offline way. For you're forced to not only upgrade the firmware but also install the Bitcoin "ledger app" (or whatever that is called) after you entered your seed into the device.
Which is complete and total amateur hour.
In addition to that Ledger offers a service to "backup your seed": what could possibly go wrong with that uh?
I'm betting that we'll soon hear about hardware wallets getting drained due to the seed being exfiltrated through "randomness" in how transactions are built/signed (aka "kleptography").
And it's not just representative about people in the cryptocurrencies ecosystem: people simply don't understand computer security and don't understand the potential attacks nor the length at which attackers are willing to go to steal data/funds/ruin other people's lives.
At this point we've heard about chips' plans being modified before the chips are even built (only to lower the entropy of RNGs) [unrelated to cryptocurrencies btw], a worldwide backdoor attempt in SSH, eSIM sending secrets from hardware wallets with tiny attack surfaces.
It speaks a lot to the power of financial incentives. As soon as there's money in it, every conceivable attack to get that money has been tried. Which also mimics what happens in market economies: once there is money in it, every conceivable industry springs up, even things that are absurd or harmful. And money appears to be more powerful than things like laws or governments, in that things that are illegal but profitable happen, while things that are legal and unprofitable do not.
In some ways this is kinda encouraging, because it means that even in cases where society collapses and the government disappears, there are really only two fundamental technologies needed to reboot everything: money and contracts.
I kind of get what you're saying, though I'm not sure how much value money would have without a government to back it up. This is true even for cryptocurrencies. If society collapses and I can't convert to some fiat currency, I don't think I'd trade a bitcoin for six slices of bread.
The incentives lead us toward the classic "Yes, the planet got destroyed. But for a beautiful moment in time we created a lot of value for shareholders." scenario.
Sir Terry predicted this, in his C. M. O. T. Dibbler character[0].
I was just thinking about click fraud, and how I'll bet that a significant number of clicks on sites are now being driven by simple (they don't need to be too complicated) LLMs.
>that things that are illegal but profitable happen, while things that are legal and unprofitable do not.
I'm not sure. I want to say there's volunteering, charities, clubs, religions etc. But those all need resources (time, energy, money) put into them to remain viable. I suppose if something is unprofitable it means the resources (money or not) are drained faster than they go in, and the entity dissolves.
It’s always been said that if Mossad is your adversary you are already fucked. But for a some crypto thieves to operate at this level this early is a bit surprising to me. If you had asked me last year to predict when this would happen I probably would have given this year significantly less than 50% probability.
I consider my phone compromised and will not do banking on it at all. The rest of the world is living in blissful ignorance that will burn them some day.
And yet, you could point that out to lots of people that place hardware in extremely sensitive locations and they most likely won't believe you because to do so would require a lot of prepwork. And right next door sits a few hundred million worth of gear...
I bought my first ledger hardware wallet circa 2017 (If I recall correctly). At the time, they shipped it without any anti-tamper packaging, and even had a note bragging about how it didn't matter, because of how their devices were set up. I forget the exact wording, and would be interested if anyone here has it. Anyways, at the time I was doing hardware hacking for 3-letter agencies, and decided to not use ledger devices when I saw they weren't too concerned with their supply chain.
I bought directly from ledger. I don't know if they were assembling devices in house at the time or not.
> Now basically: every single attack that's been described as "theoretical" or "far-fetched" or "only existing in the mind of a paranoid person" did actually happen.
It's predictable: The ROI of attacking cryptocurrencies in this manner is high enough to make expensive attacks worthwhile. It doesn't make other expensive attacks on typical end-users worthwhile, and they remain far-fetched.
This is a big part of my problem with crypto and why I'm bearish on it breaking through to normies. Traditional financial institutions just seem so much safer all in all, not to mention having far better UX.
The big thing traditional institutions give you is logs of everything. Sure if I get your account number I can take all your money - but there are traces of that and so it is easy to arrest me after the fact.
Don't give out your account numbers, there will be a lot of hassle should an evil person get it. However you have a reasonable change of getting your money back in a couple years. (this is also why you get warning about some countries - a few will not cooperate with traces and so the money is lost)
The reason why traditional works is the fraud can be reversed. If money is stolen from your accounts, as long as you are not the cause, in most cases the institution or govt will make you whole.
Yeah, it is totally great to have to set up a different account for every service, then having to do AML and KYC, and then having your account suspended for no apparent reason. So great that international transfers takes days and tens of dollars in fees, if they succeed at all. So great how a large part of the world‘s populace is denied access to the global financial system. Great as well how centralized it is, so things go down when there are technical problems at your bank. Absolutely awesome how Canada was able to freeze bank accounts of people who donated to the ”wrong“ cause.
They totally have it figured out, we should stop looking for alternatives. We already have the perfect system for the ages. Anybody who even tries is delusional.
> Now basically: every single attack that's been described as "theoretical" or "far-fetched" or "only existing in the mind of a paranoid person" did actually happen.
I think it's good to remember this is always the case. Attacks on tamper evident seals are commonly called "theoretical" or "lacking value" in practical terms, but recent customs evasion using counterfeit seals in the US shows that to be untrue.
Heck, The Wire had an arc about people bypassing customs tamper-seal tags.
> When Ledger hardware wallets came out and people said that seed (the list of words) could be intercepted and relayed by a channel bypassing the computer (here by using an eSIM), people would post explaining that people were nuts if they thought such an attack could be pulled off.
Every single time I thought maybe people on the internet know what they're talking about, I've been proven wrong. The internet is for entertainment purposes only.
The only educational exception has been people who weren't exactly posting on the internet, such as the Berkshire Hathaway shareholder meeting videos or Stanford lectures.
There's a lot of grief can come from it, so I try and read this poem often. [0]
This is not a homogenous mass...it also keeps changing. The internet is just a medium. It's like saying people writing books know what they talk about. Doesn't make sense. Anybody can write on the internet or write a book
I remember seeing a TV program[1] where the UK govt had proposed some hare-brained key escrow thing (this is circa 2000 ish) and they had an expert on to discuss it. Well they didn’t mess around. The expert they had on to explain the drawbacks of the scheme was Whitfield Diffie[2] and he was up against some government contractor slug in a suit. Anyhow Diffie explained that there is essentially no security measure that is effective if you create a prize of infinite value. If the prize for circumventing security is great enough, it will be possible to use money to get around whatever security.
I don't get hardware wallets that have you enter the key on another device. Or don't show the transaction on the hardware device's screen, with every destination and amount, with a button to confirm on the device. Or trusting a wallet to generate a random seed. Or not using the most entropy possible (e.g. 24-word seed). Anything less is dropping the ball.
? Ledger devices are exactly what you’re describing: the key stays on the device, you don’t enter it anywhere. Transactions are confirmed on the small screen + button on device and it displays sender and receiver of a tx.
Back in the day, RSA SecurID hardware tokens were completely physically sealed, with no room for a backdoor. Tampering with them in any ways destroys them or makes it physically obvious. That's a physically secure design. This Ledger thing looks more like a consumer toy.
Not to contradict your point, but in 2011 RSA's SecurID backend servers were hacked. TOTPs require shared secrets, and their server had all the secrets to the SecurID keyfobs they managed. Security is hard.
I always wonder to what degree these omissions are really accidents. There must be some fraction where 'the hacker did it' was baked in from day #1. Not saying that that is the case here but I've seen some pretty questionable stuff that is supposedly very secure (bank security tokens for instance), where there was ample space left in the devices and no anti-tamper measures beyond the case being glued shut. Some even have replaceable batteries for convenient access to the interior right behind the keyboard.
> And Ledger is responsible for very poor security practices: for example it's impossible to use a Ledger hardware wallet in a fully airgapped/offline way.
How would this have helped here? The attackers included the radio. Most people don't have a faraday room at their disposal.
> For you're forced to not only upgrade the firmware but also install the Bitcoin "ledger app" (or whatever that is called) after you entered your seed into the device.
> Which is complete and total amateur hour.
How else would you incorporate protocol updates into your wallet? Although I do agree that it shouldn't be necessary to install these unless absolutely necessary to continue interacting with the blockchain network in question.
> For people who own Bitcoin at this point one of the only thing kinda sensible to do is to use multisig schemes, like 2-of-2 or 3-of-3 multisig, where your split the secret over two or three different hardware wallet brands
What about ignoring proprietary hardware wallets, and implement your 'wallet' as a small, bare-bones, self installed debian system with enough empty disk space to be a full node, that stores the data on a dm-crypt volume? Buy the hardware in cash from a random used computer store. No it won't be as convenient and portable. But if you trust standards-based crypto, you can implement your own ssh tunnel or whatever to it from your other client devices. This also lets you take 1:1 disk clone images of the dm-crypt volume and safely back it up to remote locations at any time you want.
If you really don't want to trust digitally generated seed phrases or digital wallets in general, and that seems reasonable to me, just roll some dice or flip coins.
Its slow, but it will never have been tampered with and can't be digitally cracked if you have multiple physical copies of the resulting seed.
> No matter whether you like or hate or don't care about cryptocurrencies, this is incredible stuff...
> Now basically: every single attack that's been described as "theoretical" or "far-fetched" or "only existing in the mind of a paranoid person" did actually happen.
Huh? Nothing here is theoretical or far-fetched. Hardware attacks of this sort have been documented for decades and basically part-and-parcel for most intelligence agencies, from the US govt installing backdoors in Cisco hardware to the exploding pagers for Hamas. This is not even the first hardware wallet attack documented on the internet (although it might be the largest-scale one).
It's just that hardware attacks are complicated, expensive, and risky, so they're usually done in a targeted manner. The only news here is that the crypto community painted a gigantic target on their backs by inventing a currency that can be taken from them with zero recourse, broadcasting it to the world that they own a lot of it, and then buying cheap hardware from overseas retailers to "protect" their assets. So all of sudden, it was profitable and relatively low-risk to cast a wider net.
It's fascinating in the sense that we're discovering from first principles why the financial system works the way it does. The damage caused by cryptocurrencies has been really pretty staggering, for little real benefit.
It is far-fetched because it is an attack by thieves on consumers, not a state intelligence agency and intelligence targets. It's far-fetched for me to fly an B-2 bomber, but it's been commonplace for US government for decades.
I don't own any crypto, but if I did, I'd probably choose to use a multisig setup with 2+ signers, including at least one (regularly pentested) software wallet.
It depends what you do with your coins. Hardware wallets are meant to be used for people that frequently trade and need to sign transactions.
I always thought it is stupid to HODL using a hardware wallet. For HODLing, just get a random computer (no mailorder) and run debian13 with electrum (it is in the official repo, not an external package hence protected by standard debian safeties). Once you generated you keys, back them up and either wipe the machine, or at least airgap it.
Extra bonus: Raspberry pi 5 runs debian 13 out of the box.
> We're talking here about a tiny eSIM implant and a little CPU doing OCR on the fonts appearing on the hardware wallet's screen to read the secrets during set up. So the secure element ain't tampered with.
Nit: did it actually do OCR? Given the implant was embedded in a specific known device that probably used specifically known fonts, you'd think they could just do a lookup a character's block of pixels to read the screen.
This also speaks to Bitcoin's design weakness in the form of the distributed, authority-less blockchain: there is no authority that can undo or correct illegally made transactions. I know that this is used as a selling point for crypto coins, but I would argue that it is the central enabler behind these conplex technical attacks because it shifts the economy far into the attacker's favor.
Perhaps it is possible that VisaNet is priced more fairly than it would seem at first glance?
I don't have to think about any of this stuff when I am using the payment terminal at Kroger. We have well engineered systems that eliminate the need for being constantly on edge about every monetary transaction. I can lose my entire actual wallet and experience ~zero financial impact, even if a malicious party obtains it.
It always depends how much money you got in the wallet. People in the crypto space go super paranoid, 2-of-3 signing schemes with top-notch security, hardware legers, metal-plated keys that are burried in the woods etc, and in the end they hold less than 1000$ in the wallet... All safety measures should be chosen relative to the amount you are actually securing.
Not sure if your comment invalidates the context: your iPhone app (or hardware or iOS, etc) could have a bug that was not discovered yet. It's all about attack vectors, and opponent motivation and resources.
