本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Ledger confirms spy chip implant behind wallet crypto thefts

Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users’ cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia.

Ledger 证实，其通过东南亚经销商 CryptoBilis 分销的部分设备被植入了硬件芯片，导致用户的加密货币钱包被盗。该公司一直在调查用户通过 CryptoBilis（一家在东南亚运营的大型马来西亚硬件钱包零售商）购买钱包后资金丢失的报告。

Some researchers have shown the implant in Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware. Ledger wallets are physical devices designed to securely store the private keys that control cryptocurrency assets and authorize transactions.

自 9 月 16 日以来，一些研究人员展示了 Ledger X 中的植入物，并称这些被篡改的设备售价仅为原装硬件价格的一半左右。Ledger 钱包是旨在安全存储控制加密货币资产和授权交易的私钥的物理设备。

On October 9, Ledger said it had launched an investigation into user reports of cryptocurrency losses and asked CryptoBilis to stop selling and shipping Ledger devices. The next day, the company confirmed hardware tampering on at least one device, though it’s still unclear exactly how or when the devices were tampered with.

10 月 9 日，Ledger 表示已针对用户加密货币损失的报告展开调查，并要求 CryptoBilis 停止销售和发货 Ledger 设备。次日，该公司确认至少有一台设备遭到硬件篡改，但目前尚不清楚设备具体是如何或何时被篡改的。

“Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation,” Ledger said. The crypto wallet maker also noted that it was working with authorities to identify the perpetrator and bring them to justice.

Ledger 表示：“Ledger 可以确认，其中一名受影响用户的设备包含未经授权的硬件植入物。作为正在进行的调查的一部分，Ledger 正在联系受影响的用户。”这家加密钱包制造商还指出，它正在与当局合作，以查明肇事者并将其绳之以法。

“[…]Ledger recommends users who purchased a Ledger device from this reseller to not initiate set up if they have not yet done so. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with a new seed),” warned Ledger.

Ledger 警告称：“……Ledger 建议从该经销商处购买 Ledger 设备的用户，如果尚未进行设置，请不要开始设置。如果您已经设置了 Ledger 设备，请考虑将资产转移到新的 Ledger 签名器（使用新的助记词）。”

Yesterday, Ledger provided another update, confirming that all user reports of unexpected fund drains were linked to devices sold through CryptoBilis and describing the affected volume as “limited.” While the company did not disclose the type of devices compromised in this supply-chain attack, reports online talk about a spy implant in Ledger X devices that blends with the legitimate hardware.

昨天，Ledger 提供了最新消息，确认所有关于资金意外流失的用户报告均与通过 CryptoBilis 销售的设备有关，并将受影响的规模描述为“有限”。虽然该公司没有披露在此次供应链攻击中受损的设备类型，但在线报告称 Ledger X 设备中存在一种与合法硬件融为一体的间谍植入物。

Mark Karpelès, currently leading Karpeles Lab Inc. and CTO at Shells.com, showed a picture of the new implant in Ledger X, saying that it was “quite an evolution” from previous versions featuring manually soldered wires.

目前领导 Karpeles Lab Inc. 并担任 Shells.com 首席技术官的 Mark Karpelès 展示了 Ledger X 中新植入物的图片，称其与之前采用手动焊接导线的版本相比是“相当大的进化”。

The former CEO of Mt. Gox said the implant was concealed behind the screen, but its antenna cable would have indicated that something was wrong. According to Karpelès, the malicious hardware captured the device’s display output and button presses to identify the seed phrase, then transmitted it to the attacker over an LTE connection using an eSIM.

这位 Mt. Gox 的前首席执行官表示，植入物隐藏在屏幕后面，但其天线电缆本应显示出异常。据 Karpelès 称，恶意硬件会捕获设备的显示输出和按键操作以识别助记词，然后通过使用 eSIM 的 LTE 连接将其传输给攻击者。

“Ledger Nano X are used to store crypto. The spy implants are used to steal whatever crypto you store in those Ledger Nano X,” Karpelès explained. Although the CEO did not name CryptoBilis as the vendor of the compromised LedgerX, he said the device was not purchased via Ledger’s recommended channels but from “a well known platform via a Chinese seller (product shipped from Malaysia).”

