Compromised Before the Box Was Opened

Yesterday we looked back over the last year and touched on the cold storage exploits that have hit the industry. Unfortunately, the weekend delivered another one. This time Ledger is at the centre of it.

What Happened

Users in South East Asia who bought Ledger devices through an authorised reseller, CryptoBilis, have reported their wallets being drained. On-chain investigators estimate more than $86m USD has been stolen from hundreds of wallets across Bitcoin, Ethereum and TRON.

Ledger has confirmed that at least one compromised unit contained an unauthorised hardware implant, a physical modification made to the device before it reached the customer. This was not a flaw in Ledger’s firmware and not a breach of its network. The device was tampered with somewhere in the supply chain.

Ledger has asked the reseller to pause all sales and shipments. Anyone who bought from that reseller in the last 90 days has been told not to set up their device, and anyone who already has should move their funds to a new device with a new seed phrase.

Bitcoin had a brief sell off as the news broke, before steadying.

Two Exploits, Two Different Weak Points

This follows the Coldcard exploit, where more than $115m was lost. The causes could not be more different.

Coldcard was a software problem. A bug in the device’s firmware produced weak seed phrases that attackers could work out.

Ledger was a physical problem. The device itself was altered before it ever reached its owner.

One failure was inside the device’s code. The other was in the journey from the factory to the customer. Between them, more than $200m is gone.

The Threat You Can’t See

Most security advice is aimed at the user. Don’t share your seed. Don’t click suspicious links. Don’t store your recovery phrase in the cloud.

The two largest hardware wallet losses of this year had nothing to do with any of that. The damage was done before the owner pressed a single button.

These buyers went to an authorised reseller and bought a device from one of the most trusted brands in the industry. From the outside, it looked exactly like the real thing. There was nothing to warn them.

You can master seed storage and firmware updates, but you can’t audit a circuit board. Your security depends on every set of hands the device passed through before it reached you.

Some Harsh Truths

Self custody is not for the average person. That isn’t a popular thing to say in this industry, but it’s true.

It is an option for everyone. It is not an option everyone is ready to explore.

Be honest with yourself. Would you know if your device had been opened and resealed? Would you know what the inside of a genuine one is supposed to look like? Would you know if its firmware was generating weak seed phrases? The victims of both exploits this year didn’t, and most people wouldn’t either.

Being ready is more than knowing how to write down 24 words. It means understanding the risks you can see and accepting the ones you can’t. For most holders, it’s the ones they can’t see that end up costing them.

Choosing not to self custody isn’t a failure, and it isn’t turning your back on what Bitcoin stands for. Knowing which risks you are equipped to manage, and which you aren’t, is part of managing your wealth properly.

If this raises any concerns about how your Bitcoin is held, we would encourage you to discuss custody with your dedicated Stormrake broker and learn more about Stormrake Custody.

---

Stormrake Spotlight: Lighter (LIT) ($3.48)

Source: https://www.tradingview.com/x/o6vIkpPX/

LIT is down nearly 10% over the last day as altcoins bear the brunt of Bitcoin’s retracement. After failing to break above key resistance, LIT has fallen back to major support. If that support fails to hold, the bears take full control and we can expect a move lower.

---

BTC/USD Key Levels and Price Action:

Source: https://www.tradingview.com/x/tX7YSL77/

Bitcoin has lost key support at $83k, flipping it into resistance as the bears mount pressure. We have now seen the first rejection at this level, and the moving averages sit right alongside it, adding further resistance. If this continues, we can expect BTC to revisit key support at $80.6k, last tested on Friday morning.

---

*All prices are denominated in USD unless stated otherwise*

---

Written by Alexandar Artis