Can't believe people who went to the trouble of figuring out a hardware wallet are getting robbed just as badly as my naïve ass, who just held all my crypto at FTX
I bought some bitcoin in 2017. Im using electrum, I'm terrified I'm going to get hacked. To the point where I don't even have electrum installed anywhere. I was thinking paper wallets are probably my best bet. I'm not sure what to do. And right now I don't have enough time to seriously investigate my options.
I refuse to touch anything crypto with a ten-foot pole. I don't know if that makes me "paranoid", but it is certainly very easy. Just stay away from the thing doing drug markets, scams and rugpulls every month.
> or "only existing in the mind of a paranoid person" did actually happen.
This reminds me of the 2020 case where a union organizer thought there was a spy camera inside a utility pole outside his house. It was in a conspiracy subreddit, so it seemed like the deranged ramblings of a ravingly-paranoid stranger. But they found the addresses of the IP cams and had plenty of evidence to corroborate it.
Now, Flock cameras are just normal.
I think the 2020s will be defined by this trend. "Things which only existed in the minds of a paranoid person" becoming normal parts of daily life.
Most large cities in the world have had thousands of public CCTV cameras for decades. Traffic enforcement cameras have been super normal for even longer.
Bitcoin rich people generally did nothing legitimate to earn their wealth and are often straight up devious criminals, so hearing this story about them being robbed is just a rare instance of karmic justice, IMO.
This is the argument that scammers and ransomware gangs use: we (the criminals) live in a poor country, and you, the rich white people, enjoy all the benefits. Nothing happens if you lose some of your savings, especially if it's a business and not some granny.
Multiple crypto-experts said that the safest crypto wallet is a recent iPhone in airplane mode which is only used for this purpose. Because it's much harder to implant that your average hardware crypto wallet.
On the other hand, the attack surface of an iPhone is huge compared to a dedicated hardware wallet, and it's hard to keep it in airplane mode and actually transact your coins.
How about if you build your own airgapped hw wallet? There should be plenty folks here who would be capable of doing so. (Doesn't even have to be the most hardened and audited implementation ever since you won't release this to anybody.) This makes you vulnerable to purely very targetted attacks.
As long as the cost of sucha single-target attack isn't substantially below its potential upside, you should be safe.
Otoh, it's only meaningful if you have more than just toy assets in there.
There should be a range between those two though that would contain lots of folks comfortably.
Is it? The theory and even the implementation is literally a gas station credit card skimmer for crypto. I do agree that anyone dismissing attacks on Ledger was foolish, but mostly because Ledger is an obviously low-quality product on even a cursory inspection, not because we need to become even more paranoid conspiracy theorists.
This is why I sold my bitcoin early - all those years of reading Phrack. Sure, it was $300 at the time and I could have made more, but I had no idea how to securely _store_ it. Still don't.
I remember chatting with about AI a few months ago about the issue of foreign RAM sticks being able to cooperate with websites to serve different files/instructions, undetectably. Scary stuff.
Not mentioned in article: MediaMarkt, the German equivalent of Best Buy, was selling these compromised devices on store shelves in every city in Germany.
Selling Ledger wallets or compromised Ledger wallets? My understanding was a reputable reseller (Cryptobilis) was bought and then the wallets were modified via the reseller chain. This isn’t on Ledger it’s a (literal) supply chain attack. Unless MediaMarkt was buying via the reseller?
Why doesn't it surprise me that the shittiest company Media Markt is somehow involved in this. These guys are about to close shop anyway, rest in piss Mediamarkt.
Not that easy. The potting epoxies made for this purpose are nothing like your regular epoxies. They're pricey and when you try to break them you are very likely to tear the parts right off the board. This is the brand I have used in the past:
The devices we made were put in places where there was a significant risk of tampering and to the best of my knowledge nobody ever managed to break the epoxy bond to the point that the circuit was still functional. But as I wrote above: not cheap.
Good question: the battery here doesn't look like it had any room for expansion so it wouldn't be worse per se. But normally you want a little bit of room around a battery, I guess a thin foam liner would allow for that and would still allow you to pot the whole thing.
A more mundane and common use of this technique is for reading the displays of weighing scales, digital micrometers, and similar instruments which did not originally have the feature to enable computer connectivity.
In my teens, I built a digital serial interface for a scale company my uncle was a salesperson for, think highway and landfill truck scales. This is how I built it, very straightforward to your point, mitm from the scale to the display.
Analogue hole is how I did a more efficient smart garage door hack than what people were talking about here at the time. Soldered zigbee switch into the physical button; worked great :D
I had a similar idea to bypass DRM for a while. Some kind of board that goes between the display panel driver and whatever sends it the signal, and outputs something you can capture, e.g. DVI or unencrypted HDMI. Not sure how practical it is.
In the past (circa a few years ago) the connection between the main board for a display and the glass driver board would be a ribbon cable, LVDS signalling. Very straightforward and typically not soldered. There'd be a ribbon cable connector. So yeah, you could just put a board between easily. And there are LVDS to H264/H265 chips already.
But as the other comment points out, older HDCP is broken wide open so ... easier to just use that. Plenty HDCP strippers on the market.
Hardware wallets are not a solution to self-custody.
If one would make a list of things that can go wrong, starting from the supply chain that delivers parts to the manufacturer, malicious employees at the manufacturer, mistakes the manufacturer can make, attacks on the delivery chain from the manufacturer to the user, to mistakes the user can make creating, using and storing their keys - the list would contain hundreds of points.
> Hardware wallets are not a solution to self-custody.
Nothing in this world tends to be "the solution", everything has tradeoffs.
Say you want to do self-custody, what is then the best option? "Don't do self-custody" obviously isn't the solution, as the core use case here is self-custody, so what in your opinion is a better way, than hardware wallets?
If there is nothing better today than hardware wallets, then for now, they are "one of the better solutions" for how to do self-custody, even with the current tradeoffs. But again, I'm eager to hear what the alternatives are.
From a bird's-eye perspective, 3 things are needed: Create a key, derive an address from the key, store the key.
Creating a key safely is possible with dice. You would probably create a seed phrase instead of a key directly, but for this discussion it is the same.
Deriving an address from the key is hard and I have not yet seen a good protocol on how to do it. I have read through a bunch of descriptions of how people do it and they are all weak and brittle. The most popular seems to be "I order a hardware wallet and follow the instructions that come with it". But even people who put a lot of thought into it come up with weak and brittle approaches.
I would think there is a way to do it safely. But I have never seen a description of one yet. It might involve multiple computers, multiple software implementations and a hell of a lot of work to create a multisig that is not prone to a single attack vector.
Storing the key is probably the hardest. The most popular way seems to be to store it in a drawer or a safe. So now those coins are just as safe as a piece of gold would be. Or they use a multisig and store the keys in multiple locations. Quite painful. As you have the ongoing problem of keeping those locations accessible and safe at the same time.
> Say you want to do self-custody, what is then the best option?
A $5 USB stick with Tails on it. You can make as many clones as you want, so no need for a recovery phrase. It's not specialized hardware, so there's no incentive for anyone to look for money on it (plus it's encrypted). If you want to be extra tinfoil hat, make sure you only plug it into an air-gapped machine and copy any output (address, transaction hex etc.) onto another USB.
Passkeys don’t gate immutable financial transactions. (Pretty much everything you do in a bank’s website is reversible during the day to a few days out.)
Banks and payment providers (Visa Mastercard AMX) provide services beyond simply a store of wealth and a mechanism to transfer it.
Actually 2FA, hardware biometrics, behaviour based fraud prevention and personal confirmation of suspicious transactions. If you’re using credit they can refund fraudulent transactions, and there is the chargeback mechanism. This is probably banking system dependent, but in AUS there is a refund mechanism for mistaken/fraudulent traditional bank transactions.
BTC has effectively none of the safety net, and humans are fallible. We need the safety net. It’s the hugest barrier to adoption. Exchanges do a far better job of managing the risks than trusting your wealth to a hardware wallet.
If there was one, someone would write down the steps necessary and put them on the internet. But I have never seen a sound description of how to self-custody Bitcoin in a safe way.
The hardest part seems to not even be the one that currently creates all those problems - the hardware and software used. The hardest part is storing the key (for example a seed phrase). If anyone says they know a way to safely store Bitcoin, my first question is: How do you store the key?
get a brand new, cheap laptop or machine (even a raspberry pi works) that you randomly pickup at the store (no delivery order). Install debian 13, install electrum, airgap the device, reboot and generate 1-of-2 your wallet keys.
The wipe the device, use any non-debian other linux (or BSD) to generated the 2-of-2 wallet key.
The existing financial system which provides protection to consumers. Crypto doesn’t solve the problem the general public assumes it does and hype has inflated its value dramatically.
MPC or multi-sig is a pretty good solution, you can require a 2/3 sign off from different custody solutions (ie. a hardware, desktop, and mobile wallet)
Well this is a tradeoff. In theory a specialized device is more robust and has a smaller attack surface. Consider something running Linux with some libc and a whole host of other shared libs. Sure they have some robustness because they're so widely used but that's a massive attack surface. There is a solid argument for dedicated hardware.
Also, general purpose hardware doesn't really prevent this as much as you might like. You're still subject to supply chain attacks even if Linux (etc) are quite secure. Look at supply chain attacks we've had in the npm and other ecosystems.
My current pet-peeve with the top providers is that they all refuse a fully-airgapped solution. You have all these widgets and gadgets like it's a toy when you are planning to hold millions in there. Their apps are also a joke and polymarket-like these days.
At this point, the best is a 2-multi-sig solution where one is some hardware wallet and the second is an iPhone app wallet where the seed is stored digitally only. So even if your offline seed is compromised, you are still covered.
There are pictures online. And for an unexplainable reason it is the person behind the biggest Bitcoin exchange SNAFU of all times (where hackers stole something like 800 000 Bitcoins), Mark Karpeles of "Mt. Gox" (who did jail time btw), who was the first to post them:
Apparently the hacker did remove the battery and replace it with a smaller one, leaving enough room for the tiny eSIM/LTE modem / OCR chip that did recognition of the secret on screen.
Look at the size of the board in something like a late-model iPhone. The biggest part of a regular smartphone is the battery. The modem and RFIC along with supporting discretes are absolutely tiny. They've been making wrist-sized watch-phones for many years.
This is a cool attack from a technical POV, no doubt.
But what I want to talk about is trust. The big selling point of crypto has always been that fiat currencies, governments and the banking system can't be trusted. Your money can be seized. You may be subject to capital controls. Also, you're subject to chargebacks and so forth.
So crypto hasn't really eliminated the trust issue. It's just moved it. Instead of governments and the financial system having to be trusted, you're trusting far less accountable hardware vendors who might be completely trustworthy as far as you and they know but they can still be subject to supply chain attacks. An extreme (non-crypto) example of this is the Lebanon pager operation.
I've always maintained the crypto is largely solving non-problems and it treats things in the financial system as bugs when they're in fact features, such as reversible transactions.
Crypto transactions has significant limitations, such as everything needs to be on the blockchain (ie the so-called Oracle Problem), which is the whole reason we have stablecoins, etc.
People with this hardware wallet were largely very sophisticated users and even they couldn't successfully and securely manage a wallet. What hopes does the average Joe have?
The more time goes on, the more I'm convinced that crypto is a solution looking for a problem.
Wouldn't using transparent/translucent plastic for the casing make this attack much harder (assuming users verified the insides against official photos)? My bank's hardware tokens used to have that, but new ones are opaque like this wallet. I wonder why.
The other big wallet hardware maker, Trezor, already responded they will majorly cut back their authorized suppliers network.
They want to be certain they have the resources to properly personally verify the operations and trustworthiness of every authorized distributor that they’re vouching for.
My gut reaction is that a hardware implant would be too costly so there's no way they'd actually do that but I guess when you can steal $92M, anything is possible. They could even fab an esoteric chip and still make a profit.
Why do you think it's too costly? It's well known that there are divisions in DPRK that are focused on generating $ through crypto hacks and compromises.
We're dealing with reasonably sophisticated state actors here in this dark forest; not script kiddies.
Cheap $5 PCB + programmable small FPGA is a very viable route too for hardware implants; but even a microcontroller / ESP32/etc will probably do.