Karpelès 解释说：“Ledger Nano X 用于存储加密货币。间谍植入物则用于窃取你存储在这些 Ledger Nano X 中的任何加密货币。”尽管这位首席执行官没有点名 CryptoBilis 是受损 Ledger X 的供应商，但他表示该设备并非通过 Ledger 推荐的渠道购买，而是“通过中国卖家在知名平台上购买（产品从马来西亚发货）”。

Tibane Labs, a cryptocurrency research and development studio, confirmed Karpelès’ finding, adding that there were two implant versions for Ledger X. The researchers obtained two variants, one in a Ledger device bought on Amazon Japan from ” China-based seller · shipped from Malaysia,” the other purchased on Yahoo! Auctions, Japan.

加密货币研发工作室 Tibane Labs 证实了 Karpelès 的发现，并补充说 Ledger X 有两个植入版本。研究人员获得了两个变体，一个是在日本亚马逊上从“中国卖家·马来西亚发货”处购买的 Ledger 设备，另一个是在日本雅虎拍卖上购买的。

In a report over the weekend, Tibane Labs notes that the threat actor made room for the malicious circuitry by replacing the original battery with a smaller one, which powers both the implant and the Ledger X. “Under the battery and antenna sits an ST STM32G431KBU6 (Arm Cortex‑M4, 128 KB flash, UFQFPN‑32),” the researchers found inside one of the devices.

在周末的一份报告中，Tibane Labs 指出，威胁行为者通过用较小的电池替换原装电池，为恶意电路腾出了空间，该电池同时为植入物和 Ledger X 供电。研究人员在其中一台设备内发现：“在电池和天线下方是一个 ST STM32G431KBU6（Arm Cortex-M4，128 KB 闪存，UFQFPN-32）。”

For connectivity, the actor used “a tiny eSIM, an 8‑pad package just 2×2 mm, next to the MCU, and a shielded LTE module that sends the words out.” In the second hardware wallet analyzed, Tibane researchers found that markings on both the MCU (Microcontroller Unit) and the eSIM had been scraped off to hide the part numbers.

为了实现连接，攻击者使用了“一个微小的 eSIM，一个仅 2×2 毫米的 8 焊盘封装，位于 MCU 旁边，以及一个发送数据的屏蔽 LTE 模块。”在分析的第二个硬件钱包中，Tibane 研究人员发现 MCU（微控制器单元）和 eSIM 上的标记已被刮掉，以隐藏零件编号。

The second variant, which appears to be the same one that Karpelès described, is more advanced. It ran on the original battery and fit into the space normally occupied by the foam padding under the OLED display. In both cases, the tell tale was the antenna wire, which ran along the top edge in the case of the second implant. In the first implant, the antenna is taped across the top of the battery and the shielded LTE module.

第二个变体似乎与 Karpelès 描述的相同，更为先进。它使用原装电池运行，并安装在通常由 OLED 显示屏下方的泡沫衬垫占据的空间内。在这两种情况下，天线导线都是破绽，在第二个植入物中，它沿着顶部边缘延伸。在第一个植入物中，天线被胶带固定在电池和屏蔽 LTE 模块的顶部。

The researchers warned that the specimen above used “a designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off.” Ledger is advising users to avoid purchasing from unauthorized resellers as they run an increased risk of getting counterfeit or modified devices.

研究人员警告说，上述样本使用了“一种经过设计的、拼板式的柔性 PCB，这是从电路板工厂订购的那种，而不是手工制作的单件产品。”Ledger 建议用户避免从未经授权的经销商处购买，因为他们面临获得假冒或改装设备的风险增加。

The company is also reminding its authorized resellers and distributors to get the products only through authorized channels and to avoid restocking returned products. Ledger provides a ‘Genuine Check’ mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device’s original Secure Element remains intact.

该公司还提醒其授权经销商和分销商仅通过授权渠道获取产品，并避免重新进货退回的产品。Ledger 提供了“正品检查”机制来确定设备的真实性；然而，它明确警告说，当设备原有的安全元件保持完整时，该机制无法检测到添加的植入物。

At this time, there’s no indication that any other Ledger resellers are shipping compromised wallets; however, the community’s trust in the resellers’ network has been compromised, with many now calling for its dismantling.

目前，没有迹象表明其他 Ledger 经销商正在发售受损的钱包；然而，社区对经销商网络的信任已经受损，许多人现在呼吁将其拆除。