Rendered at 08:50:29 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
acstapleton 19 hours ago [-]
Looking at the images here, there is zero attempt at security here from the ledger team. They’re using an MCU (ST MCU with Cortex M4 core) that doesn’t have any meaningful security features (ie, no secure boot, no differentiation between trusted and user mode operation - features the newer Cortex M33 core supports and newer ST parts implement). So there’s no way to guarantee that the software running on this has not been tampered with.
There is no physical tamper detection either. No tamper pads to detect case openings, no seal that gets broken when it’s opened that prevents operation. As others have mentioned, the most basic precaution would be to glue the whole thing together, which they didn’t do either.
Trusting Ledger with securing anything secret would be a very bad idea.
lxgr 17 hours ago [-]
> Looking at the images here, there is zero attempt at security here from the ledger team. They’re using an MCU (ST MCU with Cortex M4 core) that doesn’t have any meaningful security features (ie, no secure boot, no differentiation between trusted and user mode operation - features the newer Cortex M33 core supports and newer ST parts implement).
That MCU is explicitly not assumed to be critical in their security model [1]. It handles Bluetooth and USB communication, both of which are assumed to be insecure transport layers. Securing the MCU would not have helped in this particular incident, and I can't think of a scenario in which it would be critical.
Button input and screen output, which are critical, are handled by a secure element. Unfortunately, at some point even the most hardened secure element will have to output data to be displayed on a screen; that's what was attacked here. Electronic shoulder surfing, basically.
This is a great observation! I regularly end up with M33 devices I program as they make sense for reasons other than security. (E.g. an Atmosic one, and St ones like L5/U5/H5). I look at the secure flash functionality and think "This is annoying and I have no current or projected use for this."
I ponder "What applications would I want this security stuff for?" Crypto wallets are a great example... and the crypto wallets in the wild aren't using them, as you point out!
expedition32 16 hours ago [-]
Why would a crypto wallet company give a shit? They already have your money.
lxgr 16 hours ago [-]
Reputation is somewhat relevant in that line of business.
bjt 18 hours ago [-]
Yes to all that, and, why not use a clear plastic housing? Make it way harder to hide the tampering.
lxgr 16 hours ago [-]
They do seem to have a clear version of this device. Unfortunately it's just an option; would be nice to have that be the default.
pclmulqdq 18 hours ago [-]
Ironically, there have been several crypto wallets that use much better hardware security, but they can't beat Ledger on marketing.
lxgr 16 hours ago [-]
Which ones would you suggest? I actually consider Ledger one of the more competent vendors in this space. A lot of alternatives don't even perform all key operations in secure hardware, yet loudly proclaim themselves as superior.
alfiedotwtf 17 hours ago [-]
Dice, a sheet of metal, letter stamps, a hammer, and a piece of stainless steel.
trombuance 16 hours ago [-]
Not practical when one makes any type of transaction regularly. For those who don't want to research or generally trust HW wallet manufacturers, they can easily make their own though by using an old offline device and sign the transactions there.
People should do better research before buying things, and - it should go without saying - especially when it's about security. Ledger has a whole list of issues, they became the most popular brand not because they're the most trustworthy but because of their marketing and focus on supporting a massive number of coins. You'd think though that security should be the number one priority for a hardware wallet brand, not convenience.
lxgr 16 hours ago [-]
A great option if you can do ECDSA operations in your mind :)
tdeck 16 hours ago [-]
If you ever go through TSA with this type of wallet they can read your key off the scanner.
mschuster91 18 hours ago [-]
> They’re using an MCU (ST MCU with Cortex M4 core) that doesn’t have any meaningful security features (ie, no secure boot, no differentiation between trusted and user mode operation - features the newer Cortex M33 core supports and newer ST parts implement).
This doesn't help any bit against the hardware implant we're discussing here.
> So there’s no way to guarantee that the software running on this has not been tampered with.
While true, I don't think it matters too much, other than the possibility of turning the device into something like a rubberducky.
> There is no physical tamper detection either. No tamper pads to detect case openings, no seal that gets broken when it’s opened that prevents operation. As others have mentioned, the most basic precaution would be to glue the whole thing together, which they didn’t do either.
Now that is the real meat. Unfortunately, for any given attack it's possible to bypass it. Tamper pads, if you know where they are, you can drill through the housing and, depending what it is, keep the button pressed by a jig, or solder wires if it's a sense trace to bridge it. The housing itself can easily be fully replicated, it's just a matter of coughing up some money for custom molds.
The only way to make something relatively tamper proof is to use injection molding over the full housing with something like glitter as part of the plastic, that will distribute randomly - and most importantly: not replicable! - across the housing, and then take high quality photographs and store them on your website together with the serial number.
That way the customer can photograph the device they have, and compare the random glitter specks with those on the website.
Tamper proofing hardware is among the hardest things there are, especially if you are up against nation-state actors like North Korea (that has been known to engage in cryptocurrency theft in the past).
acstapleton 18 hours ago [-]
While secure boot and the other software features might not have defended against this attempt, it highlights the abject failure of the company to even make an attempt at security.
You bring up a good point about bypassing physical tamper detection, but those defenses increase the cost and complexity of the attack, making them harder to succeed undetected. As it is, this attack seemed quite trivial to implement.
lxgr 16 hours ago [-]
> it highlights the abject failure of the company to even make an attempt at security.
Do you know anything about their security model to pass judgement like that? They actually have a quite thorough hardware security model, outlining which components are and aren't considered critical: https://www.ledger.com/ledger-nano-x-bluetooth-security-mode...
> As it is, this attack seemed quite trivial to implement.