> A technical account published by Tibane Labs described an arrangement involving a microcontroller, cellular communication hardware and connections to the screen’s internal data lines.
Cellular communications hardware seems very sophisticated and expensive compared to a simple microcontroller.
They did, in fact, appear to mass-manufacture a custom-built flat flex implant with cellular (LTE-M!), eSIM, and everything that hid right inside the Ledger, sniffing the SPI reads to the display to read the recovery phrases it pukes out and send 'em over cellular to the ringleader.
It's an EXTREMELY well built implant. I'm impressed. Multiple revisions, even.
The money's too hot to not build shit like this and slip it into the stream. Even a few thousand in R&D netting a six figure ROI is worth it, getting millions is just the icing.
Custom flex PCBs designed to line up precisely on top of an existing PCB seems to be a fairly standard technique for games console mod chips (particularly Nintendo Switch) these days.
But yeah, putting a cellular modem and eSIM on there is certainly taking it to the next level
PCBWay will make anything you send them for reasonable pricing. Custom boards etc are not at all hard to manufacture, and for the amount of money you can get, of course you can team up with someone. I think the most people overestimate the cost of bespoke PCB creation.
"tiny eSIM implant and a little CPU " .... i can't even get something like this for my raspberry pi ? lol :(
What would be cool is if someone from Ledger like did some reverse engineering, dumped instructions on how to buy these devices like this and made it so we could use them for hobbyist usage with our own esim. I could for sure think of some use cases for like remote wipe etc.
On a whim I read TFA. What it reported as happening isn't quite what some of the comments here represent. Now, I'm sure there are all kinds of vulnerabilities in Ledger, but this attack seems to be a quite crude supply chain attack mounted on some part of Ledger's retail distribution network. It's actually not even clear that's the case because it talks about these being sold for "half the usual price" so they may have been gray market or second hand. Anyway, this is like buying a Yubikey from Amazon or eBay. You don't do that because Yubico sells direct, which is how you should buy them, to avoid obvious supply chain attacks.
There are other elements of the article that are confused: an "eSIM" is SOFTWARE, not a "tiny chip". Perhaps they mean a "realSIM"?? The SIM is of course only needed to authenticate to a cell network. The article mentions an LTE module. So the e/not-e-SIM aspect seems a little by the by. The main meat of the trojan was a regular ARM SoC.
I already commented the other day on this exploit but really it's fascinating.
I don't care about cryptocurrencies but I've always been fascinated by the cryptography behind it. I've also dabbled with hardware wallets for non-cryptocurrencies stuff: like U2F auth.
The idea of a master secret that is behind a secure element which I control and which I can duplicate is amazing to me (as opposed to, say, "your" passkeys which Google/Microsoft/Apple can basically backup and transfer to other devices for you).
But really to me in the cryptocurrencies world people have been sold the lie that a hardware wallet was secure: it's not. It could be tampered with (as happened in this hack, where an additional rogue chip reading the screen and then sending it using an eSIM steals the secret) but it can also contain a bug (like the recent Coldcard exploit where Coldcard hardware wallets fell back on a RNG with only 32 bits of entropy and some dark-hat hacker cracked those and stole Bitcoins) and, most of all, the vendor of the hardware wallet itself can do nasty attacks (like "kleptography").
From the very start everybody in the ecosystem should have pushed of "n-of-n" schemes (say even just 2-of-2), where one secret goes on a hardware wallet from one vendor and the other secret goes on a hardware wallet from another vendor.
For years and years the tune has been: "PCs cannot be trusted, use a hardware wallet" but it mislead people.
PCs indeed cannot be trusted but unsuspecting users should have learned how to use 2-of-2 or 3-of-3 schemes, to become immune from hacks affecting one hardware wallet vendor.
The typical, non-sensical, response to this is the idiotic: "but if you have two secrets, if you lose one of them you lose everything". It's totally idiotic for people basically save a list of 24 words (the "seed", which is the master secret). Well, guess what: instead of saving a list of 24 words, you save a list of 48 words. Exact same thing, just twice longer.
That's my take: the entire "your coins will be safe if you use a hardware wallet" was misguided.
m-of-n provides increased security AND redundancy.
2-of-3 allows loss of one key, 3-of-5 allows loss of two keys, etc
The cost is increased complexity, but the alternative is potentially losing everything due to a single mistake. So far people seem to overweigh the complexity of multisig, and to overestimate their understanding of using a single signing device.
Reminds me of that time when state actors wanted to spread the Stuxnet worm into an air gapped nucleair facility in Iran, and basically hijacked the whole USB supply chain and put the worm in there.
When enough resources / money is involved, these things are to be expected.
That's not what happened. Companies that did maintenance and had physical access to the facility were targeted, which then pushed the worm on to the laptops and flash drives they would take with them into the air gapped facility.
I bought from this very reseller in the last 90 days and I just opened my Stax with a knife to find out it was implanted. It is a very good job too, if I didn't watch the Youtube video, I would think it's part of the original Ledger hardware.
I wonder the lengths smartphone vendors are going to prevent this kind of attack. I cannot imagine it is easy to completely validate hardware in such an elaborate supply chain. I shudder to think about the attack surface in something like a modern car.
It seems unlikely that smartphones would be targeted for such an attack because almost nobody stores large amounts of crypto on their smartphone. Those that do will likely get hacked more traditionally.
“Not your wallet, not your coins” is usually taken to imply “Your wallet, your coins”, catchy marketing but a logical fallacy. This incident demonstrates as much.
I wonder why they only managed to steal 100M so far. Like with the order of effort needed, why haven't they waited for the really big fish to unlock their ledger?
because the longer they wait, the higher the chance of being discovered before they're able to steal anything. I'm sure there's some game theory about this
Pretty sure an older iphone with lockdown mode enabled has better security than any of these ledger wallets. Unfortunately, apple does not allow you to run custom software on their phones and app store apps can be compromised and give false sense of security even if the keys themselves are in hardware as well as the fact that it's untrusted code running on your hardware as well.
Ledger has had three data leak incidents: once in 2020, a software supply chain attack in 2023 and another data leak in 2026. This latest one is the fourth.
Even if one were to ignore the latest incident, which arguably isn't their fault, the first three incidents make up a pretty bad security track record.
How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
> the latest incident, which arguably isn't their fault
I'd not release them soo easily from their share of responsibility. Tamper-proof hardware is a thing, electronic funds transfer terminals for example already implement ways to detect or prevent physical intrusion into safety-relevant parts of the device. Would probably have cost a few cents in manufacturing to add countermeasures to physical modification into the Ledgers. The fact that there is not even the slightest attempt at securing the device against this kind of attacks is entirely on the manufacturer.
> How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
Surely you can name a dozen of US companies that have been driven out of business by enforcement of EU privacy laws. But I'd be glad if you'd at least name a single one!
I'm not into bitcoins nor physical wallets, but I'm guessing those are not supposed to attach any gsm network ever.
Isn't that trivial to detect, even without opening a device, that something inside is attaching the gsm network? Those are pretty strong signals in a well defined tiny range of frequency, after all.
(Not so long ago you could hear them talk with the towers through regular home speakers.)
You could only realistically detect this in a lab.
You need to actively listen at multiple frequencies at the same time (gsm/lte/5g have many different bands, + wifi/bt at 2.4/5/6 ghz and their bands). And you need to remove interference from all other devices to conclude that signal is coming from ledger (so any home isn't an option).
On top of that, you need to be listening at the exact time it exfiltrates data (it might intentionally wait for some time after using device), and you need to have the compromised device (which the hardest part here - you could test 100s of devices and not find anything).
So I think this could only be caught with a large scale, recurring lab testing, far from "trivial to detect".
It doesn't need to connect to or even turn on the eSIM until you already entered your key and code, by then it is too late. Unlike voice, it just needs a microsecond pulse to send the data. With all the wireless interference, you'd need a controlled setup too.
I'm guessing the best way to go about self custody these days is to have a multi sig wallet, based on multiple hardware wallets from different vendors.
Hardware wallets have a huge target on their back. They are great for convenience, but once you are using multiple for muli-sig you can have more security with less hassle with an airgapped old laptop or a hand-stamped piece of metal you keep in a safe
It would make the tampering more expensive, but not too expensive given the 100 million dollar reward, while also making inspection of the device practically impossible for users.
If you can't get to the insides without breaking it, the only devices verified to likely be safe would be unusable too, so the product would in practice be even more unsafe.
If the user first inspects it and then glue it on their own, that would work, but it wouldn't solve this problem. Evil maid attack is something else and obviously harder at scale.
a lot of things can be done. Hardware epoxy, or anti-tamper switch that auto brick Firmware. There is hardware integrity check. Check the impedance of each pin/gpio, if it's fall out of expected value, brick it.
Be careful. Some data from resellers has been hacked or leaked and scammers will contact you saying your device is compromised to run software or other methods to get your keys. This is a known scam from previous ledger software exploits. They will give you cves and won't have any typically scammers accent.
> The crypto wallet maker also noted that it was working with authorities to identify the perpetrator and bring them to justice.
Is it nowadays a workable defense to say that you had a bunch of AI agents in a sandbox doing experiments and they somehow escaped and you will totally make sure this does not happen again?
Not really. We have physical proof of the compromised Ledger devices; no one has ever presented any specific evidence that Supermicro hardware was similarly compromised.
One would've thought that the display data bus would be encrypted/scrambled in such a device, or at least packaged in a way that makes this kind of attack destructive to the circuit board (chip-on-glass).
What a f-ing nightmare. It's stuff like this where I start to understand Apple's stance on right to repair. How do you maintain hardware security without strict provenance over every component in your device?
Even if you have perfect provenance over every component you put in, the moment it leaves your factory to be shipped to customers, it can be tampered with.
Even if you would hand it from the factory straight to a customer that comes physically to your factory to pick it up, then you would still require some sort of ID to know that that person is in fact the customer I suppose. Which removes some of the advantages of cryptocurrencies
One of the educational parts of this is that the phrase "supply chain attack" evokes image of Mission Impossible nonsense, whereas this was "just buy the reseller"...
Why are these things not potted in epoxy at the factory? Not that it would entirely prevent this attack but it could make it a lot harder to execute and hide.
getting more into just storing things on paper, and occasionally going digital, recently started working on making an open source secret storage/keeper, to just use by myself to store things when i need to access it on the go, built it with libsodium and argon2id. now i know it doesnt protect me against hardware things, but at least i know where i am storing my things
You should have a paper backup of your hardware wallet anyway. The point of the wallet is to perform cryptographic calculations you’ll probably rather not do in your head.
This was stealing the seed phrases as they were being displayed so the user could make the paper backup you suggest and in the process have all their current and future coins stolen.
Possibly, there is a lot of KYC involved in setting up an eSIM virtual provider but the party that ordered the eSIMs may not be in the know, and the attacker may have obfuscated their credentials or used high quality fakes.
It's always fascinating to me to poke my head into the crypto ecosystem because so many problems people are encountering in it are just... solved in fiat-currency ecosystems.
Nothing like the monopoly on violence to severely discourage bad actors from executing something like this.
The fact that some people can put million dollars worth of crypto on a device, but can't buy a plane ticket to someone to get the device straight from the factory is crazy.
> Before Ledger publicly confirmed the hardware implant, former Mt. Gox CEO Mark Karpelès reported examining a suspicious Ledger Nano X device obtained from Malaysia. On October 9, Karpelès described finding an additional electronic component hidden behind the device’s display, inside material normally used to protect the screen.
> He reported that the wallet had arrived in packaging that appeared intact, raising questions about whether customers could identify a modified device through a routine visual inspection. In photographs shared publicly, the component appeared to contain electronic circuitry separate from the wallet’s original hardware
Can see why hardware wallets seemed a good idea at the time but history has shown this is a terrible way to self custody. Compromised devices aside, the KYC data leaks have put people in danger too.
The cash has been acting as a medium of exchange (something the cryptocurrency industry has given up on, at this point), which is its job, and my wealth is in capital. And capital is what the world runs on. And it's done really well.
