Ledger confirms unauthorized hardware implants in affected wallets-What should CryptoBilis buyers do

Disclaimer: Content does not constitute investment advice. Trading involves risks—please invest with caution!

硬件植入物导致资产损失：Ledger 确认东南亚钱包被盗事件细节及应对指南

Ledger 已确认，在其调查的东南亚钱包资金被盗事件中，查获的一台设备包含“未经授权的硬件植入物”。这是该硬件钱包制造商首次证实存在物理篡改行为。链上分析师估计，此类事件已导致用户损失超过 8600 万美元。在官方支持账户发布的最新声明中，Ledger 表示正在联系受影响的用户，同时强调其自身的安全基础设施、系统和服务未受到侵害。

事件背景与初步确认

此次发现与通过 CryptoBilis（一家 Ledger 列出的印度尼西亚、马来西亚和菲律宾经销商）销售的设备有关。针对买家，公司给出了明确指导：切勿初始化尚未设置的设备；如果已经设置过，请将资产转移至使用全新助记词生成的新钱包。

以下是已确认的事实、植入物的工作原理推测以及后续应对措施：

Ledger 官方确认内容

In an Oct. 10 statement, Ledger noted: "One of the affected users had an unauthorized hardware implant on their device." This is the first time that the company has confirmed physical tampering since it launched the investigation on October 9. Since then, CryptoBilis has suspended sales of all hardware wallet inventory until the review is completed. The move is broader than Ledger's original request, which only requested a suspension of sales of Ledger branded equipment.

Ledger reiterated that there is currently "no indication that Ledger's security infrastructure, systems or services have been compromised." The company also thanked security agency SEAL 911 for its support and said it was working with authorities. It also warned that Ledger would never ask for a user's 24-word recovery phrase.

The current loss amount is still an estimate. On-line investigator Specter estimates that the total loss involving Bitcoin, Ethereum and TRON exceeds $86 million;Bitquery estimates the loss involving 311 wallets at approximately $92.9 million; and researcher Yfarmx estimates the suspected loss involving 471 addresses at $93.4 million. Ledger has not confirmed any of the specific figures above.

Speculation on how the implant works

The most detailed public description of this event comes from previous Mt. Gox CEO Mark Karpelès. He showed off a modified Ledger Nano X device. The device is said to contain a circuit board with an LTE module, eSIM card and a microcontroller connected to the SPI bus of the display.

由于植入物仅在设置过程中监控屏幕显示 24 字恢复短语时的工作状态，它可以记录这些单词并通过蜂窝网络传输，而无需触碰保护私钥的安全元件。这种设计解释了为何被篡改的设备仍能通过 Ledger 的真伪验证：因为安全芯片和固件未被触动，植入物仅读取屏幕显示的内容。截至目前，Ledger 尚未发布其技术调查结果，也未证实资金正是以此方式被盗取的。

CryptoBilis 买家的应对措施

Ledger 的指导方针根据设备是否已初始化分为两种情况：

未初始化的设备：过去 90 天内从 CryptoBilis 购买且尚未初始化的用户，不应开始设置过程。
已初始化的设备：已经设置设备的用户应考虑将资产转移至使用新种子短语生成的新 Ledger 签名器。重用旧的助记词仍会导致相同的密钥暴露。

无论资金是否已被转移，买家都应将设备视为不可信，并通过 support.ledger.com 联系 Ledger 客服。此外，请忽略任何索要恢复短语的信息。

您的 Ledger 安全吗？

The confirmation points to supply chain issues with a single dealer, not vulnerabilities in Ledger's own systems. Current evidence is limited to devices sold through CryptoBilis, and Ledger said it is developing enhanced tamper-resistant solutions. Buyers who buy directly are not listed as affected.

This case reminds us once again that the security of self-hosting is not limited to the software level: even with a solid foundation in cryptography, wallets purchased through contaminated channels can fail.

Frequently Asked Questions (FAQ)

Is my Ledger safe?

If you purchased it directly from Ledger, there is no indication that your equipment has been affected. The confirmed implants are related to equipment sold through the distributor CryptoBilis.

Which devices are affected?

Ledger has identified one device affected, but did not disclose the specific model number or the number of devices that may be affected. The investigation is still ongoing.

What should I do if I purchase a device from CryptoBilis?

Do not initialize unused equipment. If you have already set up your equipment, transfer assets to new equipment that uses the new recovery phrase and contact Ledger at support.ledger.com

Can the firmware detect the implant?

Cannot be reliably detected. According to reports, the implant only monitors the display and leaves the security element untouched, which is why the tampered device can still pass the authenticity verification.