Have you looked at the miniature LTE board implant? It's an extremely sophisticated attack against a very sophisticated target, in my view.
alfiedotwtf 17 hours ago [-]
Isn’t it all moot if you’re buying from a reseller rather than the manufacturer? Because I’m thinking your photos to compare the glitter with will be provided by the middle man anyway
saidnooneever 17 hours ago [-]
not really. nor does the glitter and the photo really help. problem is they will infiltrate vendor ,or maybe your ISP or he device u take picture with, replace photo.
u would need something that you do not have to check online which is physically given to you by a known person. who do you really know at the vendor? no one. there isnt this person.
that being said,.so it comes back to trusting someone if you are dealing with digital things, somewhere down the line. That trust can be attacked, so u need to ne aware of it and if anything dont put all your eggs in the same basket.
Say you have 10 million$. you would want to split it up in chunks the size of your acceptable loss * the chances of such loss occurring, so that whenever you lose something, its within accepted risk parameters :')
api 18 hours ago [-]
That's bad. The HSM in a typical laptop has some of these features.
lxgr 17 hours ago [-]
So does the secure element in Ledger wallets.
The issue is that the HSM itself has no input or output. Securely interfacing with those is not trivial.
tdeck 17 hours ago [-]
It's just amazing to me sometimes that people get so far with so little sense of professional responsibility. I have no particular expertise in hardware security and even I would have made put more effort in. And this company has been around since 2014! What excuse can there be?
Edit: For folks down voting me, please explain. I'm genuinely curious about your perspective.
lxgr 16 hours ago [-]
Well, you asserted that you'd be doing a better job than Ledger, so arguably it's on you to outline how that would look like.
tdeck 16 hours ago [-]
I would start with filling the product with potting compound, which has been a standard process in tamper-proofing hardware for a long time. Keep in mind the whole value proposition of a hardware wallet is security.
lxgr 16 hours ago [-]
Are you sure that that's safe to do with a device containing a lithium ion battery? These usually have emergency gas valves to prevent explosion.
tristor 16 hours ago [-]
Yes, it's safe to do with lithium ion batteries as long as you use the right potting compound (potting compound isn't just one thing). There are compound specifically designed for battery encapsulation that assist with thermal management and preventing ruptures. As the person you're replying to has already stated, using potting compound to fill in cavities and discourage tampering on electronics is a standard practice.
Depending on your design requirements you can also use different battery chemistries or cell constructions to minimize the need for mechanical venting.
lxgr 16 hours ago [-]
Sad to see so many people with seemingly zero background in hardware security comfortably passing expert judgement about this attack, apparently without either looking into the security model of the attacked platform (it's public and worth a read, in my view [1]) or into the sophistication of the attack itself.
Ledger's mistake here was solely assuming that fitting hardware capable of long-range (or even global, in this case) communication into the tiny footprint of their device's case was impossible. I'm not in their industry, but I'd honestly have guessed the same until this week.
I just opened a ledger up, its stupid easy to do. Why wouldn't they make this a sealed unit with and glue it to make it impossible to open without damaging? Also why would you not glue the entire circuit board? The entire board is covered in test pads which make it super easy to solder dodgy stuff onto.
phh 20 hours ago [-]
At the price of an eSIM and a LTE modem (and of the stolen 100$M), destroying a glued casing and making your own costs next to nothing. Looking at the photos, even without the test pads soldering directly on the components seem pretty easy.
tdeck 17 hours ago [-]
They could have just potted it. This is a standard manufacturing process that's been around since at least the early 20th century.
Last year there were ones going around with these eSIM modules in them and they appeared to have printed new 3D cases for them, so it's definitely something they have experimented with.
polonbike 19 hours ago [-]
Even if it is still possible to do, doing it at scale becomes a lot more complex
bayindirh 20 hours ago [-]
I believe epoxy-filling them a-la IronKey is a good idea, but for longevity reasons, I'd prefer the rechargeable battery to be replaceable.
Maybe it increases the price quite a lot, IDK.
moduspol 19 hours ago [-]
I had an old Ledger die recently and replaced it with a new one. Didn't even consider being potentially able to replace the battery, but it would have been nice.
On the plus side, I did get to do a "fire drill" of my recovery process, which did work, so that was nice.
bayindirh 19 hours ago [-]
I'm a large believer of long-living tools and things in general, so I prefer my tools to be repairable and maintainable.
Of course I can't achieve what I want all the time, but being able to use a fixed-function tool till some electronic component dies inside is way more attractive for me to send the same device to recycling or trash just because a part with limited life (and shorter time w.r.t. rest of the device in general) reaches ends of its life.
enopod_ 13 hours ago [-]
Out of curiosity, I‘n not familiar with the topic, how do you recover a seed phrase from a dead hardware wallet?
glitchc 19 hours ago [-]
Access to battery terminals enables power side-channel attacks such as DPA and CPA.
bayindirh 18 hours ago [-]
Probably, but you can defend for them as well. We fixed those more than a decade ago, I believe.
bstsb 17 hours ago [-]
different models are subject to different levels of physical security. for example, the Nano Gen5 is extremely hard to open without some form of physical damage
Depending on who is responsible for this, do you not think these people would have the ability to circumvent physical anti-tampering measures?
dansquizsoft 20 hours ago [-]
Not an excuse for ledger making a sub-par product to begin with...
vincnetas 20 hours ago [-]
why not make it transparent?