And yet on this exact website people critical of the industry were ridiculed with the exact same rhetoric adopted by the AI industry. It was touted by so many as inevitable, and how we will all be left behind if we don’t join the cult
finally, good use for eSIMs /s
But damn, it's hard problem to fix. Put it in epoxy and while tampering is harder (not impossible! also can just replace whole module), you can't verify it
TBH, this just sounds to me like the crypto industry is discovering, yet again, why the banking and credit card industry have all this red tape and supply chain security.
Like sure, they're not fully immune... But at least I can call my bank and show them that I didn't suddenly fly from New Mexico to Florida to buy $200 in gift cards from a gas station in the middle of nowhere.
Crypto MUST deal with fraud and hacking if they want to become reliable. At that point, they'll just become another bank with a casino attached.
I can guarantee that if this was open-source, someone or some system would’ve picked it up. I’m still amazed that one guy picked up the XZ Utils backdoor because it slowed down after an update.
Oh-Kay_Labs have said it for years. Not only hackers and thieves go for them, but also kidnappers and robbers. If anyone knows you have one, and things could be much worse. Use paper-wallets, old phones and encrypted USBs instead.
>Use paper-wallets, old phones and encrypted USBs instead.
None of these prevent thieves or anybody from knowing you have one worth stealing. The actual solution is to not use fundamentally broken transparent crypto like BTC that broadcasts to the whole world your exact funds and ties them to your identity on every transaction. With monero your funds could be 0,10 or 10 billion and that is nobody's business.
LOL why would anyone want a hardware wallet when you can just store your Bitcoins on your own encrypted hard disk or USB stick? Bitcoin is merely a file.
These people are being suckered into a false sense of security with hardware cryptowallets. I mean, it would be very tempting to sell a hardware wallet with a backdoor inside of it to steal everyone's cryptocurrency, wouldn't it?
You can use FDE all you want but you're still vulnerable to that file being stolen. Do you install programs from outside your package manager? Do you personally verify and compile everything? Do you pirate stuff? Use npm? Have an AI agent? Do you fully trust the browser sandbox? Click on email attachments? Even if you are Better Than Most, judging by the amount of youtubers that get hacked through stolen cookies, it's clear to me that even above-average people are susceptible to having files stolen.
Keeping your wallet file on a USB stick (or encrypting it) merely reduces the window of time an attacker can get the information. The attacker with local access could simply replace your wallet software. Or make use of a keylogger, screen capture, memory capture, etc.
In that context a dedicated device is the safer approach, and a hardware key is a minimalist device to do that whilst also being less inconvenient than an airgapped dedicated crypto laptop.
This whole operation smells Israeli from the beginning to the end. First are these USB ledgers with modified hardware (guess who likes to do that on pagers and similar), then this happens in Germany, the country that never says "no" to the same specific group of people and finally they try exfiltrate the stolen funds with the favorite "private" coin of the same group of people, which in end is (again) proven to NOT be private at all.https://x.com/YFarmX/status/2108918564015006200
HN will never permit to look into the origin of this criminal action and normies will not even put that possibility on the table because they've been programmed against it. Let's play a game, this is a serious criminal act. I bet this will be quickly forgoten in about 3 weeks without anyone in Germany pointing fingers to the guilty party.
The crypto-theft angle seems more typical of China/NK/Russia to me. (China has some history of hardware supply-chain attacks). But without evidence we're simply speculating.
No matter whether you like or hate or don't care about cryptocurrencies, this is incredible stuff...
Now basically: every single attack that's been described as "theoretical" or "far-fetched" or "only existing in the mind of a paranoid person" did actually happen.
We're talking here about a tiny eSIM implant and a little CPU doing OCR on the fonts appearing on the hardware wallet's screen to read the secrets during set up. So the secure element ain't tampered with.
Not long ago the Coldcard hardware wallet had an issue where it'd fallback to a 32-bit only RNG that could be cracked and so many people got their coins stolen.
Now it's Ledger that sees tampered devices all around the world (in Asia for sure but now there are reports about reseller in the EU selling backdoored/eSIM'ed devices).
For people who own Bitcoin at this point one of the only thing kinda sensible to do is to use multisig schemes, like 2-of-2 or 3-of-3 multisig, where your split the secret over two or three different hardware wallet brands (meaning being able to sign a 2-of-2 wallets requires hardware wallets from two different vendors).
When Ledger hardware wallets came out and people said that seed (the list of words) could be intercepted and relayed by a channel bypassing the computer (here by using an eSIM), people would post explaining that people were nuts if they thought such an attack could be pulled off.
Yet here we are.
And Ledger is responsible for very poor security practices: for example it's impossible to use a Ledger hardware wallet in a fully airgapped/offline way. For you're forced to not only upgrade the firmware but also install the Bitcoin "ledger app" (or whatever that is called) after you entered your seed into the device.
Which is complete and total amateur hour.
In addition to that Ledger offers a service to "backup your seed": what could possibly go wrong with that uh?
I'm betting that we'll soon hear about hardware wallets getting drained due to the seed being exfiltrated through "randomness" in how transactions are built/signed (aka "kleptography").
And it's not just representative about people in the cryptocurrencies ecosystem: people simply don't understand computer security and don't understand the potential attacks nor the length at which attackers are willing to go to steal data/funds/ruin other people's lives.
At this point we've heard about chips' plans being modified before the chips are even built (only to lower the entropy of RNGs) [unrelated to cryptocurrencies btw], a worldwide backdoor attempt in SSH, eSIM sending secrets from hardware wallets with tiny attack surfaces.
You're not anywhere near paranoid enough.
It speaks a lot to the power of financial incentives. As soon as there's money in it, every conceivable attack to get that money has been tried. Which also mimics what happens in market economies: once there is money in it, every conceivable industry springs up, even things that are absurd or harmful. And money appears to be more powerful than things like laws or governments, in that things that are illegal but profitable happen, while things that are legal and unprofitable do not.
In some ways this is kinda encouraging, because it means that even in cases where society collapses and the government disappears, there are really only two fundamental technologies needed to reboot everything: money and contracts.
I kind of get what you're saying, though I'm not sure how much value money would have without a government to back it up. This is true even for cryptocurrencies. If society collapses and I can't convert to some fiat currency, I don't think I'd trade a bitcoin for six slices of bread.
The incentives lead us toward the classic "Yes, the planet got destroyed. But for a beautiful moment in time we created a lot of value for shareholders." scenario.
https://www.insidehook.com/culture/story-tom-toro-new-yorker...
30 replies →
> It speaks a lot to the power of financial incentives
Also, to the power of modern-day cryptography that rubber-hose and evil maid (backdoors) are the only viable (even if expensive) alternatives.
> the government disappears, there are really only two fundamental technologies needed to reboot everything: money and contracts
Both of which require "governance", but post-collapse, it may be of form that may not benefit the collective.
1 reply →
The two most important fundamentals are agreements (contracts) and the ability to enforce them (that is, to seek redress) - as in: law enforcement.
A high trust society. Everything else is downstream of that.
Sir Terry predicted this, in his C. M. O. T. Dibbler character[0].
I was just thinking about click fraud, and how I'll bet that a significant number of clicks on sites are now being driven by simple (they don't need to be too complicated) LLMs.
[0] https://discworld.fandom.com/wiki/Cut-Me-Own-Throat_Dibbler
>that things that are illegal but profitable happen, while things that are legal and unprofitable do not.
I'm not sure. I want to say there's volunteering, charities, clubs, religions etc. But those all need resources (time, energy, money) put into them to remain viable. I suppose if something is unprofitable it means the resources (money or not) are drained faster than they go in, and the entity dissolves.
Money is a contract, so I guess its just contracts all the way down.
After the Hezbullah pagers incident, the basic assumption has to be that every possible supply chain attack you can think of is realistic.
It’s always been said that if Mossad is your adversary you are already fucked. But for a some crypto thieves to operate at this level this early is a bit surprising to me. If you had asked me last year to predict when this would happen I probably would have given this year significantly less than 50% probability.
5 replies →
I thought it was Israel who did the pager bomb attack, not Hezbollah?
1 reply →
I consider my phone compromised and will not do banking on it at all. The rest of the world is living in blissful ignorance that will burn them some day.
8 replies →
Hezbullah and a few innocent civilians. It was pretty messy.
And yet, you could point that out to lots of people that place hardware in extremely sensitive locations and they most likely won't believe you because to do so would require a lot of prepwork. And right next door sits a few hundred million worth of gear...
[dead]
I bought my first ledger hardware wallet circa 2017 (If I recall correctly). At the time, they shipped it without any anti-tamper packaging, and even had a note bragging about how it didn't matter, because of how their devices were set up. I forget the exact wording, and would be interested if anyone here has it. Anyways, at the time I was doing hardware hacking for 3-letter agencies, and decided to not use ledger devices when I saw they weren't too concerned with their supply chain.
I bought directly from ledger. I don't know if they were assembling devices in house at the time or not.
Edit: further context, this discussion is somewhat relevant to how confident they were. See the OP's remark about what ledger said: https://www.reddit.com/r/CryptoCurrency/comments/ssycjn/my_l...
> Now basically: every single attack that's been described as "theoretical" or "far-fetched" or "only existing in the mind of a paranoid person" did actually happen.
It's predictable: The ROI of attacking cryptocurrencies in this manner is high enough to make expensive attacks worthwhile. It doesn't make other expensive attacks on typical end-users worthwhile, and they remain far-fetched.
"that's been described" is the important part of that statement
Ah, but typical end-users is only one class of targets, industry is another and there the pay-off can be substantial.
This is a big part of my problem with crypto and why I'm bearish on it breaking through to normies. Traditional financial institutions just seem so much safer all in all, not to mention having far better UX.
The big thing traditional institutions give you is logs of everything. Sure if I get your account number I can take all your money - but there are traces of that and so it is easy to arrest me after the fact.
Don't give out your account numbers, there will be a lot of hassle should an evil person get it. However you have a reasonable change of getting your money back in a couple years. (this is also why you get warning about some countries - a few will not cooperate with traces and so the money is lost)
15 replies →
The reason why traditional works is the fraud can be reversed. If money is stolen from your accounts, as long as you are not the cause, in most cases the institution or govt will make you whole.
1 reply →
The traditional banks are not better than crypto for receiving and sending money, specially when it comes to international transactions.
The only thing they are better is providing security in an easier way.
2 replies →
I think it also encourages us to rethink specialized and hardened advices versus general ones.
The same attack on every desktop and laptop would be... significantly harder.
> not to mention having far better UX
Yeah, it is totally great to have to set up a different account for every service, then having to do AML and KYC, and then having your account suspended for no apparent reason. So great that international transfers takes days and tens of dollars in fees, if they succeed at all. So great how a large part of the world‘s populace is denied access to the global financial system. Great as well how centralized it is, so things go down when there are technical problems at your bank. Absolutely awesome how Canada was able to freeze bank accounts of people who donated to the ”wrong“ cause.
They totally have it figured out, we should stop looking for alternatives. We already have the perfect system for the ages. Anybody who even tries is delusional.
I'd argue that if used properly that crypto is more secure than most banks.
6 replies →
> Now basically: every single attack that's been described as "theoretical" or "far-fetched" or "only existing in the mind of a paranoid person" did actually happen.
I think it's good to remember this is always the case. Attacks on tamper evident seals are commonly called "theoretical" or "lacking value" in practical terms, but recent customs evasion using counterfeit seals in the US shows that to be untrue.
Heck, The Wire had an arc about people bypassing customs tamper-seal tags.
> When Ledger hardware wallets came out and people said that seed (the list of words) could be intercepted and relayed by a channel bypassing the computer (here by using an eSIM), people would post explaining that people were nuts if they thought such an attack could be pulled off.
Every single time I thought maybe people on the internet know what they're talking about, I've been proven wrong. The internet is for entertainment purposes only.
The only educational exception has been people who weren't exactly posting on the internet, such as the Berkshire Hathaway shareholder meeting videos or Stanford lectures.
