Hardware Wallet Tampering: Europe's Retailer Pulls Ledger Devices Amid Spy Chip Claims
Key Summary
Europe's largest electronics retailer, MediaMarktSaturn, has removed Ledger hardware wallets from its shelves due to tampering reports, with the former Mt. Gox CEO claiming his device contained a spy chip. The company has not confirmed any funds were lost, but experts warn that tampering can still pose risks, including displaying a recovery phrase or installing harmful firmware.
Background
Europe's largest electronics retailer, MediaMarktSaturn, has removed Ledger hardware wallets from its shelves due to tampering reports.
Tampering Reports
The company took the precautionary measure after a user on X claimed that two Ledger wallets he bought at different MediaMarkt locations included unauthorized cables and cellular modules. Additionally, Mark Karpeles, former CEO of the now-defunct crypto exchange Mt. Gox, said his Ledger Flex, bought at Singapore's Changi Airport, also had a spy chip embedded in it.
Ledger Response
Ledger acknowledged receiving one tampering report from a customer in Germany, but said no funds were lost. The company has not clarified whether any tampered devices sold outside of CryptoBilis, a Ledger reseller based in Southeast Asia, resulted in stolen funds.
Risks of Tampering
An unauthorized cable or cellular module may not be able to extract the private key directly, but it can still pose risks. For example, a tampered device could display a recovery phrase the attacker already knows or install harmful firmware on the wallet. The recovery phrase is a series of words you can use to recreate the wallet on any compatible device, so if an attacker has it, they can gain full control of the wallet's funds.
Checks for Tampering
If you already own or are considering buying a hardware wallet, here are four checks you can do to make sure your device hasn't been tampered with. If your device fails any of these checks, treat it as compromised and contact the manufacturer's support team before using it. Buying from a reputable retailer can also help minimize the risk of tampering.
Conclusion
The incident highlights the importance of verifying the authenticity of hardware wallets and being cautious when purchasing from third-party resellers. While Ledger has not confirmed any funds were lost, the company's acknowledgment of a single tampering case does not address the status of other devices users haven't reported. As the crypto market continues to evolve, it is essential for users to stay informed and take necessary precautions to protect their assets.