Create 20 hours ago [-]
Sony SRF-39FP has a transparent case, designed to thwart contraband concealment. The radio often appears on the commissary lists of U.S. federal prisons, hence the "FP" suffix
https://en.wikipedia.org/wiki/SRF-39
Sony D-FJ003FP, Sony WM-FX193FP, SONY SRF-M35FP
It's almost as if the cryptocurrency industry is just amateur LARP…
sorenjan 21 hours ago [-]
Shouldn't it be possible to track who bought the esim, where the data is sent, and who owns the wallets where the stolen crypto is transferred?
flotzam 20 hours ago [-]
It's easy to buy eSIMs anonymously. Either directly with cryptocurrency, or with a prepaid virtual credit card bought with cryptocurrency.
karel-3d 21 hours ago [-]
They tracked the traffic (not the eSIMs) to some servers in Hong Kong, managed by Alibaba.
dwh452 21 hours ago [-]
how can the implant send the seed words to an attacker? doesn't a crypto wallet have to talk an application on the host computer? wouldn't the communication between the wallet and the host computer never allow for the seed words to be sent from the wallet to the outside world? in other words how could an "implant" tampering of the wallet make the host computer suddenly start sending seed phrases to third parties?
littlecranky67 20 hours ago [-]
They sniffed the LCD interface and OCR'ed the seed words when they were displayed using an implanted tiny CPU. This is a very sophisticated attack.
donkey_brains 20 hours ago [-]
They were almost certainly not doing the OCR on the device. Such a CPU would be too power-hungry and the process would still be too error-prone given the limited compute. They would just send the raw data to the C2, which could send it to an emulator, snapshot the output and send it to an LLM.
dezgeg 20 hours ago [-]
Well it doesn't need to be a generic purpose OCR, just one that works for this single UI layout and font.
littlecranky67 12 hours ago [-]
and only needs to distinguish around the 1000 different words that are used in the seedphrase. So it is more word-recognition than character recognition.
thousand_nights 20 hours ago [-]
i don't think OCRing a bitmap font is very expensive or power hungry, if you know the exact pixel configurations of the glyphs ahead of time
foobarbecue 20 hours ago [-]
Exactly. No O, just CR.
usrusr 20 hours ago [-]
Wire character recognition
moduspol 19 hours ago [-]
Streaming the raw data would also be more flexible for other use cases. From what I've read, it was streaming off the generated recovery passphrase, but users aren't required to generate one--they can input one. That'd require a much more sophisticated algorithm than simply reading from the screen, since users are using two buttons to pick from hundreds of words in a randomized menu.
And besides, Ledger firmware can be updated to change fonts and such so it'd be long-term safer to just stream the raw data.
lxgr 21 hours ago [-]
The attackers added their own tiny 4G or 5G board.
trillic 21 hours ago [-]
They put an eSIM in the device…
karel-3d 21 hours ago [-]
There is an eSIM with worldwide data in the device.
kg 21 hours ago [-]
Though it's not what happened in this case, you could tamper with a crypto wallet to make it emulate a USB keyboard and once connected, send a series of keystrokes to download and run an exploit.
lxgr 16 hours ago [-]
That's fairly risky, though, as it's very visible to users if it goes wrong, who could then alert the manufacturer, who could in turn warn other users.
I suspect that the attackers here have been waiting for enough funds to land on compromised wallets to be worth their efforts and then withdrew everything at once, with comparably little chance to get caught.
ovi256 21 hours ago [-]
The implant could fabricate a reason to connect to a host computer. Like "Cannot display seed words, connect to a computer to debug"
tamimio 18 hours ago [-]
These attacks are easily done because a lot of people assume new hardware in bubble wrap is secure and wasn’t altered. There are many stories of intelligence agencies bugging the hardware after you order it, specifically online, and no, those aren’t some tinfoil hat thinking, they are actively doing it incl Europe, so always buy your device randomly from some local store and pick it up immediately, or buy it used, better yet, if you have some electronics knowledge is checking it yourself.
thecybertracker 16 hours ago [-]
Lets start with a very basic hash. Weight of the device down to milligram. and assume if the weight does not match, its tampered with.
harrouet 18 hours ago [-]
The thing with eSIMs is that they are bound to an operator, which is supposed to keep record of who is using them. Law enforcement authorities should be able to get to the guys doing this...
... unless they are tied to a government.
lxgr 16 hours ago [-]
> which is supposed to keep record of who is using them
Says who? I've bought single-use eSIM profiles for data while traveling without any KYC in the past; it's actually the norm, not the exception.
Some suppliers specifically advertise that, as well as accepting cryptocurrency.
harrouet 3 hours ago [-]
But you at least had to provide an email and a means of payment.
lxgr 1 hours ago [-]
An anonymous throwaway email address is not exactly hard to find, and payments can be anonymous too. There are resellers of prepaid cards that accept crypto payments, if the eSIM supplier doesn’t accept it already.
tristor 17 hours ago [-]
The lack of security on these devices is shocking as someone who has worked in the hardware security space, but I guess it shouldn't be surprising that this like everything else involving crypto is some sort of elaborate scam done by non-experts and bad actors.
lxgr 16 hours ago [-]
What would you be doing differently? There are many hardware wallet vendors out there, and I consider Ledger to be relatively sophisticated. This attack was extremely sophisticated as well.
tristor 16 hours ago [-]
The attack was sophisticated, but Ledger appears to have taken almost zero precautions against hardware attacks, which made this attack simpler and cheaper to pull off. There are very few precautions that would have completely eliminated the possibility of this attack, but it would have been straightforward to make it more expensive, primarily by investing in tamper proofing and tamper evident design. There are several other comments in this thread that go into fair detail about some examples of these techniques.
hackermailman 16 hours ago [-]
I like the fancy security theatre display that the Trezor device has but turns out it initializes with a copy of the legitimate firmware then saboteurs simply overwrite the random seed generator with a predetermined seed after all the startup security checks. https://www.zetter-zeroday.com/trezor-wallets-also-compromis...
So where does the implanted chip upload the seed phrase to? Who owns that website? This seems like it should have been caught with wireshark or network sniffing of the Ledger app?
mhluongo 17 hours ago [-]
The tampered devices have their own eSIMs - it's not running data through the Ledger app on your computer.
