Ledger wallet tampering suspected after reports of crypto thefts

据报道，部分 Ledger 加密货币钱包中可能存在间谍植入程序，这或许是一起价值 8600 万美元供应链攻击的根源。

A spy implant in some Ledger crypto wallets may be the root of an $86 million supply chain attack.

有越来越多的报告称，Ledger 加密货币钱包的用户发现其账户资金被清空，这似乎与 CryptoBillis 销售的被篡改硬件有关。Ledger 已要求 CryptoBillis 在其进行调查期间暂停所有钱包的销售。Ledger 已证实，“其中一名受影响用户的设备包含未经授权的硬件植入程序。”

Reports have been mounting that users of the Ledger crypto wallet have seen their accounts drained, and it appears to be related to tampered hardware sold by CryptoBillis. Ledger has asked CryptoBillis to pause all sales of its wallets while it conducts an investigation. Ledger has confirmed that “one of the impacted users’ devices contained an unauthorized hardware implant.”

发布在 X 和 Threads 上的照片和视频显示，屏幕下方夹着一块小型电路板。据称，该植入程序会拦截屏幕上显示的任何内容，包括初始设置过程中显示的助记词。该植入程序利用内置的 SIM 卡将这些信息发送回攻击者，攻击者随后便可从用户账户中窃取资金。

Photos and videos posted on X and Threads appear to show a small circuit board sandwiched under the screen. The implant allegedly intercepts anything displayed on the screen, including the seed passphrase shown during the initial setup. Using an embedded SIM card, the implant then sends that information back to the attacker, who can then siphon funds from user accounts.

报告显示，此次黑客攻击的幕后黑手已从数百个钱包中窃取了价值超过 8600 万美元的加密货币。目前没有迹象表明 Ledger 的系统遭到破坏，也没有迹象表明直接从该公司购买的钱包受到影响。相反，该问题似乎是一起主要涉及东南亚用户和经销商 CryptoBillis 的供应链攻击。Ledger 已就如何检查钱包是否被篡改提供了指导。

Reports indicate that whoever is behind the hack has stolen over $86 million worth of crypto from hundreds of wallets. There’s no indication that Ledger’s systems have been compromised or that wallets purchased directly from the company have been affected. Instead, the issue appears to be a supply chain attack primarily involving users in Southeast Asia and the CryptoBillis reseller. Ledger has provided guidance on how to check if your wallet has been tampered with.