The Crypto devices built to foil hackers came with spies inside

In Malaysia, CryptoBilis faces an investigation after numerous customers experienced thefts from hardware wallets. Reports from Ledger SAS link these crimes to a group of criminals who modified the wallets. Victims' losses total over $90 million, raising red flags among cybersecurity experts who emphasize the vulnerabilities present in cold wallets meant for cryptocurrency storage. These events stress the critical need for improved safety mechanisms in the management of digital assets.

At a small cryptocurrency shop in the heart of Kuala Lumpur, a sheet of paper dated Oct. 10 is taped to shutters over the entrance: "Our physical stores are temporarily closed until further notice."

Malaysian retailer CryptoBilis, a reseller of hardware crypto wallets, has become a focal point of an investigation into thefts from devices meant to secure digital assets offline. Customers began reporting missing funds on Oct. 9, and blockchain researchers have estimated losses of over $90 million.

Paris-based Ledger SAS, manufacturer of the affected wallets, said on Thursday that a "highly organized criminal group" had fitted some of its devices with hidden hardware. Ledger had previously linked the problem to CryptoBilis, but it is also reviewing reports of implants found in wallets purchased elsewhere -- suggesting the problem may extend beyond a single retailer.

It's the latest example of vulnerability in what was once thought to be cryptocurrency's safest tool. Multiple hacks over the past few months have shown that even physical devices designed to keep digital money beyond the reach of online crooks can be compromised, sometimes before their owners even take them out of the box.

"This reveals that crypto storage is an operational risk, not just a cryptographic one," said Esme Pau, head of capital markets and policy at blockchain security firm CertiK. "Real-world security depends on the entire process."

A Ledger spokesperson said the company is conducting an investigation that includes engaging with local law enforcement and would share more information when available. CryptoBilis did not respond to requests for comment.

Social-media sleuths have investigated how the implants work. In their telling, the secret hardware intercepts passcodes sent to Ledger screens, then transmits those keys over cellular connections to hackers, who can then access funds on other devices.

Ledger's hardware features a protection chip, but the attack works around it, according to these experts. As a result, the implants can evade standard security checks until it's too late.

"Protecting against one type of attack doesn't eliminate the others," said Aneirin Flynn, chief executive officer of cybersecurity technology firm FailSafe.

Ledger represents the latest chapter in a months-long crisis over "cold wallets," which store private keys and are not connected to the Internet. They were once thought to be impregnable by criminals, but over the summer a software flaw in similar devices made by Coinkite Inc. exposed serious vulnerabilities.

That hack resulted in the theft of an estimated $130 million worth of Bitcoin and led to ripple effects across the industry. Soon after, another cold-wallet company called Trezor encountered a data breach through one of its shipping providers that exposed personal information of some 67,000 customers.

"People buy hardware wallets to reduce their exposure to online theft, but they're still dependent on the software, services and people involved in managing their assets," Flynn said.

New ThreatLedger's latest breach has rattled nerves in a new way. It's not a software or data-security flaw, but hackers actually cracking open physical devices to steal funds. Even after the company's update on Thursday, the full extent of the problem remains unknown.

Over the years, the company developed a number of devices with different designs, including a new one it's shopping for $899. Old versions, including the Nano X, sometimes end up with third parties like CryptoBilis who refurbish and resell them.

Ben Yorke, who works in the crypto industry from Kuala Lumpur, said he bought a Ledger Flex at a Metapod shop at Singapore's Changi Airport. Before he got around to setting it up, he noticed that the device looked like it had been tampered with.

"I noticed the subtle but suspicious markings on the side, indicating someone may have tried to pry open the back of the device," Yorke said.

He sent it to Mark Karpelès, a crypto founder-turned-researcher, who now runs Tibane Labs. He previously headed Mt. Gox, a digital asset exchange that suffered one of the industry's most devastating hacks. Karpelès works from Japan, where he received a suspended sentence in 2019 for tampering with financial records related to Mt. Gox's collapse, and was acquitted of embezzlement.

Karpelès was one of the first to post on social-media offering to help victims of the Ledger hack. He examined Yorke's device and identified a custom connector tapping into the display, along with a cellular chip and SIM card. In an interview, he said the technology was more sophisticated than one might expect.

"This is not your guy in a garage putting implants on a Ledger," Karpelès told Bloomberg. "This is the kind of scale you see in spy movies."