Ledger Wallet Spy Implants (The Great Hackening Continues...)

0:00 The great hackening of 2026 continues, and this time it's Ledger Wallet. This was actually a really sophisticated operation, and I think it shows just how much more powerful our adversaries are becoming and how we must adjust to account for that. We are not in Kansas anymore. You know what the most ironic thing about this hack is?

0:27 everything that people liked what I liked about the cold card was essentially all of the things that were done to protect against the sort of hack that ledger just got hit with yet all of those things for the cold card were useless because they couldn't get their firmware right to even make enough entropy for a key to be even slightly secure whereas ledger has all this great entropy and has a more professional and finished product, not worrying so much about the cypherpunk, you know, shoot this chip to make sure it's right. Let's look inside the device and have it clear so you can see if it's been modified. And let's just go ahead and use resellers. And that is exactly what got them hit. So Cold Guard was basically the prime example of being protected from what

1:19 Ledger just got destroyed with. While Ledger was able to make proper entropy for their keys, but they got hit because they couldn't control their supply chain and people literally modified their devices and then sold a bunch of compromised hardware wallets to a bunch of customers. Holy cow. Okay, we have a version 1.2 implant here.

1:45 So this is not supposed to be here. This is bad. This is not a crypto bilis unit. This is a Singapore airport unit. So, yeah, this is bad. This is why you're going to hear from Bitcoiners over and over again. Buy straight from the manufacturer. A device like this is just too vulnerable and the attack surface is too big with too great of a reward for it to not occur.

2:20 And this is exactly the sort of thing that we've talked about for years would eventually happen. And of course, it happens in the great hackening of 2026. Not really surprised. Just crazy to see it all kind of come to a head at the exact same time. I'm tired, boss. so let's go a little bit into the details of exactly what happened how the attack was implemented and who is at risk so ledger has an authorized reseller in the malaysia philippines kind of indonesia area that's kind of their main distribution market called crypto bilis okay red flags flying at the very beginning of this year the company got quietly bought out and there's also actually an NDA about keeping the sale private and apparently what has been discovered so

3:12 far is that there was a single owner that was based out of China at some point in the mix the ledgers going through this reseller stopped being normal ledgers and I am recording this on October 14th and it was October 9th that the wallets started draining. And it was the next day that Ledger confirmed that there was an unauthorized implant inside tons of these devices.

3:40 And so far it looks like it's somewhere between 70 and 100 million dollars in the hack across somewhere between 300, maybe 350-ish wallets, at least as far as anybody can tell at the moment. And as with any of this, it seems like this wasn't the first time and there were kind of some yellow flags being brought up.

4:01 Back in 2025, somebody found an implant in their ledger that they got from Thailand, sent to hardware hacker Joe Grand, who confirmed. There is a bunch of wires connecting to that little green circuit board there. That's normally not there. The Ledger Nano X board is the black board. it does not have wires connecting to an external board.

4:25 So he knew enough to say that looks different. This is not a legitimate device. This is you know something been actually it is a legitimate device but it been compromised with some additional circuitry and he noticed that the battery was smaller also and the battery was made smaller so that hardware implant could fit in there multiple more of these devices were purchased in march and the same alteration was found in those and then this was reported to ledger there was another researcher in japan who said that there were five different versions of this thing and actually watched at least 90 of these things phoning home the seed phrase back in June. So this had been running for a good little while and was just quietly getting better. So then

5:07 it's about how this thing works and it's kind of brilliant in its simplicity. So it didn't hack the firmware. It didn't break the cryptography or the entropy. It didn't change the hardware on the device. Like it didn't manipulate the secure element route around the RAM or anything like that it literally it was a key logger it watched the screen it just sat in between it watched the screen and the buttons and so anything that you typed in and anything that the screen showed and then it phoned home there was an e-sim a microcontroller and a lte modem and then it was put up where the phone padding usually is underneath the screen and there's basically a tiny little cell phone it just put an itty bitty little cell phone inside the ledger and then it

5:55 literally just looks at the screen and then calls home. Calls his bro up in China or whatever. He's like, yo boss, here's the seed phrase. In fact, this was the crazy thing is because it didn't do anything to the secure element or the inner workings of the board itself on the ledger. Like it passed the genuine check. So when you plug it in the computer and you go to the ledger, like check if my thing is safe, it passed with flying colors because the secure element was fine.