The impacted resellers would have to test the devices powered on to see if they were using cellular data.
luxuryballs 19 hours ago [-]
I believe an untampered Ledger is still OK as long as you don't pair it with a compromised machine, which perhaps is not saying much at the present moment...
lxgr 19 hours ago [-]
The security model of Ledger wallets should survive even a compromised computer/phone, assuming you have an out-of-band way to compare address destinations and hashes.
artisinal 21 hours ago [-]
-Post removed as this account is rate limited and I can't reply to comments-
thenthenthen 21 hours ago [-]
All hw wallets are being breached. Big, easy target. I think a lot of people are interested in this breach and the people behind it. 100 million worth? This might works both ways.. curious about the further investigations. My hunch… after major crackdowns on scam centers in the golden triangle, this is their latest dab to wealth?
theturtletalks 20 hours ago [-]
Stable coins are spreading like wildfire in Asia. It’s poised to overtake even the US is terms of spending. People use it to send money back home and ledgers MITM attack happened in Asia.
motionlessveloc 21 hours ago [-]
Ledger the company was not breached (this time around). The devices here were modified by a middleman in the distribution chain and sold to unsuspecting buyers.
artisinal 21 hours ago [-]
-Post removed as this account is rate limited and I can't reply to comments-
dfadsadsf 21 hours ago [-]
You need to have reseller in most countries otherwise your customers will have to deal with long shipping time, customs, etc. The same for selling in physical stores.
21 hours ago [-]
nilamo 18 hours ago [-]
Accounts can be rate limited? Woah
artisinal 14 hours ago [-]
Typically happens when my account is a few months old. It is annoying that you have to wait a few hours to reply on someone. On to the next account.
aa-jv 21 hours ago [-]
The crypto lunatic fringe have long frustrated me with their assertions of sovereign this and that.
There is no sovereignty in crypto if YOU ARE NOT BUILDING YOUR OWN HARDWARE.
Any claims of sanctity or reliability in the software stack are rendered null and void until someone with a tunneling electron microscope has completed an audit of your chips.
THIS is why Taiwan matters so much, people: there is NO sovereignty for as long as your chips are being imported. You can trust all you want - but trust is nothing without verification. We are all serf-subjects of the wafer-producing overlords.
Ledger clearly drank the koolaid. Crypto people: invest in hardware. NOT software. Anything less is utter futility.
RugnirViking 21 hours ago [-]
not your keys, not your crypto
not your hardware, not your keys
not your chips, not your hardware
not manufactured in house, not your chips
not your designs, not manufactured by you
not designed by you personally, not your designs
ad infinitum. To be truly secure, you must first learn to survive alone in the wilderness and smelt tin
ourmandave 20 hours ago [-]
... and smelt tin
I'll just order my crucible and tongs off Alibaba.
Wait a second...
vitorfblima 20 hours ago [-]
Our grandparents stored their crypto under their matresses.
lxgr 16 hours ago [-]
And at that point, why do you still need to transact with other humans, securely or otherwise?
trollbridge 17 hours ago [-]
Hence why governments have generally ended up issuing and securing currency.
orsorna 21 hours ago [-]
This is why the assertion that crypto allows you and you alone to control your capital is a fallacy. Depends on your threat model of course...
aa-jv 21 hours ago [-]
Yes, that is true.
gpderetta 21 hours ago [-]
big bang or bust.
riffraff 21 hours ago [-]
ah the good old C-x M-c M-smelting
karel-3d 21 hours ago [-]
Crypto people keep rediscovering we live in a society.
stymaar 21 hours ago [-]
Every cryptographic system has a trust assumption somewhere
flir 21 hours ago [-]
Hm. Computation with paper and pencil?
(I agree in general, I'm just exploring the statement).
cedilla 20 hours ago [-]
Unless you are a world-class cryptographer, you have to trust someone that the algorithms are sound.
Ohentis 18 hours ago [-]
Even if you are a world-class cryptographer, you have to trust that the algorithms are sound (but now it isn't even a person you are trusting).
dansquizsoft 19 hours ago [-]
I don't get what you are saying here re no sovereignty with no (custom) hardware.
Grab the Bitcoin white paper and an airgapped PC with a fresh Debian install.
Implement the algorithm(s) in the white paper to generate yourself a private key and then a wallet address from that.
Send bitcoin to that wallet. Write down the private key and wallet address, store it somewhere safe, bury it in the garden, whatever.
No special hardware is required for any of this...
Or am I missing something?
duvall69 18 hours ago [-]
Yes, you're missing that grabbing an airgapped PC with a fresh debian install is less fool-proof than you are proposing. The victims here thought they were buying an airgapped device but due to a supply-chain attack they were not actually airgapped. Of course the odds of their being a secret modem in a random PC you buy to be your own homebrew ledger device are nearly 0 -- but it's certainly not impossible or even difficult for a motivated attacker -- it's just unlikely because there would usually not be enough value in snooping on a device like that. What you are talking about is just security through obscurity, not actual security.
expedition32 16 hours ago [-]
Ah yes real mass adoption strategy right there.
dansquizsoft 9 hours ago [-]
shrug - if you want to take the government out of your money and put it into a system that can scale a lot larger than the size of your local community, then you had better know what you are doing...
dingaling911 21 hours ago [-]
Seems like maybe crypto having a single point of failure (keys) is a problem rather than hardware.
You will never be completely secure against failure, the only way to protect yourself is to be able to robustly recover from failure.
I'd rather be able to say "every single government is in my hardware and they still can't touch it."
