Hacking News
Ledger Wallet Implant Breaches Security
Ledger, a hardware wallet manufacturer, confirmed an unauthorized implant in one of its affected customer devices. The hackers exploited a hidden piece of hardware inside the Ledger wallet, which read the 24 recovery words displayed during setup and sent them over a mobile connection. This breach exposed the wallet's security, as the protected chip and transaction signatures remained intact. The attackers stole $102 million from 324 wallets across six networks, although Ledger has not confirmed the total or the number of losses from implanted devices. Hardware wallets do not hold the actual cryptocurrency, but they protect the private keys used for transactions, keeping them away from malware on internet-connected devices. The recovery words, which can recreate the wallet and its keys, were exposed during the setup process, posing a security risk if copied and shared.