Ledger硬件钱包中被发现植入了复杂的硬件后门装置，导致约1.02亿美元的加密货币从约315个账户被盗1。这些后门存在于由授权经销商CryptoBilis在东南亚销售的设备、德国MediaMarkt电子连锁店销售的设备以及Ledger Flex和Stax等新款产品中1。
硬件黑客Joe Grand在2025年8月首次发现了第一个后门，并于3月4日向Ledger报告1。随后，Mark Karpelès在9月发现了更高级的后门版本，并在10月上旬将其公开发布1。植入物包含LTE模块、eSIM和天线等组件，用于窃取钱包的恢复密钥1。日本安全研究人员追踪发现，被盗数据被传输至香港阿里巴巴数据中心的服务器，截至6月至少有90个受感染设备向该服务器发送密钥短语1。
授权经销商CryptoBilis在3月被收购，但相关信息一直受到保密协议保护，直到10月中旬才被披露1。后门版本从基础设计逐步演进至定制化生产级设计，安全研究人员指出这表明"这不是业余爱好者的作品"1。竞争对手Trezor随后宣布大幅减少授权经销商名单，自2027年1月1日起移除部分经销商1。
Sophisticated hardware backdoors have been uncovered in Ledger cryptocurrency wallets, resulting in the theft of approximately $102 million in digital assets from around 315 accounts.1 The malicious implants were detected in devices sold through authorized distributor CryptoBilis in Southeast Asia, units distributed by German electronics retailer MediaMarkt, and subsequently identified in Ledger Flex and Stax models.1 The backdoor devices contained LTE modules, eSIM cards, and antennas designed to intercept and transmit recovery seed phrases to attackers.1
The discovery timeline reveals a significant gap between initial detection and public disclosure.1 Hardware security researcher Joe Grand first identified the backdoor in August 2025, formally notifying Ledger on March 4th, though the vulnerability remained undisclosed until recently.1 A more advanced iteration of the backdoor was later uncovered by Mark Karpelès, who published his findings online in early October.1 Japanese security researchers traced the stolen data transmissions to servers hosted at an Alibaba data center in Hong Kong, with at least 90 compromised devices documented sending key phrases to the Hong Kong infrastructure as of June.1 The evolution from a basic design to a sophisticated, production-level variant suggests this was "not amateur work."1
The incident has triggered scrutiny over supply chain security and Ledger's incident response protocols.1 CryptoBilis was quietly acquired in March, with acquisition details kept confidential under non-disclosure agreements until mid-October.1 In response to the breach, competitor Trezor announced a significant reduction in its list of authorized resellers, with certain distributors to be removed effective January 1, 2027.1
评论
还没有评论，欢迎留下第一条。