There's a lot of grief can come from it, so I try and read this poem often. [0]
[0] https://gladdestthing.com/poems/ed
> people on the internet
This is not a homogenous mass...it also keeps changing. The internet is just a medium. It's like saying people writing books know what they talk about. Doesn't make sense. Anybody can write on the internet or write a book
1 reply →
I remember seeing a TV program[1] where the UK govt had proposed some hare-brained key escrow thing (this is circa 2000 ish) and they had an expert on to discuss it. Well they didn’t mess around. The expert they had on to explain the drawbacks of the scheme was Whitfield Diffie[2] and he was up against some government contractor slug in a suit. Anyhow Diffie explained that there is essentially no security measure that is effective if you create a prize of infinite value. If the prize for circumventing security is great enough, it will be possible to use money to get around whatever security.
[1] “Newsnight” on BBC
[2] As in Diffie-Hellman etc https://en.wikipedia.org/wiki/Whitfield_Diffie
I don't get hardware wallets that have you enter the key on another device. Or don't show the transaction on the hardware device's screen, with every destination and amount, with a button to confirm on the device. Or trusting a wallet to generate a random seed. Or not using the most entropy possible (e.g. 24-word seed). Anything less is dropping the ball.
? Ledger devices are exactly what you’re describing: the key stays on the device, you don’t enter it anywhere. Transactions are confirmed on the small screen + button on device and it displays sender and receiver of a tx.
2 replies →
> So the secure element ain't tampered with.
Back in the day, RSA SecurID hardware tokens were completely physically sealed, with no room for a backdoor. Tampering with them in any ways destroys them or makes it physically obvious. That's a physically secure design. This Ledger thing looks more like a consumer toy.
Not to contradict your point, but in 2011 RSA's SecurID backend servers were hacked. TOTPs require shared secrets, and their server had all the secrets to the SecurID keyfobs they managed. Security is hard.
4 replies →
Anything about RSA SecurID hardware tokens always makes think about the guy who used a web cam and OCR to read token LCD screen.
https://smallhacks.wordpress.com/2012/11/11/reading-codes-fr...
I always wonder to what degree these omissions are really accidents. There must be some fraction where 'the hacker did it' was baked in from day #1. Not saying that that is the case here but I've seen some pretty questionable stuff that is supposedly very secure (bank security tokens for instance), where there was ample space left in the devices and no anti-tamper measures beyond the case being glued shut. Some even have replaceable batteries for convenient access to the interior right behind the keyboard.
It's not doing OCR on the screen, it's intercepting the pixel data that comes unencrypted over the SPI bus that connects the CPU to the display.
The idea reminds me somehow of bank card ATM skimmers from old times like this one (2009): https://www.consumerreports.org/consumerist/heres-what-a-car...
> And Ledger is responsible for very poor security practices: for example it's impossible to use a Ledger hardware wallet in a fully airgapped/offline way.
How would this have helped here? The attackers included the radio. Most people don't have a faraday room at their disposal.
> For you're forced to not only upgrade the firmware but also install the Bitcoin "ledger app" (or whatever that is called) after you entered your seed into the device.
> Which is complete and total amateur hour.
How else would you incorporate protocol updates into your wallet? Although I do agree that it shouldn't be necessary to install these unless absolutely necessary to continue interacting with the blockchain network in question.
Would love to hear people's thoughts on this excerpt from the Epstein files in light of these disclosures:
--------------
From: Vincenzo lozzo
Sent: Monday, July 2, 2018 8:04 AM
To: jeevacation@gmail.com
Subject: Ledger wallet warning
Attachments: image1jpeg; Untitled attachment 00284.txt
In case you hold any coins in it, please don't spread this as they h=ven't released any of the information yet.
As for what is worth, the other wallets seem just as bad
--------------
Links:
https://www.justice.gov/epstein/files/DataSet%2011/EFTA02501...
https://www.justice.gov/epstein/files/DataSet%2011/EFTA02507...
https://www.justice.gov/epstein/files/DataSet%209/EFTA008603...
https://www.justice.gov/epstein/files/DataSet%2011/EFTA02505...
Lol at the thought of Steve Bannon speaking at DEFCON (last link).
2018? Irrelevant
1 reply →
> For people who own Bitcoin at this point one of the only thing kinda sensible to do is to use multisig schemes, like 2-of-2 or 3-of-3 multisig, where your split the secret over two or three different hardware wallet brands
What about ignoring proprietary hardware wallets, and implement your 'wallet' as a small, bare-bones, self installed debian system with enough empty disk space to be a full node, that stores the data on a dm-crypt volume? Buy the hardware in cash from a random used computer store. No it won't be as convenient and portable. But if you trust standards-based crypto, you can implement your own ssh tunnel or whatever to it from your other client devices. This also lets you take 1:1 disk clone images of the dm-crypt volume and safely back it up to remote locations at any time you want.
what kind of hardware would you buy to have a reasonable chance at being usable in 15 or 20 years?
1 reply →
If you really don't want to trust digitally generated seed phrases or digital wallets in general, and that seems reasonable to me, just roll some dice or flip coins.
Its slow, but it will never have been tampered with and can't be digitally cracked if you have multiple physical copies of the resulting seed.
> No matter whether you like or hate or don't care about cryptocurrencies, this is incredible stuff...
> Now basically: every single attack that's been described as "theoretical" or "far-fetched" or "only existing in the mind of a paranoid person" did actually happen.
Huh? Nothing here is theoretical or far-fetched. Hardware attacks of this sort have been documented for decades and basically part-and-parcel for most intelligence agencies, from the US govt installing backdoors in Cisco hardware to the exploding pagers for Hamas. This is not even the first hardware wallet attack documented on the internet (although it might be the largest-scale one).
It's just that hardware attacks are complicated, expensive, and risky, so they're usually done in a targeted manner. The only news here is that the crypto community painted a gigantic target on their backs by inventing a currency that can be taken from them with zero recourse, broadcasting it to the world that they own a lot of it, and then buying cheap hardware from overseas retailers to "protect" their assets. So all of sudden, it was profitable and relatively low-risk to cast a wider net.
It's fascinating in the sense that we're discovering from first principles why the financial system works the way it does. The damage caused by cryptocurrencies has been really pretty staggering, for little real benefit.
It is far-fetched because it is an attack by thieves on consumers, not a state intelligence agency and intelligence targets. It's far-fetched for me to fly an B-2 bomber, but it's been commonplace for US government for decades.
1 reply →
Agree on your comments about amateur hour.
I've worked in payment terminal hardware security and this is not surprising to me at all.
This attack on the Ledger wallets would definitely rate as amateur in terms of sophistication in that world.
I don't own any crypto, but if I did, I'd probably choose to use a multisig setup with 2+ signers, including at least one (regularly pentested) software wallet.
It depends what you do with your coins. Hardware wallets are meant to be used for people that frequently trade and need to sign transactions.
I always thought it is stupid to HODL using a hardware wallet. For HODLing, just get a random computer (no mailorder) and run debian13 with electrum (it is in the official repo, not an external package hence protected by standard debian safeties). Once you generated you keys, back them up and either wipe the machine, or at least airgap it.
Extra bonus: Raspberry pi 5 runs debian 13 out of the box.
> We're talking here about a tiny eSIM implant and a little CPU doing OCR on the fonts appearing on the hardware wallet's screen to read the secrets during set up. So the secure element ain't tampered with.
Nit: did it actually do OCR? Given the implant was embedded in a specific known device that probably used specifically known fonts, you'd think they could just do a lookup a character's block of pixels to read the screen.
This also speaks to Bitcoin's design weakness in the form of the distributed, authority-less blockchain: there is no authority that can undo or correct illegally made transactions. I know that this is used as a selling point for crypto coins, but I would argue that it is the central enabler behind these conplex technical attacks because it shifts the economy far into the attacker's favor.
> there is no authority that can undo or correct illegally made transactions
That is the only way to ensure no "authority" can undo or correct legally made transactions.
Perhaps it is possible that VisaNet is priced more fairly than it would seem at first glance?
I don't have to think about any of this stuff when I am using the payment terminal at Kroger. We have well engineered systems that eliminate the need for being constantly on edge about every monetary transaction. I can lose my entire actual wallet and experience ~zero financial impact, even if a malicious party obtains it.
Because card readers brick themselves if opened or tampered with. If Ledger designed their hardware the same, this attack would not be possible.
1 reply →
Here I am using an iPhone app like I have been for a decade, feeling safer than ever. I'm really glad I didn't jump on the hardware wallet trend.
It always depends how much money you got in the wallet. People in the crypto space go super paranoid, 2-of-3 signing schemes with top-notch security, hardware legers, metal-plated keys that are burried in the woods etc, and in the end they hold less than 1000$ in the wallet... All safety measures should be chosen relative to the amount you are actually securing.
10 replies →
Even iPhone apps:
https://www.reddit.com/r/Bitcoin/comments/1x46gnh/a_fake_cry...
1 reply →
Not sure if your comment invalidates the context: your iPhone app (or hardware or iOS, etc) could have a bug that was not discovered yet. It's all about attack vectors, and opponent motivation and resources.
Can't believe people who went to the trouble of figuring out a hardware wallet are getting robbed just as badly as my naïve ass, who just held all my crypto at FTX
2 replies →
I bought some bitcoin in 2017. Im using electrum, I'm terrified I'm going to get hacked. To the point where I don't even have electrum installed anywhere. I was thinking paper wallets are probably my best bet. I'm not sure what to do. And right now I don't have enough time to seriously investigate my options.
> You're not anywhere near paranoid enough
I refuse to touch anything crypto with a ten-foot pole. I don't know if that makes me "paranoid", but it is certainly very easy. Just stay away from the thing doing drug markets, scams and rugpulls every month.
The US dollar would like a word
1 reply →
Got worried there for a second about the mokka pot I got through Amazon instead of Bialetti.
Lots of security relies on potential attackers being lazy and relatively 'sane'.
There are lots of security measures you can bypass if you pretend to be crazy within given bounds or simply stop acting sane.
Apparently the world learned nothing from Israel's Pager Attack.
Post it note in a drawer somewhere baby
> or "only existing in the mind of a paranoid person" did actually happen.
This reminds me of the 2020 case where a union organizer thought there was a spy camera inside a utility pole outside his house. It was in a conspiracy subreddit, so it seemed like the deranged ramblings of a ravingly-paranoid stranger. But they found the addresses of the IP cams and had plenty of evidence to corroborate it.
Now, Flock cameras are just normal.
I think the 2020s will be defined by this trend. "Things which only existed in the minds of a paranoid person" becoming normal parts of daily life.
Most large cities in the world have had thousands of public CCTV cameras for decades. Traffic enforcement cameras have been super normal for even longer.
1 reply →
Bitcoin rich people generally did nothing legitimate to earn their wealth and are often straight up devious criminals, so hearing this story about them being robbed is just a rare instance of karmic justice, IMO.
This is the argument that scammers and ransomware gangs use: we (the criminals) live in a poor country, and you, the rich white people, enjoy all the benefits. Nothing happens if you lose some of your savings, especially if it's a business and not some granny.
1 reply →
Multiple crypto-experts said that the safest crypto wallet is a recent iPhone in airplane mode which is only used for this purpose. Because it's much harder to implant that your average hardware crypto wallet.
On the other hand, the attack surface of an iPhone is huge compared to a dedicated hardware wallet, and it's hard to keep it in airplane mode and actually transact your coins.
1 reply →
How about if you build your own airgapped hw wallet? There should be plenty folks here who would be capable of doing so. (Doesn't even have to be the most hardened and audited implementation ever since you won't release this to anybody.) This makes you vulnerable to purely very targetted attacks.
As long as the cost of sucha single-target attack isn't substantially below its potential upside, you should be safe.
Otoh, it's only meaningful if you have more than just toy assets in there.
There should be a range between those two though that would contain lots of folks comfortably.
3 replies →
How about a recent Pixel with GrapheneOS, again kept in airplane mode and only used for this purpose? Using QR codes for transaction signing.
Why is it harder to implant?
10 replies →
"crypto-experts"
Exactly, inspiration.
after you entered your seed into the device.
ewww
> this is incredible stuff...
Is it? The theory and even the implementation is literally a gas station credit card skimmer for crypto. I do agree that anyone dismissing attacks on Ledger was foolish, but mostly because Ledger is an obviously low-quality product on even a cursory inspection, not because we need to become even more paranoid conspiracy theorists.
