Show Notes
A hidden implant read Ledger seed phrases off the screen and sent them out over an eSIM. Mark Karpelès and SEAL 911's Jonty discuss what that means for self-custody.
========================================================
Thank you to our sponsor!
Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.
Find out more at https://unchainedcrypto.com/go/nexo-podcast-sn.
Geo-restrictions, eligibility and terms apply.
========================================================
Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for. Our listener survey takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.
— Laura
========================================================
An estimated $100 million or more has been drained from Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. The devices carried a hidden implant that reads the seed phrase off the screen and sends it out over an eSIM.
Jonty, founder of Pangolin Intelligence and a SEAL 911 contributor, and Mark Karpelès, CEO of Karpelès Lab, join Laura Shin to trace how the attack was found and how far it may reach.
They cover drains dating back to September 8, a tampered Ledger Flex bought from Metapod at Singapore's airport, the two MediaMarkt devices a buyer in Europe traced to distributor Aqipa, and Tether's $10 million freeze.
Mark argues Ledger's manual sends mixed signals by picturing the device's insides while warning that opening it voids the warranty, then opens a Nano X on camera to show what to look for.
The open question is whether self-custody's best defense against malware has become its newest attack surface.
Host:
Laura Shin, Host / Unchained
Guests:
Mark Karpelès - CEO of Karpelès Lab Inc.
Jonty - Founder of Pangolin Intelligence and Contributor to SEAL 911
Timestamps
🎬 00:00 Intro
🚨 03:50 How Jonty spotted the Ledger drains through SEAL 911 victim reports
📡 05:52 How the implant reads a 24-word seed phrase and sends it out by eSIM
🛫 11:33 Mark on the spy implant he found in a Ledger Flex bought in Singapore
🕵️ 15:16 CryptoBilis or a distributor? Mark and Jonty on who could be behind it
📣 17:38 Nexo: Generate daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt
🇪🇺 18:19 MediaMarkt and Aqipa: has the Ledger implant reached Europe?
🛒 27:00 Buying direct vs. through a reseller, and why Vietnam needs resellers
🔐 31:30 Ledger's 'tamper-proof' notice and whether self-custody is dead
🔧 36:45 Mark opens a Nano X on camera to show how to check for an implant
🧊 40:33 Tether's $10M freeze and why Jonty says recovery could take years Learn more about your ad choices. Visit megaphone.fm/adchoices
More from Unchained
Traders tried to lose money fast to earn PAPER. Now the token may never be transferable, and one tracker shows staking revenue fell 93% in a day.
A certificate authority's private key was the number 4 for over a year. Kain, Taylor, and Austin on why the internet's trust schemes are cracking.
Justin Drake says crypto should brace for AI breaking elliptic curves before Q-Day. Project Eleven's Alex Pruden and Conor Deegan weigh in on what's actually at risk.
A Ledger reseller's devices shipped with a hidden LTE modem inside. Taylor Monahan lays out how it passed the genuine check and why panicking now costs more.
The boys regroup after TOKEN2049. Ledgers sold through CryptoBilis, an authorized reseller in Malaysia, came with an LTE implant that read seed phrases off the screen, an OpenAI engineer was caught with a listening device, Papertrade launches 1000x perps where losing money mints you tokens, and the hosts argue over Nikita Bier's claim that technical moats are dead.