Criminals steal $90M in crypto using modified USB devices

Ledger: Ledger is a French company that makes hardware cryptocurrency wallets, including its Ledger Signer devices, which protect private keys and recovery phrases. The company is investigating a supply-chain attack in which modified devices sold through the Southeast Asian reseller CryptoBilis allegedly captured recovery phrases and enabled cryptocurrency theft. Specter: Specter is a pseudonymous blockchain investigator who analyzed the affected wallets and estimated that the incident caused losses exceeding $86 million. The estimate has not been independently confirmed by Ledger. Bitquery: Bitquery is a blockchain analytics company that tracks cryptocurrency transactions and investigates illicit fund movements. Its analysis estimated that the compromised-device incident affected hundreds of wallets and involved losses of roughly $100 million. CryptoBilis: CryptoBilis is a Southeast Asian reseller of Ledger hardware wallets. Ledger linked confirmed losses to devices distributed through the reseller and said sales were suspended while the investigation continues. Response: Ledger asked relevant resellers to suspend sales, urged potentially affected customers not to initialize suspicious devices, and said it was reviewing its anti-tampering and distribution policies. Security: Ledger said the unauthorized implant could read 24-word recovery phrases displayed during device setup and transmit them over a cellular network using an embedded SIM. Supply chain: The incident highlights a hardware supply-chain risk: the malicious component was reportedly soldered inside devices after manufacture and hidden beneath the screen.