Unchained - Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?

Episode Date: October 16, 2026

A hidden implant read Ledger seed phrases off the screen and sent them out over an eSIM. Mark Karpelès and SEAL 911's Jonty discuss what that means for self-custody. ======================================================== Thank you to our sponsor! Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients. Find out more at ⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠. Geo-restrictions, eligibility and terms apply. ======================================================== Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18. — Laura ======================================================== An estimated $100 million or more has been drained from Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. The devices carried a hidden implant that reads the seed phrase off the screen and sends it out over an eSIM. Jonty, founder of Pangolin Intelligence and a SEAL 911 contributor, and Mark Karpelès, CEO of Karpelès Lab, join Laura Shin to trace how the attack was found and how far it may reach. They cover drains dating back to September 8, a tampered Ledger Flex bought from Metapod at Singapore's airport, the two MediaMarkt devices a buyer in Europe traced to distributor Aqipa, and Tether's $10 million freeze. Mark argues Ledger's manual sends mixed signals by picturing the device's insides while warning that opening it voids the warranty, then opens a Nano X on camera to show what to look for. The open question is whether self-custody's best defense against malware has become its newest attack surface. Host: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained Guests: ⁠⁠⁠⁠⁠⁠⁠⁠⁠Mark Karpelès - CEO of Karpelès Lab Inc. ⁠⁠⁠⁠⁠⁠⁠⁠⁠Jonty - Founder of Pangolin Intelligence and Contributor to SEAL 911 Timestamps 🎬 00:00 Intro 🚨 03:50 How Jonty spotted the Ledger drains through SEAL 911 victim reports 📡 05:52 How the implant reads a 24-word seed phrase and sends it out by eSIM 🛫 11:33 Mark on the spy implant he found in a Ledger Flex bought in Singapore 🕵️ 15:16 CryptoBilis or a distributor? Mark and Jonty on who could be behind it 📣 17:38 Nexo: Generate daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt 🇪🇺 18:19 MediaMarkt and Aqipa: has the Ledger implant reached Europe? 🛒 27:00 Buying direct vs. through a reseller, and why Vietnam needs resellers 🔐 31:30 Ledger's 'tamper-proof' notice and whether self-custody is dead 🔧 36:45 Mark opens a Nano X on camera to show how to check for an implant 🧊 40:33 Tether's $10M freeze and why Jonty says recovery could take years Learn more about your ad choices. Visit megaphone.fm/adchoices

Typically, this kind of attacks, inserting implants into wallets, used to be very expensive. So it would be done on very specific targets. For example, you would create 10 or 20 spy units and then you would ship those two addresses you've got from a leak to people telling them, sorry, your information was leaked or the device you've got has an issue. Please use this one instead. And that's something that actually happened. The one thing that has changed is that this new implant is made for mass production and the ease of installation.

Let me say that we like going to see a lot more of it in the future. Hey everyone, just a quick note about today's episode. Shortly before we streamed, Ledger released two announcements that we didn't see until after the show, and so didn't get to discuss. One was an announcement by Ledger about the investigation into this incident. Their blog post said that a highly organized criminal group over months bought, quote, genuine ledger devices, opened them, fitted custom-built hidden components designed to capture the recovery phrase during setup, and put them back into distribution through resellers in Southeast Asia. Everything Mark and John T and I discussed in this episode is still relevant.

But notice Ledger only admits that the reseller issue existed in Southeast Asia, contradictory reports that devices bought in Europe also had issues. The Ledger blog post says, quote, we followed every lead, including sending teams to local markets, including Germany, to spot by and open a number of devices from stores. And we also examined samples from warehouses. Every unit examined was clean. So Ledger itself has not found corroborating evidence that devices being sold by resellers in Europe were also compromised, which you'll hear us discuss in the show.

After that post, the company then announced their new device, the Ledger Adam, which is being marketed as Quantum Ready, has a secure element chip, a privacy switch, AI agent features, and the ability to access Defi protocols. However, with the timing of the announcement, the tweet was getting ratioed hard with comments like, quote, whoever thought it's a good idea announcing a new product right after everything that took place recently needs to be fired ASAP. Although we didn't get to discuss this development, it'll be interesting to see what the reception is to this device going forward, given the awkward timing of the launch. Other than that, enjoy. the show.

Hi, everyone. Welcome to Unchained. You're an oh-hype resource for all things crypto. I'm your host, Laura Shin. Thanks for joining this live stream. First, we'll take a quick word from the sponsors who make this show possible. This episode is brought to you by Nexo, the premier digital assets wealth platform. Earned daily interest on your crypto or borrow funds, all through one platform trusted by more

than 10 million clients. Find out more at nexo.com. Geo restrictions, eligibility, and terms apply. Before we get started, I want to ask you for something. We're making a bunch of decisions right now about unchained. What we make next, when we go live, what we should be doing more of, and I'd rather hear from you before we make them than after. So we put together a survey. It takes just a few minutes. It's anonymous, and there's a box where you can tell me what we could be doing better. I read all the responses. The link is in the show notes, or you can snap the QR code on screen. or go to unchained crypto.com slash survey. Thanks. Today's topic is the leisure reseller hacks.