Perhaps possible with multisig, but now you're basically back to trusting banks.
rhyperior 21 hours ago [-]
Keys don’t have to be a SPoF though. Multi-signature schemes are the baseline for security today.
dingaling911 20 hours ago [-]
Right, but who is the multi in the multisig and what happens if they die.
rhyperior 20 hours ago [-]
You can be the multi yourself. Choose diverse hardware (ie, not all the same Ledger) and your likelihood of compromise changes significantly in your favor.
Sure, loss of seed material would be catastrophic so have a backup scheme. The point isn’t that you can make it perfect, but there’s laughably risky and imperfect solutions and putting everything on a single key HW device like this is the poster child.
dingaling911 19 hours ago [-]
OK but if your wallet gets doxed, you can still be forced to give it up by criminals.
rhyperior 16 hours ago [-]
Indeed! The pipe wrench attack, employed since valuable things existed!
thenthenthen 21 hours ago [-]
Not sure what you mean? Taiwan, imported, isnt taiwan the biggest exporter of high end chips? 100% these have not been hacked in Taiwan. You mean setting up your own fab? I am confused
aa-jv 21 hours ago [-]
Yes, Taiwan is the biggest exporter of chips. Have you audited your chips today?
dada216 21 hours ago [-]
I wonder if even people like Intel or AMD or Nvidia do.
There might be a strict hardware audit process for cryptographic accelerators on IBM Z machines though, I'm not sure, I'm gonna ask though.
aa-jv 20 hours ago [-]
It is standard practice in many industries to do hardware audits, including random controls of chip supplies.
These industries are just not sexy enough for the crypto folks to want to learn from, or about.
PaulRobinson 18 hours ago [-]
That's an impractical stance, there's always another layer down.
Supply chain risk is real, and it has to be managed in realistic terms.
For me, this is the weak link in the chain for digital assets, and always has been, but the mitigation is simple: no one hardware wallet should have millions of dollars of assets on it. Split it up, and use different techniques, different vendors, with different supply chains.
coliveira 20 hours ago [-]
Every bitcoin in existence will eventually be hacked. It's just a matter of time.
astoor 16 hours ago [-]
> "Every bitcoin in existence will eventually be hacked."
Or the keys lost/forgotten, like Satoshi's approx 1M Bitcoin (possibly/probably). But this is a feature not a bug - according to Satoshi himself "Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone." (https://satoshi.nakamotoinstitute.org/posts/bitcointalk/thre...)
littlecranky67 20 hours ago [-]
Yet we trust our daily money system to be based on printed colorful paper that no one can reproduce.
dbspin 20 hours ago [-]
Because it works... The level of counterfeit currency is readily measurable. Currency can be withdrawn and replaced. Individual stolen notes can be tracked. Counterfeiting of the dollar and the euro today is a relatively minor problem
How do they track counterfeiting of digital currency? Most of the money supply is not physical but digital.
lokar 18 hours ago [-]
There counterfeiting is not the issue; it’s unauthorized transfers or alterations to the account ledger. In both cases there are many layers of backup record keeping and procedures to investigate and correct errors.
giantg2 13 hours ago [-]
The checks in place seem pretty minimal. What's stopping spoofed transfers between institutions or end users?
lokar 10 hours ago [-]
The participants (the banks) are trusted to validate transactions before sending them, and are responsible for fixing bad transactions. And if they keep screwing up they can lose access.
StilesCrisis 20 hours ago [-]
You sound sarcastic but it's true. Unless you have government-level resources, you can't make a perfect $20 bill. They don't use paper--water would destroy it--they use a special fabric with a single supplier that only sells to the government. They don't print; they stamp. There are watermarks, security strips, and other features that can't easily be reproduced. Doing it right would be a massive investment, at the risk of being caught and losing everything.
Muromec 20 hours ago [-]
Doesn't matter as long as the real money is not disappearing from my wallet
giantg2 19 hours ago [-]
But, assuming you are like the vast majority of people, most of you money is virtual in bank accounts and such. There doesn not exist enough physical currency to back all the virtual money in the accounts.
Muromec 7 hours ago [-]
Still doesn't matter as long as my virtual money reliably transacts and I get whatever physycal goods and services.
cedilla 20 hours ago [-]
It's very very very very hard to forge money convincingly enough to fool central banks. It's basically impossible for anyone but nation-state actors, and the only known cases date back decades. Today, it's even harder, because even if central banks were unable to identify forgeries, duplicate serial numbers or ones that have never been issued would be detected very quickly.
Even making forgeries that can fool normal automated tests, like those done in an ATM, is incredibly hard. It's certainly possible, just way too expensive.
hvb2 20 hours ago [-]
It's very hard to steal a lot of physical currency.. Even with the biggest bills, it becomes unmanageable. Digitally it obviously doesn't matter if your transferring 1 Bitcoin or 10K
CJefferson 19 hours ago [-]
There are two important differences:
1) We have a legal system which (not perfectly) can reverse or fix issues which arise, with crypto money, it's just gone.
2) Someone who can produce fake colourful paper will typically only be able to produce a fairly small amount and not destabilize the whole currency. In the rare occurrences where someone found a significant hack in a crypto-currency, it's just done.
albedoa 20 hours ago [-]
Yes, you are getting it.
agentdev001 21 hours ago [-]
Some chollima, its always a chollima.
ricardobeat 20 hours ago [-]
The idea of a hardware wallet sounded wronged to me from the start.
Why would you trust some random hardware, that has the sole purpose of holding your money, making it an obvious target, over a general purpose computer you control entirely?
wappieslurkz 20 hours ago [-]
Strictly speaking, a hardware wallet doesn't hold your "money". Your assets live on the blockchain, and your seed phrase generates the private keys that control them.
The hardware wallet is just a sandboxed interface between you, your seed, and the blockchain. It requires a computer to connect to you and the internet.
In other words: as long as you have your seed phrase (and your passphrase, if you set one) on a piece of paper, you can smash your hardware wallet to bits and be fine.