[dead]
[dead]
This is why I sold my bitcoin early - all those years of reading Phrack. Sure, it was $300 at the time and I could have made more, but I had no idea how to securely _store_ it. Still don't.
You are king sensible. Well done. Just $90,000 per BTC worse off ha ha.
1 reply →
I remember chatting with about AI a few months ago about the issue of foreign RAM sticks being able to cooperate with websites to serve different files/instructions, undetectably. Scary stuff.
Are you sure whatever the LLM said was actually credible though?
2 replies →
Not mentioned in article: MediaMarkt, the German equivalent of Best Buy, was selling these compromised devices on store shelves in every city in Germany.
Selling Ledger wallets or compromised Ledger wallets? My understanding was a reputable reseller (Cryptobilis) was bought and then the wallets were modified via the reseller chain. This isn’t on Ledger it’s a (literal) supply chain attack. Unless MediaMarkt was buying via the reseller?
according to this guy, compromised (https://x.com/0xJohannes_/status/2109240472933671125). Interestingly, Mediamarkt removed the device from their shop quickly after (https://www.mediamarkt.de/de/product/_ledger-sas-nano-s-plus... now 404).
2 replies →
> This isn’t on Ledger it’s a (literal) supply chain attack.
Supply chain attack?
"Can't do shit, not my problem."
If it was that easy to shed responsibility.
14 replies →
I wonder what the liabilities are for that
Not much unless you can show that they knew about it. Otherwise, they are just as much a victim.
5 replies →
Why doesn't it surprise me that the shittiest company Media Markt is somehow involved in this. These guys are about to close shop anyway, rest in piss Mediamarkt.
Genuinely curious, why the hate for MediaMarkt?
The link you want:
https://grandideastudio.com/portfolio/security/ledger-hardwa...
They should have posted the weight with and without the device in it.
Also: never leave empty space in a hardware key, pot the whole thing in epoxy.
No, this is May version. If you look at the twitter thread, the October version is different and looks much more "stock"
(sadly I have not found nice website with newer version photos yet)
I heard they reduced the battery size to make space for their chip.
Yes, hence the potting. You'd have to figure out a way to open the device without breaking it.
19 replies →
Well, still a safer reason for clandestinely reducing the size of a battery in a mobile device many people carry around close to their body.
Interesting. Everyone that read the article also heard that.
This one too (pardon the AI slop): https://www.tibane.net/research/ledger-nano-x-implant
Ah good one, more useful info in that one. That kapton circuit might be traceable to whoever ordered it.
4 replies →
This is May version. If you look at the twitter thread, the October version is different and looks much more "stock"
1 reply →
They could x-ray it, carve out epoxy with nothing inside, put the logger, apply epoxy.
Not that easy. The potting epoxies made for this purpose are nothing like your regular epoxies. They're pricey and when you try to break them you are very likely to tear the parts right off the board. This is the brand I have used in the past:
https://www.masterbond.com/techtips/tamper-resistant-potting...
The devices we made were put in places where there was a significant risk of tampering and to the best of my knowledge nobody ever managed to break the epoxy bond to the point that the circuit was still functional. But as I wrote above: not cheap.
Is that safe for devices containing a lithium battery?
Good question: the battery here doesn't look like it had any room for expansion so it wouldn't be worse per se. But normally you want a little bit of room around a battery, I guess a thin foam liner would allow for that and would still allow you to pot the whole thing.
2 replies →
Take off the case, put your own entire module in, put the case back in. Epoxy doesn't solve much.
...frankly, selling one as DIY kit have highest chance for tamper resistance. Tho pretty untenable with small SMD components sadly
The technique is so coool. I mean taping the screen output on the way to the display to get around having to hack the secure element. :)
Great example of a digital 'analog hole'; https://en.wikipedia.org/wiki/Analog_hole
A more mundane and common use of this technique is for reading the displays of weighing scales, digital micrometers, and similar instruments which did not originally have the feature to enable computer connectivity.
In my teens, I built a digital serial interface for a scale company my uncle was a salesperson for, think highway and landfill truck scales. This is how I built it, very straightforward to your point, mitm from the scale to the display.
Analogue hole is how I did a more efficient smart garage door hack than what people were talking about here at the time. Soldered zigbee switch into the physical button; worked great :D
I had a similar idea to bypass DRM for a while. Some kind of board that goes between the display panel driver and whatever sends it the signal, and outputs something you can capture, e.g. DVI or unencrypted HDMI. Not sure how practical it is.
In the past (circa a few years ago) the connection between the main board for a display and the glass driver board would be a ribbon cable, LVDS signalling. Very straightforward and typically not soldered. There'd be a ribbon cable connector. So yeah, you could just put a board between easily. And there are LVDS to H264/H265 chips already.
But as the other comment points out, older HDCP is broken wide open so ... easier to just use that. Plenty HDCP strippers on the market.
https://www.amazon.co.uk/hdcp-bypass/s?k=hdcp+bypass
HDMI 1.4 has been leaked and there are devices which will force communication to this protocol level.
Hardware wallets are not a solution to self-custody.
If one would make a list of things that can go wrong, starting from the supply chain that delivers parts to the manufacturer, malicious employees at the manufacturer, mistakes the manufacturer can make, attacks on the delivery chain from the manufacturer to the user, to mistakes the user can make creating, using and storing their keys - the list would contain hundreds of points.
> Hardware wallets are not a solution to self-custody.
Nothing in this world tends to be "the solution", everything has tradeoffs.
Say you want to do self-custody, what is then the best option? "Don't do self-custody" obviously isn't the solution, as the core use case here is self-custody, so what in your opinion is a better way, than hardware wallets?
If there is nothing better today than hardware wallets, then for now, they are "one of the better solutions" for how to do self-custody, even with the current tradeoffs. But again, I'm eager to hear what the alternatives are.
There is no solution yet.
From a bird's-eye perspective, 3 things are needed: Create a key, derive an address from the key, store the key.
Creating a key safely is possible with dice. You would probably create a seed phrase instead of a key directly, but for this discussion it is the same.
Deriving an address from the key is hard and I have not yet seen a good protocol on how to do it. I have read through a bunch of descriptions of how people do it and they are all weak and brittle. The most popular seems to be "I order a hardware wallet and follow the instructions that come with it". But even people who put a lot of thought into it come up with weak and brittle approaches. I would think there is a way to do it safely. But I have never seen a description of one yet. It might involve multiple computers, multiple software implementations and a hell of a lot of work to create a multisig that is not prone to a single attack vector.
Storing the key is probably the hardest. The most popular way seems to be to store it in a drawer or a safe. So now those coins are just as safe as a piece of gold would be. Or they use a multisig and store the keys in multiple locations. Quite painful. As you have the ongoing problem of keeping those locations accessible and safe at the same time.
5 replies →
> Say you want to do self-custody, what is then the best option?
A $5 USB stick with Tails on it. You can make as many clones as you want, so no need for a recovery phrase. It's not specialized hardware, so there's no incentive for anyone to look for money on it (plus it's encrypted). If you want to be extra tinfoil hat, make sure you only plug it into an air-gapped machine and copy any output (address, transaction hex etc.) onto another USB.
1 reply →
> Hardware wallets are not a solution to self-custody.
Look back as recently as last year and hardware wallets were held up as the recommended way to do self-custody all over.
Whenever I brought up the issue of losing coins due to hacks or bugs, I was told that hardware wallets had solved this problem.
There have been more hacks, bugs, and coins lost from software or custodial wallets than ever have and likely ever will be lost from hardware wallets.
People selling hardware wallets might pay good money to convince you of that. People not selling hardware wallets probably won’t pay for the reverse.
Do passkeys next.
Passkeys don’t gate immutable financial transactions. (Pretty much everything you do in a bank’s website is reversible during the day to a few days out.)
1 reply →
Then can you give an example of what you would consider a solution, whether hypothetical or real?
Banks and payment providers (Visa Mastercard AMX) provide services beyond simply a store of wealth and a mechanism to transfer it.
Actually 2FA, hardware biometrics, behaviour based fraud prevention and personal confirmation of suspicious transactions. If you’re using credit they can refund fraudulent transactions, and there is the chargeback mechanism. This is probably banking system dependent, but in AUS there is a refund mechanism for mistaken/fraudulent traditional bank transactions.
BTC has effectively none of the safety net, and humans are fallible. We need the safety net. It’s the hugest barrier to adoption. Exchanges do a far better job of managing the risks than trusting your wealth to a hardware wallet.
23 replies →
Use a device that’s mass produced enough it can’t be targeted e.g a MacBook, then keep it airgapped and don’t do normal computing on it.
10 replies →
There is none yet.
If there was one, someone would write down the steps necessary and put them on the internet. But I have never seen a sound description of how to self-custody Bitcoin in a safe way.
The hardest part seems to not even be the one that currently creates all those problems - the hardware and software used. The hardest part is storing the key (for example a seed phrase). If anyone says they know a way to safely store Bitcoin, my first question is: How do you store the key?
4 replies →
Using the banking system instead of crypto.
get a brand new, cheap laptop or machine (even a raspberry pi works) that you randomly pickup at the store (no delivery order). Install debian 13, install electrum, airgap the device, reboot and generate 1-of-2 your wallet keys.
The wipe the device, use any non-debian other linux (or BSD) to generated the 2-of-2 wallet key.
1 reply →
The existing financial system which provides protection to consumers. Crypto doesn’t solve the problem the general public assumes it does and hype has inflated its value dramatically.
MPC or multi-sig is a pretty good solution, you can require a 2/3 sign off from different custody solutions (ie. a hardware, desktop, and mobile wallet)
Yes, but this threat analysis also holds for laptops and phones.
What do you use to access your bank account online? I use my laptop, or my phone.
If your money is stolen from a bank account via fraud you have recourse to get it back, and it’s pretty straightforward to do in most cases.
12 replies →
But freedom.
Seriously, that's why we have banks, still.
Good luck trying send money abroad or dealing with a sudden unexplained account shutdown.
9 replies →
I never understood why people considered specialized hardware more secure than general purpose hardware.
A hardware wallet is way way way more likely to be backdoored[1] than an off the shelve Intel or AMD CPU.
[1] by people wanting to steal your crypto (unlike the NSA or Intel)
I believe it was Ledger that said if you can hack their wallet you will become their CSO, looks like they owe someone a job!
With how much money they(the hacker) made, the package they have to offer gonna be insane.
Yup, if they are in business long enough to onboard the hire...
may be they already had someone without them knowing.
Well this is a tradeoff. In theory a specialized device is more robust and has a smaller attack surface. Consider something running Linux with some libc and a whole host of other shared libs. Sure they have some robustness because they're so widely used but that's a massive attack surface. There is a solid argument for dedicated hardware.
Also, general purpose hardware doesn't really prevent this as much as you might like. You're still subject to supply chain attacks even if Linux (etc) are quite secure. Look at supply chain attacks we've had in the npm and other ecosystems.
it's about signal to noise ratio. if you spend money for specialized device, it's a good chance you have more money in your wallet.
My current pet-peeve with the top providers is that they all refuse a fully-airgapped solution. You have all these widgets and gadgets like it's a toy when you are planning to hold millions in there. Their apps are also a joke and polymarket-like these days.
At this point, the best is a 2-multi-sig solution where one is some hardware wallet and the second is an iPhone app wallet where the seed is stored digitally only. So even if your offline seed is compromised, you are still covered.
These guys had the audacity to slap a label on their box: "See how there's no security sticker? That's because our hardware is soooo secure"
Everyone at ledger has made absolute fools out of themselves.
Exhibit #9387434 for reasons to stay out of crypto.
Funny enough, EEVBlog posted a teardown video of one of those things today. https://www.youtube.com/watch?v=8JnHdr30v4g
Not your factory, distributor, warehouses, fulfillment centers and entire supply chain, not your coins.
Man, I wish there were some pictures. I didn’t even know that there are LTE modems that small.
There are pictures online. And for an unexplainable reason it is the person behind the biggest Bitcoin exchange SNAFU of all times (where hackers stole something like 800 000 Bitcoins), Mark Karpeles of "Mt. Gox" (who did jail time btw), who was the first to post them:
Apparently the hacker did remove the battery and replace it with a smaller one, leaving enough room for the tiny eSIM/LTE modem / OCR chip that did recognition of the secret on screen.
https://www.tibane.net/research/ledger-nano-x-implant
They're here. It's wild.