Here to discuss are Mark Carpalis, chief executive officer at Carpalus Labs, and John T, seal 911 contributor and founder of Panklin Intelligence. Welcome, Mark and John T. Hello, thank you. This past week, the crypto community has been stunned by a series of hacks that appears to have been months, if not a year or more, in the making. An estimated $100 million or more has been stolen from ledger hardware wallets purchased from a reseller in Southeast Asia known as Cryptobillis. John T, as far as I can tell you, were the first person to tweet about the hack, just as it started.

Tell us how you became aware of it. Yeah, hi, Laura. Yeah, thanks for having us. So, yeah, as you said, aside from my day job, I'm a contributor to a project called C-1991. If you don't know us, we're a group of about 25 vetted security research. who essentially operate a 24-7 free emergency hotline for anybody experiencing a crypto emergency to get some expert advice. So that's anything from big companies who've lost hundreds of millions of dollars all the way

to, I don't know, your granddad who's suffered a fishing attack or something. So naturally, as soon as the theft started coming through, people started reporting to C-0-9-1 saying, hey, my ledge has been drained. And when we get an influx of about five reports that say exactly the same thing, we start getting concerned. And my main role at CO911 and more generally my experience, I'm non-chain analysts. So I look at the blockchain data to try and work out what's happened. So I immediately started looking at these thefts and noticed that the inflows to the theft addresses were significantly larger than the amounts that were being reported as lost from the victims who reached out to C1191. what this tells me is that actually the scale of this thing is much larger than just the victims

that we're talking to. I've got, on my last count, over 100 million lost in this particular wave of instance. But at that point, we didn't know the exact cause of the losses. And the only way that we were going to really work that out was if we had more victims reporting to us so that we could start to look for patterns. So that's why I went on Twitter and posted the theft addresses and asked for people to reach out. And Mark, your company actually had a blog post about this type of attack, which was first seen a year ago, I guess, and has seen successive improved versions. Explain how the attack works. So the attack works by installing into the wallet ledger in this case, an extra module that will be looking at the screen as you set up your device initially.

And when you set up your device on the screen, it will be shown your seed phrase, which is basically the, the, password that is made to protect everything you're going to store on this wallet. The CITRA is made of 24 words. So as you see the words and write these on paper, the implant will also be watching, taking note of every single word. And as you reach the end, which is 24 words, the implant will be sending your password basically to the attacker using the mobile model that is included in the implant.

Yeah, yeah, it's so clever because, you know, Ledger, it's supposed to have this hardware component that is sort of impenetrable. But then they just attached something on there that, you know, bypasses that completely and it's just looking at the screen and then has a little E-Sim that just sends it out, you know, the way that any of, you know, of our information on our mobile phone gets sent. Cryptobillis was rather quickly identified as the reseller whose devices were being hacked. What do we know about Cryptobelis? And either one of you can respond. At this point, we don't have a lot of information. The first thing that came up to be known is that the founder of Cryptobelis had sold the company about six months prior. But we don't know at this point if this has a direct connection with this event or not.

What was clear, however, is that a lot of the victims had bought their wallet from Cryptobelis. Some people who had bought the web from two Cryptoblis also opened this and found an implant inside. Yeah, I guess more fundamentally than this, the reason that this attack is very scary is that Cryptobilis was an authorized reseller of ledger devices, i.e., it's one of the vendors that Ledger has approved to resell their hardware wallets. It was authorized across Indonesia, Malaysia, and the Philippines, so also multiple jurisdictions. and yeah, that's what makes this supply chain incident different from many other hardware wallet, fake versions of hardware wallets that we've seen in the past being sold. Yeah, I did want to ask so I know we can't know exactly for sure what happened, but I did see some people taking that fact that the company had been sold last spring.

And then the owner also said, quote, we were legally bound by contract confidentiality to hold off on public announcements until October 19th. So the timing of the hack and the relationship to that date is very interesting. But I did see some people making what could be a logical leap that potentially the new owners of Cryptobilis are implicated somehow. So I thought it was interesting. I saw Ledger announce that they had asked Cryptobillis to pause all sales and shipments of Ledger devices because there is a possibility that the crypto bill as owners are actually, you know, like somehow, yeah, potentially the source of the hack. I'm curious for your thoughts on that. Yeah. So I guess at this point, nothing is confirmed. So I don't want to accuse people of anything.