6:24 nobody changed anything. Just a side note to marvel at how small technology and how dense technology has become. You can fit an entire cell phone inside of this without having to take any of the stuff that's in it right now out of it. They literally put an entire extra computer in this thing. So who's at risk and what do you do? Well, first, who's at risk? Anybody who bought from resellers if you bought from a reseller consider yourself at risk that's a rule that we really should stick to the exposure of just passing this around in from hand to hand just presents such a huge attack vector whereas like this is why the rule is just always buy directly from the manufacturer it does seem that this was all centered in the west pacific so you know auction

7:18 Yahoo Auctions in Japan was specifically mentioned. CryptoBillus obviously was mentioned. If you ever find it discounted, that's one of the things that you see a lot on, especially Amazon and those sorts of marketplaces, is that it'll be like 20% cheaper than if you bought it from the manufacturer. There's a reason why they're willing to take that cut.

7:36 What's the catch? So if you fall under any of those categories, then you can get a new hardware wallet straight from the manufacturer. In fact, Trezor just announced that they will no longer do reseller. and honestly I wonder how that works out because I know a lot of these companies have partnered with like meetups and you know Bitcoin Beach and all these things you know like they have you know the Bitcoin Magazine conference and stuff they're selling the devices but those are all points of failure to get those in person like that's a part of the supply chain the level of attack is becoming more sophisticated and better funded at the same time that the access to technology and capacity to produce and build custom hardware and these sorts of things is getting easier and easier

8:24 and easier but that's beside the point you can get yourself a new hardware wallet i have a five discount for the bitbox and bitbox is one that i love and use and it's and i have a discount because they gave the manufacturer gave me the discount and you're buying it directly from them not because i'm selling it on amazon and i've tampered with all of them uh so that's just know that that's the reason that i just told you not to ever listen to somebody who gives you a discount i gave you a discount, but there is a discount, but get a new one, generate a new seed, uh, or just do the super easy. The old and trusty, right? Is just boot up an old laptop that you have put Bitcoin core on it and just make a wallet and keys and don't attach it to the internet or anything and just use it

9:05 straight from there and then have a watch only wallet attached to it There nobody going to put extra secret hardware in that and you know unplug the wireless stuff And a really important note actually if you think you have a compromised device or you bought from this area and you're not sure, it's important to note that a passphrase or rolling the dice, all the stuff that would have saved you from the cold card incident, specifically don't work here because all of those things get put into the screen were input with the keys, and that's all phoned home the same as the seed phrase.

9:34 the seed phrase. But if there's any risk, you think that you could have a compromised device, make a new seed, get a secure device directly from the manufacturer, and move your coins to it as quick as you can. Now, I've already been seeing a bunch of people doomsaying again about self-custody, and this is something I talked about in the first Great Hackening video, is just that I knew this was going to keep happening and it makes sense that things were going to continue to feel really bad and the hit was going to get harder and harder because I'm seeing self-custody is dead that you know this isn't that much better than gold we have so many risks and the only reason we were ever going to be able to stand up to the fed and that the reason bitcoin couldn't be captured is because

10:20 you could self-custody and now look proof that you can't self-custody you should have just bought an ETF, it's going to be captured in the same way. I think this is exactly how security gets better. I do genuinely believe that there is a fundamental imbalance between defense and offense that gears towards greater order. I think the very existence of life is kind of a proof of that asymmetry somewhere in the universe that life is able to exist against all the chaos of the universe. And I think it applies to cryptography. There's a great quote from Julian Assange that for some reason the universe smiles on cryptography. I think the capacity to defend at a lower cost than the attack does exist. The thing is, is security doesn't improve in a vacuum.

11:06 It is literally the stimulus itself that causes the change. Almost nobody hardens a system against attacks that nobody has tried. Everything we call best practices today, seed phrases, hardware wallets, multi-sig, multi-vendor multi-sig, verifying your machine, verifying your signature, all that stuff, it all exists because something broke somewhere and we had to figure out a better way to make it more secure. Those stressors are exactly what forced the system to adapt.