(This assumes a standard single-signature wallet using the BIP-39 standard)
lxgr 17 hours ago [-]
It's all about reducing the trusted computing base, both in terms of lines of code and of organizations supplying said code.
Most people's computes run a lot of software, including a general-purpose OS with a huge attack surface and third-party applications, often with broad or even unconstrained access to all their files.
General purpose computers often also don't have tamper-proof secure storage; hardware wallets generally do.
tzs 12 hours ago [-]
Get a general purpose computer that you have removed all writable storage from. Boot from a CD-ROM or write protected USB drive that contains an OS, your wallet software, and your encrypted key.
To use it boot, run your wallet software, enter the decryption key for your wallet, conduct your transaction (communicating with whatever other device you are using for this the same way a hardware wallet would communicate), and turn off the wallet computer when done.
lxgr 12 hours ago [-]
How do you write the CD-ROM? Who vets the software that goes on it? How sure are you that none of the many peripherals running their own firmware are compromised?
tzs 8 hours ago [-]
The software that goes on the CD-ROM or write-protected USB drive can simply be a minimal Debian Linux, with some popular software wallet that works on read-only systems installed.
You build it the same way people build any other read-only bootable Linux.
Configure your kernel to not include drivers for any peripherals not needed for the task of being a wallet.
If you have some peripheral whose firmware does something like snoop RAM on its own to try to find and steal your crypto keys, and it has some way to exfiltrate that data then maybe you are screwed.
But if you do this right nothing you are using is particularly associated with cryptocurrencies or cryptocurrency users, and ideally you bought all this some anonymous way (like went to Best Buy and bought an RPi with cash, along with any peripherals you need).
Note that once built you should never need to update either the hardware or the software, so unless it is already compromised when built it should stay safe.
dd8601fn 20 hours ago [-]
If there was ever any appeal to me, it’s that vague notion that machines get wiped, rebuilt, compromised, travel, get stolen, etc. A dedicated device could kinda avoid some of that if it mostly sits in a safe or something.
I never did get one, though.
coralreef 18 hours ago [-]
Your general purpose computer is connected to the internet 24/7. It runs a complex operating system which constantly gets updated and patched. It visits dodgy websites, downloads npm packages, backs up files to the cloud, etc.
Thus the attack surface is far greater.
ricardobeat 16 hours ago [-]
Is it though? There is nothing you can solder onto it that will gain any meaningful access and go unnoticed. Tampering with the supply chain is a lot more difficult, easily detectable, and wouldn't scale. I can use 100% open source software, in an OS where it's signed and completely safe from interference - except the NSA of course, but they are not interested in your money.
For example, in MacOS it would be extremely hard to "sniff the display" as in this attack, unless you take obvious steps to authorize screen access.
coralreef 15 hours ago [-]
Using a consumer pc, risk wouldn't come from hardware hack implementations, it would be mostly software.
To continue with your example, "display sniffing" could be done by infecting trusted software or software presented as trustworthy (fake or infected Zoom binaries, Xcode binaries, etc.) or injected through open source dependencies like npm packages.
Yes, you or I might be paranoid enough to check the checksum hash to make sure the open source code matches the build. But every time, for everything?
The less connected it is, the safer. The less software it runs, the safer.
ricardobeat 15 hours ago [-]
> fake or infected Zoom binaries, Xcode binaries, etc.
There are so many hoops to go through to pull something like that off, it's basically impossible. It would be a "the great train robbery" kind of effort. I also don't think an npm package could alter an existing app or obtain screen access otherwise, unless you're running `sudo npm install` routinely.
Some form of phishing would be way more likely to succeed, luckily you can use your own brain to protect against those attacks.
More software means more complexity means more pathways to losing.
Can you do it? Sure. I'm sure there are millions of dollars in private keys stored on internet connected laptops somewhere out there. But the best practices remain the same: as little internet as possible, as little software as possible.
ricardobeat 8 hours ago [-]
Both of those are phishing attacks. You are right about NPM though - a good reminder to avoid banking on developer machines.
lokar 18 hours ago [-]
Or, get a mass produced general purpose computer and never connect it to the internet.
coralreef 17 hours ago [-]
Yes, you can certainly use an air gapped laptop as a dedicated hardware wallet.
But now you need to generate a public key to send to someone so you can receive coins. How are you sending that key to your friend? Are you going to read character by character and manually type up the string?
It's all tradeoffs.
lokar 16 hours ago [-]
For the public string? QR code
coralreef 16 hours ago [-]
Right, so now you need an additional device on hand (your phone) to parse the QR code into a string. Or I guess you could activate your hot laptop's webcam, pick up your cold laptop, crank the brightness up, point it towards your webcam, and capture the QR like that.
Sounds kinda clunky.
tzs 13 hours ago [-]
You need an additional device on hand to use the hardware wallet too, so that's not an argument against an air-gapped general purpose computer instead of a hardware wallet.
lokar 12 hours ago [-]
Yeah, I'm not deep into this stuff, but I thought the role of the device is to hold the key for a wallet that you don't intend to transfer out of very often. This makes the trade-off (more hassle, more security) worth it. If you are using the key all the time I don't see the point, the storage device won't be the weak point in your setup anyway.
wappieslurkz 20 hours ago [-]
[flagged]
trilogic 19 hours ago [-]
When people will understand that a "cryptowallet is a simple Aphanumeric sequence. Why would you need a hardware trick if all you have to do is scan for a match. Crypto has always been a scam, ask yourself do you know anyone of your friends that made it with crypto!
forshaper 18 hours ago [-]
"ask yourself do you know anyone of your friends that made it with crypto!" yes. Why would you use such an easily falsifiable example? I'm sure there's plenty of other points in your preference's favor.
trombuance 16 hours ago [-]
That said, for users who believe the math that secures everything from SSL/TLS over iMessage to PGP is a "scam", not knowing anyone who made it rich with a particular application of those algorithms is likely the least of their worries.
trilogic 16 hours ago [-]
Blah, what a waste of a comment you did, false to the bone. not much to say, the show must go on.