What incredible engineering
2 replies →
I want to read that but my slop detector went off. Instant disinterest.
Give me a shitty html4 page with the text ffs.
2 replies →
Look at the size of the board in something like a late-model iPhone. The biggest part of a regular smartphone is the battery. The modem and RFIC along with supporting discretes are absolutely tiny. They've been making wrist-sized watch-phones for many years.
This was already the level of integration 13 years ago: https://www.bunniestudios.com/blog/the-12-gongkai-phone/
Observe how the SIM card socket is the biggest part on the board: http://bunniefoo.com/ntw/dozendp_8.png
https://x.com/MagicalTux/status/2108556423445835827
https://x.com/MagicalTux/status/2108619685751374064
https://x.com/MagicalTux/status/2108574096636416402
This is a cool attack from a technical POV, no doubt.
But what I want to talk about is trust. The big selling point of crypto has always been that fiat currencies, governments and the banking system can't be trusted. Your money can be seized. You may be subject to capital controls. Also, you're subject to chargebacks and so forth.
So crypto hasn't really eliminated the trust issue. It's just moved it. Instead of governments and the financial system having to be trusted, you're trusting far less accountable hardware vendors who might be completely trustworthy as far as you and they know but they can still be subject to supply chain attacks. An extreme (non-crypto) example of this is the Lebanon pager operation.
I've always maintained the crypto is largely solving non-problems and it treats things in the financial system as bugs when they're in fact features, such as reversible transactions.
Crypto transactions has significant limitations, such as everything needs to be on the blockchain (ie the so-called Oracle Problem), which is the whole reason we have stablecoins, etc.
People with this hardware wallet were largely very sophisticated users and even they couldn't successfully and securely manage a wallet. What hopes does the average Joe have?
The more time goes on, the more I'm convinced that crypto is a solution looking for a problem.
Wouldn't using transparent/translucent plastic for the casing make this attack much harder (assuming users verified the insides against official photos)? My bank's hardware tokens used to have that, but new ones are opaque like this wallet. I wonder why.
The other big wallet hardware maker, Trezor, already responded they will majorly cut back their authorized suppliers network.
They want to be certain they have the resources to properly personally verify the operations and trustworthiness of every authorized distributor that they’re vouching for.
https://xxcancel.com/Dantoshi/status/2110000117856248141
My gut reaction is that a hardware implant would be too costly so there's no way they'd actually do that but I guess when you can steal $92M, anything is possible. They could even fab an esoteric chip and still make a profit.
Why do you think it's too costly? It's well known that there are divisions in DPRK that are focused on generating $ through crypto hacks and compromises.
We're dealing with reasonably sophisticated state actors here in this dark forest; not script kiddies.
Cheap $5 PCB + programmable small FPGA is a very viable route too for hardware implants; but even a microcontroller / ESP32/etc will probably do.
DPRK makes about a third to half of their foreign exchange income from crypto hacks. It's significant.
> A technical account published by Tibane Labs described an arrangement involving a microcontroller, cellular communication hardware and connections to the screen’s internal data lines.
Cellular communications hardware seems very sophisticated and expensive compared to a simple microcontroller.
1 reply →
Other commentator covered it a bit but BOM cost is a negligible percentage
If you slide through and ignore the writing, the linked implant teardown is wild - https://www.tibane.net/research/ledger-nano-x-implant
They did, in fact, appear to mass-manufacture a custom-built flat flex implant with cellular (LTE-M!), eSIM, and everything that hid right inside the Ledger, sniffing the SPI reads to the display to read the recovery phrases it pukes out and send 'em over cellular to the ringleader.
It's an EXTREMELY well built implant. I'm impressed. Multiple revisions, even.
The money's too hot to not build shit like this and slip it into the stream. Even a few thousand in R&D netting a six figure ROI is worth it, getting millions is just the icing.
Custom flex PCBs designed to line up precisely on top of an existing PCB seems to be a fairly standard technique for games console mod chips (particularly Nintendo Switch) these days.
But yeah, putting a cellular modem and eSIM on there is certainly taking it to the next level
PCBWay will make anything you send them for reasonable pricing. Custom boards etc are not at all hard to manufacture, and for the amount of money you can get, of course you can team up with someone. I think the most people overestimate the cost of bespoke PCB creation.
Dangerous things sells implantable chips.
Eg. https://dangerousthings.com/products/apex-flex?Antenna=Narro...
It's not that kind of implant.
If it makes no sense economically there's a good chance (in general) that it was an intelligence agency of a superpower
"tiny eSIM implant and a little CPU " .... i can't even get something like this for my raspberry pi ? lol :(
What would be cool is if someone from Ledger like did some reverse engineering, dumped instructions on how to buy these devices like this and made it so we could use them for hobbyist usage with our own esim. I could for sure think of some use cases for like remote wipe etc.
I hope they refer the exploit as "legerdemain"
On a whim I read TFA. What it reported as happening isn't quite what some of the comments here represent. Now, I'm sure there are all kinds of vulnerabilities in Ledger, but this attack seems to be a quite crude supply chain attack mounted on some part of Ledger's retail distribution network. It's actually not even clear that's the case because it talks about these being sold for "half the usual price" so they may have been gray market or second hand. Anyway, this is like buying a Yubikey from Amazon or eBay. You don't do that because Yubico sells direct, which is how you should buy them, to avoid obvious supply chain attacks.
There are other elements of the article that are confused: an "eSIM" is SOFTWARE, not a "tiny chip". Perhaps they mean a "realSIM"?? The SIM is of course only needed to authenticate to a cell network. The article mentions an LTE module. So the e/not-e-SIM aspect seems a little by the by. The main meat of the trojan was a regular ARM SoC.
I already commented the other day on this exploit but really it's fascinating.
I don't care about cryptocurrencies but I've always been fascinated by the cryptography behind it. I've also dabbled with hardware wallets for non-cryptocurrencies stuff: like U2F auth.
The idea of a master secret that is behind a secure element which I control and which I can duplicate is amazing to me (as opposed to, say, "your" passkeys which Google/Microsoft/Apple can basically backup and transfer to other devices for you).
But really to me in the cryptocurrencies world people have been sold the lie that a hardware wallet was secure: it's not. It could be tampered with (as happened in this hack, where an additional rogue chip reading the screen and then sending it using an eSIM steals the secret) but it can also contain a bug (like the recent Coldcard exploit where Coldcard hardware wallets fell back on a RNG with only 32 bits of entropy and some dark-hat hacker cracked those and stole Bitcoins) and, most of all, the vendor of the hardware wallet itself can do nasty attacks (like "kleptography").
From the very start everybody in the ecosystem should have pushed of "n-of-n" schemes (say even just 2-of-2), where one secret goes on a hardware wallet from one vendor and the other secret goes on a hardware wallet from another vendor.
For years and years the tune has been: "PCs cannot be trusted, use a hardware wallet" but it mislead people.
PCs indeed cannot be trusted but unsuspecting users should have learned how to use 2-of-2 or 3-of-3 schemes, to become immune from hacks affecting one hardware wallet vendor.
The typical, non-sensical, response to this is the idiotic: "but if you have two secrets, if you lose one of them you lose everything". It's totally idiotic for people basically save a list of 24 words (the "seed", which is the master secret). Well, guess what: instead of saving a list of 24 words, you save a list of 48 words. Exact same thing, just twice longer.
That's my take: the entire "your coins will be safe if you use a hardware wallet" was misguided.
(The previous comment ended up getting merged into this thread: https://news.ycombinator.com/item?id=50046048)
You might be interested by the Tillltis TKey - it's an open-source open-hardware programmable-by-the-user secure element.
m-of-n provides increased security AND redundancy.
2-of-3 allows loss of one key, 3-of-5 allows loss of two keys, etc
The cost is increased complexity, but the alternative is potentially losing everything due to a single mistake. So far people seem to overweigh the complexity of multisig, and to overestimate their understanding of using a single signing device.
Reminds me of that time when state actors wanted to spread the Stuxnet worm into an air gapped nucleair facility in Iran, and basically hijacked the whole USB supply chain and put the worm in there.
When enough resources / money is involved, these things are to be expected.
That's not what happened. Companies that did maintenance and had physical access to the facility were targeted, which then pushed the worm on to the laptops and flash drives they would take with them into the air gapped facility.
I bought from this very reseller in the last 90 days and I just opened my Stax with a knife to find out it was implanted. It is a very good job too, if I didn't watch the Youtube video, I would think it's part of the original Ledger hardware.
What made you purchase the ledger from a third party and not directly from ledger itself?
It's the official Ledger reseller in that country.
4 replies →
I wonder the lengths smartphone vendors are going to prevent this kind of attack. I cannot imagine it is easy to completely validate hardware in such an elaborate supply chain. I shudder to think about the attack surface in something like a modern car.
The attack is profitable because it's targeted. Every one of those devices contains crypto. Which is not the case for mobile phones.
It seems unlikely that smartphones would be targeted for such an attack because almost nobody stores large amounts of crypto on their smartphone. Those that do will likely get hacked more traditionally.
“Not your wallet, not your coins” is usually taken to imply “Your wallet, your coins”, catchy marketing but a logical fallacy. This incident demonstrates as much.
It's "not your keys, not your coins". And if someone steals your keys they also steal your coins.
I wonder why they only managed to steal 100M so far. Like with the order of effort needed, why haven't they waited for the really big fish to unlock their ledger?
because the longer they wait, the higher the chance of being discovered before they're able to steal anything. I'm sure there's some game theory about this
If they were discovered, ledger would need to announce it, couldn't they just send out all the txns at once to steal whatever they had accumulated?
Pretty sure an older iphone with lockdown mode enabled has better security than any of these ledger wallets. Unfortunately, apple does not allow you to run custom software on their phones and app store apps can be compromised and give false sense of security even if the keys themselves are in hardware as well as the fact that it's untrusted code running on your hardware as well.
Ledger has had three data leak incidents: once in 2020, a software supply chain attack in 2023 and another data leak in 2026. This latest one is the fourth.
Even if one were to ignore the latest incident, which arguably isn't their fault, the first three incidents make up a pretty bad security track record.
How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
> the latest incident, which arguably isn't their fault
I'd not release them soo easily from their share of responsibility. Tamper-proof hardware is a thing, electronic funds transfer terminals for example already implement ways to detect or prevent physical intrusion into safety-relevant parts of the device. Would probably have cost a few cents in manufacturing to add countermeasures to physical modification into the Ledgers. The fact that there is not even the slightest attempt at securing the device against this kind of attacks is entirely on the manufacturer.
> How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
Surely you can name a dozen of US companies that have been driven out of business by enforcement of EU privacy laws. But I'd be glad if you'd at least name a single one!
I'm not into bitcoins nor physical wallets, but I'm guessing those are not supposed to attach any gsm network ever. Isn't that trivial to detect, even without opening a device, that something inside is attaching the gsm network? Those are pretty strong signals in a well defined tiny range of frequency, after all.
(Not so long ago you could hear them talk with the towers through regular home speakers.)
You could only realistically detect this in a lab.
You need to actively listen at multiple frequencies at the same time (gsm/lte/5g have many different bands, + wifi/bt at 2.4/5/6 ghz and their bands). And you need to remove interference from all other devices to conclude that signal is coming from ledger (so any home isn't an option).
On top of that, you need to be listening at the exact time it exfiltrates data (it might intentionally wait for some time after using device), and you need to have the compromised device (which the hardest part here - you could test 100s of devices and not find anything).
So I think this could only be caught with a large scale, recurring lab testing, far from "trivial to detect".
It doesn't need to connect to or even turn on the eSIM until you already entered your key and code, by then it is too late. Unlike voice, it just needs a microsecond pulse to send the data. With all the wireless interference, you'd need a controlled setup too.
I'm guessing the best way to go about self custody these days is to have a multi sig wallet, based on multiple hardware wallets from different vendors.
I wouldn't trust any of the hardware wallet vendors. Pretty much all of them have had customer data leaks, resulting in wrench attacks.
