MediaMarktSaturn, the German retail group behind the roughly 1,070 MediaMarkt and Saturn electronics stores across Europe, has pulled Ledger’s crypto hardware wallets from its shelves and websites as concerns grow about a supply chain attack on the French wallet maker. At the same time, Mark Karpelès, the former CEO of the infamous and collapsed Mt. Gox bitcoin exchange, says he has now examined a Ledger with an implant that was bought at Singapore’s airport.
Karpelès had been posting about Ledger devices fitted with “spy implants” as far back as last month, weeks before Ledger users’ wallets started getting drained on Friday, and his involvement in the uncovering of the supply chain attack on Ledger has turned into an unlikely redemption story for the formerly disgraced head of Mt. Gox. Ledger still says all confirmed cases involve devices sold through CryptoBilis, a reseller in Southeast Asia, and “the volume of impacted devices is limited.” There have been no public reports of tampered devices bought in the U.S. so far.
New cases reported in Europe and Singapore
A MediaMarktSaturn spokesperson told Cointelegraph that the removal applies to every country where the company operates. “The products have been removed from our product lineup internationally in all of our countries. We did this as a precautionary measure,” the spokesperson said.
Ledger said on Tuesday morning that MediaMarktSaturn had stopped selling its devices in stores and online, with Ledger’s agreement, after one customer in Germany reported an implant. The company added that no loss of funds had been reported.
An X user had previously posted photos on Sunday of a Ledger with extra cables inside, named MediaMarkt as the store where it was purchased, and suggested the device was probably a resold return. On Monday, he said he had bought a second Ledger from a different MediaMarkt location with the same modifications. “I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again,” he wrote. He dropped the returns theory in the same post, saying a MediaMarkt employee told him the device was not a return and that returned Ledgers go back to the manufacturer.
Karpelès announced the Singapore find early Tuesday. “Ledger Flex sold at Singapore Airport confirmed to contain a spy implant!” he wrote. The confirmation is Karpelès’s own, and Ledger has not said it verified the device. The Flex belongs to Ben Yorke, who posted on Saturday that he bought it at the airport from a store called Metapod and noticed scratches on the casing, and who said Tuesday it was bought in June and never unsealed.
Karpelès has also been sharing his read on who is behind the hardware. “Seeing the kind of R&D going on those implants, the European ‘v1.0’ and the overall quality of the product, I would guess the implant itself is a product, with its production lines and a manual sold to someone else, who is installing these on ledgers prior to sale,” he wrote on Monday.
Despite all that, Karpelès is still defending Ledger’s hardware. “I’ve been using Ledger devices for many years, and the recent discoveries of hardware implants haven’t changed my trust in them,” he said in another post. “Ledger devices are relatively easy to open and examine. That’s one of the reasons these malicious implants could be discovered and investigated.”
Ledger explains how the implant works
Ledger’s in-house team of cybersecurity experts, known as the Donjon, also published its first technical explanation of the attack on Tuesday, which matches what Karpelès’s company, Tibane Labs, documented in its own teardown.
“Based on the Donjon’s analysis of the attack, the implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM,” Ledger said. “It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.”
The update adds that Ledger is reviewing reports of implants in other devices and locations. “We have not verified a drain linked to a signer bought elsewhere,” it reads.
Following the money through Tornado Cash and Zcash
Whoever is behind the thefts has been trying to launder the proceeds, but they seemingly didn’t know how to properly use the crypto mixing app Tornado Cash or the privacy-focused cryptocurrency Zcash. On-chain analytics firm Bitquery now counts $102.0 million taken from 324 wallets across six blockchains.
By its count, the thief put about 6,680 ETH into Tornado Cash from Friday through Monday and sent most of what came out on through Zcash. Bitquery followed the funds by matching amounts and timing. “A mixer means the link cannot be proven outright, but we rate it strong,” the firm said. Bitquery rates its links for later rounds of mixing as weaker, and also credits YFarmX with initially spotting that route through the mixer and Zcash.
Tether has reportedly frozen $10 million of its USDT stablecoin that has been associated with the ongoing investigation. Ledger says it has not confirmed the total number of affected users or the amount lost, and that figures circulating online come from third parties.
What Ledger and Other Wallet Makers Are Doing
Ledger CEO Pascal Gauthier said the company still does not know where the devices were tampered with. “The investigation is ongoing to determine who tampered with these signers or where in the distribution chain it happened,” Gauthier wrote on Tuesday. “We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can.”
For owners who want to look inside their devices, Ledger has a guide for inspecting its devices, and Karpelès has posted a YouTube playlist on opening and closing the Nano X, Nano S Plus, Flex, and Stax. “Use caution and make sure your recovery phrase is backed up first, because opening a signer can damage it,” Ledger CTO Charles Guillemet warned.
Other hardware wallet makers are also tightening their own sales channels. “Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with,” Trezor said on Tuesday. “Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised.” OneKey said on Monday that it had ended CryptoBilis’s authorization, stopped adding new resellers, and started reviewing every existing one.
