Important Warning on Ledger Wallet Hacks: What Should Iranian Users Do?

One of the week's most controversial stories in the digital currency market was the theft of more than $90 million in various cryptocurrencies from Ledger hardware wallets, a device long considered the safest place to store digital assets. On Saturday, October 10 (18 Mehr), Ledger confirmed that inside the device of one affected user [...]

One of the most controversial news of this week in the digital currency market was the theft of more than 90 million dollars of different currencies from Ledger hardware wallets; The wallet, until today, was thought to be the safest place to store digital assets. Ledger Company confirmed on Saturday, October 10 (18 October) that a non-virtual piece of hardware was found inside the device of one of the affected users who had purchased their wallet from a supplier in East Asia.

It is not yet clear if all ledger wallets along the supply chain were infected or if this intrusion was only done in some areas; But Erzdigital has been informed that some sellers in Iran get their ledger wallets from East Asian suppliers. Additionally, evidence of intrusion into the Ledger wallet supply chain has been observed in other regions, including Germany.

Those Iranian users who use the Ledger wallet should urgently save their assets so as not to be a victim of this intrusion. Therefore, in this report from Aruzdigital, we examine the necessary solutions to ensure the security of assets.

What is the story of manipulation of ledger wallets?

The story started with the report of theft of property of users of a store called CryptoBilis in Southeast Asia. This store is one of the official sellers of Ledger products. After the reports were published, the Ledger company asked this store to stop selling and shipping its devices so that the investigation about the origin of the theft continues.

According to the analysis of the blockchain analysis company Bitquery, the value of the stolen assets in this case is estimated at 93.2 million dollars. Of course, this figure has not yet been officially confirmed by the ledger, and it is not clear that all reported thefts are directly related to hardware tampering.

The worrying point of this case is the possible method of information theft. In examining samples of the Ledger Nano X wallet, security researchers have found a small electronic board that was connected to the device's internal components. The board could read information displayed on the wallet's screen, including a 24-word recovery phrase, and send it to attackers via an independent connection to the mobile network.

This method of penetration is called "attack on the supply chain"; It means that the device is manipulated between production and delivery to the buyer. However, it is not yet clear at which stage these changes were made, and the connection of all the examined samples with the Cryptobilis case has not been confirmed.

Are ledger wallets in Iran also in danger?

Although initial reports concerned buyers in Southeast Asia, the publication of claims about suspicious devices in Europe has raised concerns about the possible scope of the intrusion. Including a report about the device purchased from the MediaMarkt store, which has not yet been officially confirmed.

On the other hand, information obtained by ErzDigital shows that some hardware wallet sellers in Iran purchase ledger products from East Asian suppliers. Therefore, there is a possibility that some devices in the Iranian market are also imported from the same supply routes.

However, buying from an Asian supplier does not mean the device is contaminated. What is important is to identify the real route of supply and investigate the possibility of its connection with suspicious shipments. Until the writing of this report, there has not been a confirmed case of the presence of a spy piece in devices sold in Iran or reports of theft of assets from Iranian users' Ledger wallets.

What should Iranian wallet users do?

The first step is to check the purchase information of the device. If you bought your wallet from a store in Iran, it is better to inquire about its foreign supplier. You may imagine that if the device has successfully passed the Genuine Check test, there is nothing to worry about. But this test is basically designed to check the authenticity of the security parts of the device and it cannot necessarily identify the spyware pieces added to the hardware. Therefore, even an original device may have been tampered with after production.

An expert on hardware wallets, in a post on the X social network, identified signs such as the presence of an extra board, an unusual antenna, extra wiring and suspicious changes in the soldering of components as possible signs of tampering. But checking these cases requires sufficient expertise in the field of repairing electronic components.

Hence, unlocking the device is not recommended for all users. The internal parts of the wallet are delicate and opening it improperly can damage the device. On the other hand, detecting unauthorized parts requires familiarity with the hardware structure of the model in question, and the absence of external signs does not guarantee the health of the device.

If you are suspicious of your device and have significant assets in it, it is best to plan for a safe transfer of assets prior to any physical examination.

How to protect our assets?

The appropriate action depends on the condition of the device. Someone who just bought a ledger and hasn't set it up yet has a different situation than a user who keeps multiple cryptocurrencies in their wallet.

1. If you bought the device but haven't set it up yet, if your device came from a dubious source or even if you don't know the source, it's best to avoid setting it up for now. When setting up a hardware wallet, the recovery phrase appears on the screen for the first time, and in the analyzed intrusion method, this step can provide an opportunity for data theft.

Therefore, do not create a new recovery phrase on the device or enter your previous wallet recovery words into the device until the status of the device is turned on.

2. If you've booted the device and have assets on it in this state, the most important thing is that your recovery phrase is likely already in the hands of attackers. Even though the balance of the wallet remains intact, it cannot be concluded solely on the basis that its information has not been exposed.

The safest course of action for a device with serious tampering potential is to transfer the assets to a new wallet with a completely different recovery statement. To do this, follow the steps below: Get a new and secure hardware wallet of another type or brand; When you create a wallet, you will receive a new recovery phrase, which you must keep offline and in a safe place. This phrase should not be created or entered on a suspicious device.

Never restore your previous wallet with the same 24 words as before in the new wallet; This does not solve the security problem. In this case, you've just opened the same old wallet on another device, and if attackers have the recovery phrase, they'll still have access to its assets.

Transfer your assets from the old wallet to new addresses in the new wallet; When transferring, check the digital currency network and the destination address carefully. It is better to do a test transaction with a small amount first and then transfer the rest of the assets after making sure you receive it.

If you hold digital currency in several different networks, do not forget that all accounts and assets related to the previous wallet must be verified; Also, don't reset the old device until the migrations are complete; Because you may need it to access the remaining assets.

If you can't get a secure hardware wallet right away, install a reliable software wallet on a healthy phone or computer; Of course, this method has its own security risks and is not a suitable alternative for secure hardware for long-term storage of large sums.

3. If some of your assets have already been stolen, you should seriously consider revealing the recovery phrase if you've seen suspicious withdrawals from your wallet. First, check other accounts and networks created with the same phrase and take action to protect remaining assets.

Also, keep track of suspicious transaction IDs, purchase information, and device specifications and report the issue through Ledger's official support. Never deposit any new assets into a suspicious wallet.

Does changing the password or resetting the ledger fix the problem?

One of the possible mistakes of users is to think that by changing the PIN, updating the software or resetting the device, they can cut off the attacker's access.

These measures may serve security purposes under normal circumstances, but are no longer sufficient if the recovery phrase is exposed. The reason is simple: your assets are tied to the recovery phrase and the keys generated from it, not the PIN or physical device.

You should also watch out for scams that may appear after this news is published. No person or website needs your recovery phrase to check for contamination, replace the device, or pay for damages. Even if such a request is ostensibly made by Ledger Support, you must not provide recovery words to the requester.

Summarizing the discovery of a spy chip in one of Ledger's wallets has shown that even genuine hardware devices can be tampered with before reaching the buyer. However, there is still not enough evidence to draw conclusions about widespread contamination of ledger products or devices in Iran.

For this reason, ledger owners should first check the purchase route of their device. If there is strong evidence of tampering, the most important security measure is to transfer the assets to a secure wallet with a new recovery phrase; Because as long as the assets depend on the previous expression, the possibility of attacker access remains.