There is no physical tamper detection either. No tamper pads to detect case openings, no seal that gets broken when it’s opened that prevents operation. As others have mentioned, the most basic precaution would be to glue the whole thing together, which they didn’t do either.
Trusting Ledger with securing anything secret would be a very bad idea.
That MCU is explicitly not assumed to be critical in their security model [1]. It handles Bluetooth and USB communication, both of which are assumed to be insecure transport layers. Securing the MCU would not have helped in this particular incident, and I can't think of a scenario in which it would be critical.
Button input and screen output, which are critical, are handled by a secure element. Unfortunately, at some point even the most hardened secure element will have to output data to be displayed on a screen; that's what was attacked here. Electronic shoulder surfing, basically.
[1] https://www.ledger.com/ledger-nano-x-bluetooth-security-mode...
I ponder "What applications would I want this security stuff for?" Crypto wallets are a great example... and the crypto wallets in the wild aren't using them, as you point out!
People should do better research before buying things, and - it should go without saying - especially when it's about security. Ledger has a whole list of issues, they became the most popular brand not because they're the most trustworthy but because of their marketing and focus on supporting a massive number of coins. You'd think though that security should be the number one priority for a hardware wallet brand, not convenience.
This doesn't help any bit against the hardware implant we're discussing here.
> So there’s no way to guarantee that the software running on this has not been tampered with.
While true, I don't think it matters too much, other than the possibility of turning the device into something like a rubberducky.
> There is no physical tamper detection either. No tamper pads to detect case openings, no seal that gets broken when it’s opened that prevents operation. As others have mentioned, the most basic precaution would be to glue the whole thing together, which they didn’t do either.
Now that is the real meat. Unfortunately, for any given attack it's possible to bypass it. Tamper pads, if you know where they are, you can drill through the housing and, depending what it is, keep the button pressed by a jig, or solder wires if it's a sense trace to bridge it. The housing itself can easily be fully replicated, it's just a matter of coughing up some money for custom molds.
The only way to make something relatively tamper proof is to use injection molding over the full housing with something like glitter as part of the plastic, that will distribute randomly - and most importantly: not replicable! - across the housing, and then take high quality photographs and store them on your website together with the serial number.
That way the customer can photograph the device they have, and compare the random glitter specks with those on the website.
Tamper proofing hardware is among the hardest things there are, especially if you are up against nation-state actors like North Korea (that has been known to engage in cryptocurrency theft in the past).
You bring up a good point about bypassing physical tamper detection, but those defenses increase the cost and complexity of the attack, making them harder to succeed undetected. As it is, this attack seemed quite trivial to implement.
Do you know anything about their security model to pass judgement like that? They actually have a quite thorough hardware security model, outlining which components are and aren't considered critical: https://www.ledger.com/ledger-nano-x-bluetooth-security-mode...
> As it is, this attack seemed quite trivial to implement.
Have you looked at the miniature LTE board implant? It's an extremely sophisticated attack against a very sophisticated target, in my view.
u would need something that you do not have to check online which is physically given to you by a known person. who do you really know at the vendor? no one. there isnt this person.
that being said,.so it comes back to trusting someone if you are dealing with digital things, somewhere down the line. That trust can be attacked, so u need to ne aware of it and if anything dont put all your eggs in the same basket.
Say you have 10 million$. you would want to split it up in chunks the size of your acceptable loss * the chances of such loss occurring, so that whenever you lose something, its within accepted risk parameters :')
The issue is that the HSM itself has no input or output. Securely interfacing with those is not trivial.
Edit: For folks down voting me, please explain. I'm genuinely curious about your perspective.
Depending on your design requirements you can also use different battery chemistries or cell constructions to minimize the need for mechanical venting.
Ledger's mistake here was solely assuming that fitting hardware capable of long-range (or even global, in this case) communication into the tiny footprint of their device's case was impossible. I'm not in their industry, but I'd honestly have guessed the same until this week.
[1] https://www.ledger.com/ledger-nano-x-bluetooth-security-mode...
https://en.wikipedia.org/wiki/Potting_%28electronics%29
Maybe it increases the price quite a lot, IDK.
On the plus side, I did get to do a "fire drill" of my recovery process, which did work, so that was nice.
Of course I can't achieve what I want all the time, but being able to use a fixed-function tool till some electronic component dies inside is way more attractive for me to send the same device to recycling or trash just because a part with limited life (and shorter time w.r.t. rest of the device in general) reaches ends of its life.
(https://support.ledger.com/article/4404382029329-zd)
https://www.thehenryford.org/collections/explore/artifact/40...
And besides, Ledger firmware can be updated to change fonts and such so it'd be long-term safer to just stream the raw data.
I suspect that the attackers here have been waiting for enough funds to land on compromised wallets to be worth their efforts and then withdrew everything at once, with comparably little chance to get caught.
... unless they are tied to a government.
Says who? I've bought single-use eSIM profiles for data while traveling without any KYC in the past; it's actually the norm, not the exception.
Some suppliers specifically advertise that, as well as accepting cryptocurrency.
Ledger confirms spy chip implant behind wallet crypto thefts
https://news.ycombinator.com/item?id=50054092
The impacted resellers would have to test the devices powered on to see if they were using cellular data.
There is no sovereignty in crypto if YOU ARE NOT BUILDING YOUR OWN HARDWARE.
Any claims of sanctity or reliability in the software stack are rendered null and void until someone with a tunneling electron microscope has completed an audit of your chips.