11:38 It's not something broken in self-custody, it's the process of it. Our environment is changing really, really, really fast. So the nature of attacks, the capacity to attack, and the scope of the domains in which we can be attacked are all changing quite dramatically at the same time, and we are having to adjust with devices and strategies that were built in a world for 10 years ago, and a lot has happened in that 10 years. And also note that the cold card and ledger hacks actually come from totally different directions. The cold card entropy failure was a pure software bug and it actually had the clear device the tamper proof bags all the crazy edge case things that we thought made it the cool wallet and it failed due to the most fundamental and like

12:27 at the very core of just software entropy whereas ledger was a total supply chain hack is buy a company in the middle of a supply chain take it over create a new production line putting in a second computer inside of this device that had a cell phone signal that could call home and just listen and watch everything that's happening on the screen and have an operation that pushes this out and sells it to customers. Actually, I have to interject for just a second and just make sure that a lot of this is alleged. I don't actually know that, you know, the Chinese buyer. In fact, I think there's just a degree of speculation around the fact that it is, in fact, somebody in China who owns this. I think that's also kind of a loose detail around this. And we don't know

13:11 exactly where and when this got put in. Like it might not be that the company was purchased specifically to do this. It's just extremely ironic. And it's a very, it's a very flowing narrative to make that assumption. So just know that I am kind of making that assumption. There's no proof that that's what's happened yet. And, you know, so just a caveat there and follow ledger.

13:32 I'm sure there will be official reports and lots of new things uncovering in the next couple of weeks. So what do you do? What does this change? Well I think it not a coincidence that multi would have protected against this exactly the same or in a very similar way that multi protected against the cold card incident and specifically a multi multi-sig so if you've got a bit box a treasure a ledger and a cold card and you've done a two of four or a three of four multi-sig that would protect you from both of those situations and worth stating again, buy directly from the manufacturer. And also, this is just a generally good safe thing for any sort of attack is get a P.O. box. Be somebody who actually goes a little bit

14:22 like the next step and protect your home address. But if you're not sure if you're vulnerable, you're pretty sure you aren't, take this as an opportunity. You know, we're going to get a reminder every three or four weeks to go through the stash. Make sure we know where things are. make sure our keys are safe, make sure our process is airtight, and that we can get our backups if we need it, and that we're using multi-sig on that wallet that we said we were going to install multi-sig on, but that we didn't actually go and do it, and we said, oh, we'll just do it later, and it'll be next month and next month.

14:53 Let's just go do it. Let's just take the time. This is a great reminder that you can still get F'd in the A, so protect yourself. Obviously, there's a lot of great wallets out there. I'm a huge fan of Nunchuck. That's my favorite for multi-sig. there's sparrow there's specter there's a tons of wallets and these days have multi-sig and caravan over at the unchained guys at casa all those things this is getting more valuable the economy around it the network around it is getting more sophisticated this is a perfect example of also why it just takes time to build these things out if we were on a bitcoin standard tomorrow and this thing was worth 20 trillion dollars we'd just be looking at hacks of two trillion it needs to move

15:35 slowly so that things can break, so that we can trust, so we can learn important lessons, and we can make all of this stuff better. So to close this thing out, the ledger hack, the cold card hack, these are not the end of self-custody. They are the cost of making self-custody work in the world that we're headed into. And I think we are going to solve them. We are making strides, we are making improvements, and we have incredible tools at our disposal to make these things better but every attack like this is just teaching the ecosystem something and we have all of the tools and the the intelligence and the creativity to respond properly to what those things are teaching us but the systems the products and the processes will continue to improve and the

16:25 users themselves will learn more in exactly the same way that you have to protect yourself from physical space. You get a security camera, get a dog, you buy insurance, you learn how to fight and defend yourself a little bit. You learn how to use a gun and all the processes and upkeep and everything around it. You're going to have to do the same thing for the digital world. Most of our lives are falling into the digital world now, or at least an enormous portion of it. And so you're going to have to know what best practices are. You're going to have to know how to hold your keys.

16:53 You're going to have to know something about the adversaries and who you're defending against. and there will be lots of changes and lots of improvements. But the people who refuse to take responsibility for it and refuse to learn anything about it are just going to be the next set of headlines. And so for the too long, didn't watch people, multi-sig, multi-vendor, direct from manufacturer, and never discount an old laptop that's never seen the internet that you can just boot up and generate some keys on.

17:19 I hope you enjoyed the video. I feel terrible and I'm so sorry for all the people who've lost money out there. this is pretty fresh in my mind just going through this with the cold card so i know it's hell so stay safe stay strong stay vigilant you know stay on top of your stack and your keys and your backups and your multi-sig and your process you know make it a ritual make it fun make a hobby out of making fun multi-sig setups that's what i did i'm a nerd so also don't forget to check out the channel This is the new guys take channel on YouTube and any share or follow is a huge, huge benefit.

17:58 And it's a network that we're still growing. And I really appreciate any, any sharing out that you guys can do is a great free way to help out the show. And I thank you. But until next time, I'm Guy Swan and that is my two sets. you