Safeguarding Funds (2/3): Lessons from the Ledger Cold Wallet
Safeguarding Funds (2/3): Lessons from the Ledger Cold Wallet
Author: George Yim
Managing Director, Crypto HK
Earlier this month, Ledger hardware wallets sold by the official Malaysia, Philippines, & Indonesia reseller CryptoBilis were compromised. A criminal group obtained genuine devices through CryptoBilis, opened them, and implanted a miniature circuit beneath the screen. When a user set up a wallet and the 24 word seed phrase was displayed, the implant captured it and transmitted it over a mobile network. On-chain estimates put the losses at about US$90 million.
Ledger claimed the affected devices came from that distributor, and that its chips, systems, and direct-sales channels had not been breached, what was actually broken was the distribution stage after the products left the factory. The community has voiced skepticism, but no further evidence has emerged.
Ledger is the world’s most widely used cold-wallet brand. Most people who use a hardware wallet have already chosen to avoid exchange custody; they are precisely the group that takes the safety of their assets seriously. That they were still hit shows that attackers do not need to crack the secure element. They only need to find the weakest link in the supply chain. A genuine device can be opened and resealed while in circulation, and software checks run when official components are updated are poorly placed to detect an added part. Yet the device looks offline, yet the seed phrase has already leaked at the moment of setup. Security, in that case, exists in name only.
The incident has also revived a community debate over a structural problem with Ledger. Ledger offers a cloud recovery feature for seed phrases, under which an encrypted seed phrase is split into shards and held by third parties. Use of the feature is not mandatory, but the system already contains a path by which the seed phrase can be exported. From an information-security standpoint, that is a backdoor that can be exploited. Handing one’s entire seed phrase to Ledger is no different from leaving it with an exchange—only the name of the intermediary has changed.
The point of a cold wallet is to keep the private key off the network. But when the device itself may have been tampered with somewhere in distribution, a hardware wallet from a single brand may no longer be the last word. The community needs to take a fresh look at how assets are stored. That is a subject for tomorrow.