THIS is why Taiwan matters so much, people: there is NO sovereignty for as long as your chips are being imported. You can trust all you want - but trust is nothing without verification. We are all serf-subjects of the wafer-producing overlords.
Ledger clearly drank the koolaid. Crypto people: invest in hardware. NOT software. Anything less is utter futility.
not your hardware, not your keys
not your chips, not your hardware
not manufactured in house, not your chips
not your designs, not manufactured by you
not designed by you personally, not your designs
ad infinitum. To be truly secure, you must first learn to survive alone in the wilderness and smelt tin
I'll just order my crucible and tongs off Alibaba.
Wait a second...
(I agree in general, I'm just exploring the statement).
Grab the Bitcoin white paper and an airgapped PC with a fresh Debian install.
Implement the algorithm(s) in the white paper to generate yourself a private key and then a wallet address from that.
Send bitcoin to that wallet. Write down the private key and wallet address, store it somewhere safe, bury it in the garden, whatever.
No special hardware is required for any of this...
Or am I missing something?
You will never be completely secure against failure, the only way to protect yourself is to be able to robustly recover from failure.
I'd rather be able to say "every single government is in my hardware and they still can't touch it."
Perhaps possible with multisig, but now you're basically back to trusting banks.
Sure, loss of seed material would be catastrophic so have a backup scheme. The point isn’t that you can make it perfect, but there’s laughably risky and imperfect solutions and putting everything on a single key HW device like this is the poster child.
There might be a strict hardware audit process for cryptographic accelerators on IBM Z machines though, I'm not sure, I'm gonna ask though.
These industries are just not sexy enough for the crypto folks to want to learn from, or about.
Supply chain risk is real, and it has to be managed in realistic terms.
For me, this is the weak link in the chain for digital assets, and always has been, but the mitigation is simple: no one hardware wallet should have millions of dollars of assets on it. Split it up, and use different techniques, different vendors, with different supply chains.
Or the keys lost/forgotten, like Satoshi's approx 1M Bitcoin (possibly/probably). But this is a feature not a bug - according to Satoshi himself "Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone." (https://satoshi.nakamotoinstitute.org/posts/bitcointalk/thre...)
https://www.ecb.europa.eu/press/pr/date/2025/html/ecb.pr2502... https://www.bankofengland.co.uk/statistics/banknote https://www.cranecurrency.com/news-insights/85-decline-in-us...
Even making forgeries that can fool normal automated tests, like those done in an ATM, is incredibly hard. It's certainly possible, just way too expensive.
1) We have a legal system which (not perfectly) can reverse or fix issues which arise, with crypto money, it's just gone.
2) Someone who can produce fake colourful paper will typically only be able to produce a fairly small amount and not destabilize the whole currency. In the rare occurrences where someone found a significant hack in a crypto-currency, it's just done.
Why would you trust some random hardware, that has the sole purpose of holding your money, making it an obvious target, over a general purpose computer you control entirely?
The hardware wallet is just a sandboxed interface between you, your seed, and the blockchain. It requires a computer to connect to you and the internet.
In other words: as long as you have your seed phrase (and your passphrase, if you set one) on a piece of paper, you can smash your hardware wallet to bits and be fine.
(This assumes a standard single-signature wallet using the BIP-39 standard)
Most people's computes run a lot of software, including a general-purpose OS with a huge attack surface and third-party applications, often with broad or even unconstrained access to all their files.
General purpose computers often also don't have tamper-proof secure storage; hardware wallets generally do.
To use it boot, run your wallet software, enter the decryption key for your wallet, conduct your transaction (communicating with whatever other device you are using for this the same way a hardware wallet would communicate), and turn off the wallet computer when done.
You build it the same way people build any other read-only bootable Linux.
Configure your kernel to not include drivers for any peripherals not needed for the task of being a wallet.
If you have some peripheral whose firmware does something like snoop RAM on its own to try to find and steal your crypto keys, and it has some way to exfiltrate that data then maybe you are screwed.
But if you do this right nothing you are using is particularly associated with cryptocurrencies or cryptocurrency users, and ideally you bought all this some anonymous way (like went to Best Buy and bought an RPi with cash, along with any peripherals you need).
Note that once built you should never need to update either the hardware or the software, so unless it is already compromised when built it should stay safe.
I never did get one, though.
Thus the attack surface is far greater.
For example, in MacOS it would be extremely hard to "sniff the display" as in this attack, unless you take obvious steps to authorize screen access.
To continue with your example, "display sniffing" could be done by infecting trusted software or software presented as trustworthy (fake or infected Zoom binaries, Xcode binaries, etc.) or injected through open source dependencies like npm packages.
Yes, you or I might be paranoid enough to check the checksum hash to make sure the open source code matches the build. But every time, for everything?
The less connected it is, the safer. The less software it runs, the safer.
There are so many hoops to go through to pull something like that off, it's basically impossible. It would be a "the great train robbery" kind of effort. I also don't think an npm package could alter an existing app or obtain screen access otherwise, unless you're running `sudo npm install` routinely.
Some form of phishing would be way more likely to succeed, luckily you can use your own brain to protect against those attacks.
Fake zoom updates: https://www.malwarebytes.com/blog/scams/2026/02/fake-zoom-me...
NPM supply chain attack targeting cryptowallets: https://www.paloaltonetworks.com/blog/cloud-security/npm-sup...
More software means more complexity means more pathways to losing.
Can you do it? Sure. I'm sure there are millions of dollars in private keys stored on internet connected laptops somewhere out there. But the best practices remain the same: as little internet as possible, as little software as possible.
But now you need to generate a public key to send to someone so you can receive coins. How are you sending that key to your friend? Are you going to read character by character and manually type up the string?
It's all tradeoffs.
Sounds kinda clunky.