You're better off just having a dedicated laptop for crypto transactions.
Hardware wallets have a huge target on their back. They are great for convenience, but once you are using multiple for muli-sig you can have more security with less hassle with an airgapped old laptop or a hand-stamped piece of metal you keep in a safe
Don't forget to bury it under a cement birdbath in your back yard!
What always surprised me is there aren't many implementations of multisig for EVM based chains.
Actually the only one I know is the Gnosis Safe. Talk about creating a huge risk if it would have a problem.
I wonder if a epoxy/resin potting would solve this sort of attack. Or active tamper response that fries the board if someone tampers with the case.
It would make the tampering more expensive, but not too expensive given the 100 million dollar reward, while also making inspection of the device practically impossible for users.
If you can't get to the insides without breaking it, the only devices verified to likely be safe would be unusable too, so the product would in practice be even more unsafe.
If the user first inspects it and then glue it on their own, that would work, but it wouldn't solve this problem. Evil maid attack is something else and obviously harder at scale.
[dead]
a lot of things can be done. Hardware epoxy, or anti-tamper switch that auto brick Firmware. There is hardware integrity check. Check the impedance of each pin/gpio, if it's fall out of expected value, brick it.
Be careful. Some data from resellers has been hacked or leaked and scammers will contact you saying your device is compromised to run software or other methods to get your keys. This is a known scam from previous ledger software exploits. They will give you cves and won't have any typically scammers accent.
> The crypto wallet maker also noted that it was working with authorities to identify the perpetrator and bring them to justice.
Is it nowadays a workable defense to say that you had a bunch of AI agents in a sandbox doing experiments and they somehow escaped and you will totally make sure this does not happen again?
Makes the claim from BI that Supermicro had malicious hardware implants a little more believable, eh?
Not really. We have physical proof of the compromised Ledger devices; no one has ever presented any specific evidence that Supermicro hardware was similarly compromised.
Very true. I am still somewhat skeptical over the Supermicro implant but seeing these Ledger implants makes it less of an impossibility.
Here’s a new market for $500 Faraday Cages, if any HN readers are interested in selling that
We need independent hardware labs that can audit devices for absence of spy gear.
How did the attackers acquire valid, active Vodafone eSIMs without doxxing themselves?
https://kycnot.me/?categories=esim or simply used a fake identity on some online supplier's website.
UPD: NL, just like some other few countries in EU, doesn't require mandatory identification for SIM card purchases and activation
One would've thought that the display data bus would be encrypted/scrambled in such a device, or at least packaged in a way that makes this kind of attack destructive to the circuit board (chip-on-glass).
Amateur hour all around.
What a f-ing nightmare. It's stuff like this where I start to understand Apple's stance on right to repair. How do you maintain hardware security without strict provenance over every component in your device?
Even if you have perfect provenance over every component you put in, the moment it leaves your factory to be shipped to customers, it can be tampered with.
Even if you would hand it from the factory straight to a customer that comes physically to your factory to pick it up, then you would still require some sort of ID to know that that person is in fact the customer I suppose. Which removes some of the advantages of cryptocurrencies
One of the educational parts of this is that the phrase "supply chain attack" evokes image of Mission Impossible nonsense, whereas this was "just buy the reseller"...
Why are these things not potted in epoxy at the factory? Not that it would entirely prevent this attack but it could make it a lot harder to execute and hide.
Ledger screens die. I had to replace my screen a few months ago. Not use-related either, just time.
getting more into just storing things on paper, and occasionally going digital, recently started working on making an open source secret storage/keeper, to just use by myself to store things when i need to access it on the go, built it with libsodium and argon2id. now i know it doesnt protect me against hardware things, but at least i know where i am storing my things
So HW passkeys in general can also be compromised?
Why would they put all this effort in protecting the key within the chip and then go ahead and leak it via the screen?
Well add "Ledger" to the pile of crypto companies that are finished. Crypto is getting scary these days.
This is why open source wins for security. The more able you are to audit and decentralize the better.
"Because whoever can read the screen wins." This is a bit surprising from Heise.de?
At the bottom:
> This article was originally published in German. It was translated with technical assistance and editorially reviewed before publication.
Presumably "technical assistance" covers just about everything.
Back to paper wallets I guess.
You should have a paper backup of your hardware wallet anyway. The point of the wallet is to perform cryptographic calculations you’ll probably rather not do in your head.
This was stealing the seed phrases as they were being displayed so the user could make the paper backup you suggest and in the process have all their current and future coins stolen.
1 reply →
Couldn't they trace the thief through the eSIM?
Why are theee no legal repurcussions to this?
Possibly, there is a lot of KYC involved in setting up an eSIM virtual provider but the party that ordered the eSIMs may not be in the know, and the attacker may have obfuscated their credentials or used high quality fakes.
Conveniently, there is no KYC in acquiring a data-only eSIM. KYC is only enforced for the number which is not needed here.
Looks like government's work to me. Why would someone risk a prison for this.
The tweet doesn't say that ledger installed the chip.
This is some D grade trash writing.
It's always fascinating to me to poke my head into the crypto ecosystem because so many problems people are encountering in it are just... solved in fiat-currency ecosystems.
Nothing like the monopoly on violence to severely discourage bad actors from executing something like this.
The fact that Ledger uses resellers is crazy.
The fact that some people can put million dollars worth of crypto on a device, but can't buy a plane ticket to someone to get the device straight from the factory is crazy.
The fact that puri.sm has better anti interdiction practices than Ledger is crazy : https://puri.sm/posts/anti-interdiction-update-six-month-ret...
> Before Ledger publicly confirmed the hardware implant, former Mt. Gox CEO Mark Karpelès reported examining a suspicious Ledger Nano X device obtained from Malaysia. On October 9, Karpelès described finding an additional electronic component hidden behind the device’s display, inside material normally used to protect the screen.
> He reported that the wallet had arrived in packaging that appeared intact, raising questions about whether customers could identify a modified device through a routine visual inspection. In photographs shared publicly, the component appeared to contain electronic circuitry separate from the wallet’s original hardware
Come on.
Hardware compromises to steal crypto? Hollywood movie anyone?
So Ledger does not have a tamper proof seal or something?
They should publish the precise weight of these things.
What is amazing to me is that crypto is still around.
Many of us don't want to be subjugated to inflation. Sovereignty isn't for everyone.
if the chip was put in during the supply chain,is buying from the official website really safe? you always need to trust someone in chain
Can see why hardware wallets seemed a good idea at the time but history has shown this is a terrible way to self custody. Compromised devices aside, the KYC data leaks have put people in danger too.
Curious on attribution. DPRK ?
Good thing transactions like this are reversible, so that enterprises like this might be deterred.
As dumb as I think crypto is at least it provides these popcorn worthy moments of fraud.
If you lie down with dogs, you will get up with fleas.
Dogs = cryptocurrencies. Fleas = scammed.
Yep. Crypto is more clever than I am—and there are scammers in the field equally so.
(My hardware wallet is made of pleather and holds paper bills.)
your fiat goes brrrrr
It's been going very well, yes thanks.
Much better than the average crypto gambler.
The cash has been acting as a medium of exchange (something the cryptocurrency industry has given up on, at this point), which is its job, and my wealth is in capital. And capital is what the world runs on. And it's done really well.
It's a skimmer?
yes sorta
Crypto is a gift to scammers: billions stolen, victims left with little recourse, and no effective government oversight.
[dead]
And yet on this exact website people critical of the industry were ridiculed with the exact same rhetoric adopted by the AI industry. It was touted by so many as inevitable, and how we will all be left behind if we don’t join the cult
I think hn was generally more skeptical of crypto then AI
1 reply →
Funny how all the rules of capitalism break down as you approach really big sums of money.
The #1 rule that you keep what you can get away with just seems to apply a lot harder. See also the Abramovich/Deloitte story on HN today.
Just tech bro doing hardware security. Everyone in this field knowing Anti-tamper measurement is one the very basic thing to do.
I fucking knew it and never trusted them.
[flagged]
[dead]
[dead]
[flagged]
[dead]
[dead]
finally, good use for eSIMs /s But damn, it's hard problem to fix. Put it in epoxy and while tampering is harder (not impossible! also can just replace whole module), you can't verify it
[flagged]
TBH, this just sounds to me like the crypto industry is discovering, yet again, why the banking and credit card industry have all this red tape and supply chain security.
Like sure, they're not fully immune... But at least I can call my bank and show them that I didn't suddenly fly from New Mexico to Florida to buy $200 in gift cards from a gas station in the middle of nowhere.
Crypto MUST deal with fraud and hacking if they want to become reliable. At that point, they'll just become another bank with a casino attached.
Most banks in the US still use SMS password reset.
PNC is so bad they even have “secret question” password reset, last time I saw it, e.g. “what’s is the name of your cousin”
Amazing, at least we have hackers stepping up to do the work the government refuses to.
What is the use case of a hardware cryptocurrency wallet besides trapping bitcoins in the Shadow Realm?
Like any HSMs, to put private keys in it and to let things be signed with it.
Making sure malware on your PC can't steal your private keys.
I can guarantee that if this was open-source, someone or some system would’ve picked it up. I’m still amazed that one guy picked up the XZ Utils backdoor because it slowed down after an update.
+15 years later and it still doesn't do anything but provide idiots a way to lose their money. It really is impressive.
Oh-Kay_Labs have said it for years. Not only hackers and thieves go for them, but also kidnappers and robbers. If anyone knows you have one, and things could be much worse. Use paper-wallets, old phones and encrypted USBs instead.
>Use paper-wallets, old phones and encrypted USBs instead.
None of these prevent thieves or anybody from knowing you have one worth stealing. The actual solution is to not use fundamentally broken transparent crypto like BTC that broadcasts to the whole world your exact funds and ties them to your identity on every transaction. With monero your funds could be 0,10 or 10 billion and that is nobody's business.
use leather wallets and paper cash...
Government currencies deflates at 15% a year, Bitcoin doesn't.
4 replies →
Or just open a bank account like a normal person. But I suppose that requires deprogramming yourself out of the crypto cult.
Garbage website that doesn't allow me to reject tracking cookies without paying.
> Data processing by advertising providers including personalised advertising with profiling
> Consent [required for free use]
Just delete the cookies after if you absolutely must go to the site.
Most websites do this, they just don't give you the option.
LOL why would anyone want a hardware wallet when you can just store your Bitcoins on your own encrypted hard disk or USB stick? Bitcoin is merely a file.
These people are being suckered into a false sense of security with hardware cryptowallets. I mean, it would be very tempting to sell a hardware wallet with a backdoor inside of it to steal everyone's cryptocurrency, wouldn't it?
You can use FDE all you want but you're still vulnerable to that file being stolen. Do you install programs from outside your package manager? Do you personally verify and compile everything? Do you pirate stuff? Use npm? Have an AI agent? Do you fully trust the browser sandbox? Click on email attachments? Even if you are Better Than Most, judging by the amount of youtubers that get hacked through stolen cookies, it's clear to me that even above-average people are susceptible to having files stolen.
Keeping your wallet file on a USB stick (or encrypting it) merely reduces the window of time an attacker can get the information. The attacker with local access could simply replace your wallet software. Or make use of a keylogger, screen capture, memory capture, etc.
In that context a dedicated device is the safer approach, and a hardware key is a minimalist device to do that whilst also being less inconvenient than an airgapped dedicated crypto laptop.
You're forgetting that the file needs a password to unlock it.
This whole operation smells Israeli from the beginning to the end. First are these USB ledgers with modified hardware (guess who likes to do that on pagers and similar), then this happens in Germany, the country that never says "no" to the same specific group of people and finally they try exfiltrate the stolen funds with the favorite "private" coin of the same group of people, which in end is (again) proven to NOT be private at all.https://x.com/YFarmX/status/2108918564015006200
HN will never permit to look into the origin of this criminal action and normies will not even put that possibility on the table because they've been programmed against it. Let's play a game, this is a serious criminal act. I bet this will be quickly forgoten in about 3 weeks without anyone in Germany pointing fingers to the guilty party.
The crypto-theft angle seems more typical of China/NK/Russia to me. (China has some history of hardware supply-chain attacks). But without evidence we're simply speculating.