Criminals steal an estimated $90M in crypto using tampered hardware wallets

A hardware wallet exists for one reason: to keep your crypto keys away from the internet. Someone apparently found a way around that promise before the box was even opened. Criminals stole $90 million of crypto by hiding password readers inside USB-like devices, according to the Financial Times. Estimates of the total damage run from $90 million to $93 million, drained from more than 300 user wallets. The devices involved were Ledger hardware wallets. They were sold through CryptoBilis, an authorized reseller operating in Southeast Asia. The attackers did not target the blockchain or the wallet software. They reportedly went after the physical hardware itself, somewhere between the factory and the customer. How the attack reportedly worked Unauthorized hardware implants were reportedly added to devices sold through CryptoBilis, and they were placed there before the wallets reached buyers. The implants reportedly contained microcontrollers, which are small, cheap computer chips. Their job was to capture sensitive information shown on the wallet’s screen during setup. The prize was the 24-word recovery phrase. When you initialize a hardware wallet, it generates this list of words as ...