Certainly that timing is interesting. But I guess something else that is interesting that's come out, which might go against the argument that Cryptobillus is maybe the source of the compromise is that there are other authorised resellers of ledger devices in Southeast Asia who are known to have sold tampered devices and also this has resulted in in cryptocurrency being stolen. So this is an issue that's not just limited to Cryptobilis, but so far, to be clear, I'm not aware of any reports of ledgers being drained from outside of Southeast Asia. Okay. And wait, so I'm sorry, that was the other devices sold elsewhere. That was also

in this wave of hacks? So from the on-chain analysis, whilst there was obviously this wave that sort of caused all the stuff in the media and not to be aware of this incident, there was a large wave of attacks on October 9th. Through on-chain analysis, it actually looks as though that whoever is responsible for these hacks has drained cryptocurrency previously. So there is evidence of drains prior to October 9th. The earliest that I'm aware of is September 8th, so about a month prior. But these are much smaller in value. And this will be why it won't have, of course, the massive spotlight that we now have on crypto billets. And for September 8th, were those devices sold via crypto billis or from those other resellers that you?

mentioned in Southeast Asia. Other resellers based in Southeast Asia. This is now confirmed, but yeah, I want to be super clear that outside of what the letter is stated publicly, i.e. resellers in Southeast Asia, I'm not aware of any reports of crypto accounts who are being drained outside of that. Yeah, I mean, I did see some tweets where people named other resellers in Southeast Asia, but we'll talk about that later. I think Mark actually has himself looked at devices from other resellers in Southeast Asia.

Yes, I actually received one device that was purchased at the airport in Singapore from Metapod, which is also authorized the seller of ledger. And inside this device, there was also a spy implant that was configured two things information. So the authentication was a ledger flex, which is not the same as the nanox. It's a bit more of a complex device. and I was very surprised to see how advanced was the technology used to spy on the screen, basically. And was it the exact same as what's been used in this recent wave? It's not the exact same in the sense that it's a version that's fully customized for the Ledger Flex,

which is very different from the one we've seen on the leisure nanoX. But it's still the same kind of boards on the same process of the head. having three chips, one which is monitoring the screen and taking note of the passphrase, one that is communicating with the mobile network to send what has been captured, and an e-sim, which is basically a data contract to actually send the data online. And when you say it's quite sophisticated, like what was different about it? We've seen actually a number of versions of the implant. The very first version that was found was found late last year,

and was presented, I think in May or later this year, it's basically a board with some wires that connect to different point of the leisure. So it's very easy to see, it's very unnatural. And from that version, we've seen versions that have an orange flex board, which looks more professional, but it's still a lot of work to install. And the new version we're seeing have blackboards, And actually, for the nano X, the board will basically just fall into place. You just put it on the board, move a little bit, it just keeps.

And then you just have to put some point of soldier to install. And very clearly, the spy implant has been improved. And whoever is doing this is learning and making improvements are not just very small improvement, but very giant lips doing real research with a lot of funding to create those boards. The board I found into the ledger flex actually had some of the components built specifically for the ledger flex, which I've built myself some electronics and did some things. Among other things, the flex used a lot of very small connectors, which has known as Herose connectors. And they have mastered the building flex extenders that connect between the original ledger connector

on the board where it's supposed to go to take a copy of the signal going to the screen. So sensing for the process. They really have a lot of budget, I would say, because you don't build this without doing a lot of trial or error. You need a lot of test devices too.

And the technology that's behind this clearly is not something that just came from a few days with they spent months of research and development building this. Okay, yeah. that was the impression I got from your blog post because you had seen, you know, similar versions a year ago. I did want to ask just one last question about this. So, you know, we floated this theory that potentially the new owners of Cryptobillas could be the culprits, but also since other resellers have these compromised devices that potentially there could be another theory.

I was just wondering if you, either one of you could walk through what the universe of potential scenarios are in terms of who the culprits might be or how. this compromise was inserted into these devices? It's very difficult to say at this point. The timing of the purchase of Cryptobiles, of course, looks very suspicious. But generally, we like to consider that unless proven guilty, you're innocent. So I don't want to go too far in this direction. The question that remains is because we're seeing the same kind of implants in other resellers outside of Malaysia, like in Singapore, there is,

more to this story than we know today, I would guess that law enforcement is investigating. And I don't know if there's as much we can say at this point without, I mean, I would rather see what law enforcement comes with rather than trying to guess what could it be. Because there could be so many things. And yet, just guessing without evidence, we might not be any good for the investigation. I guess on a broad level, obviously, to get from the ledger factory to the shops in Singapore or Malaysia or wherever they're being sold, these devices have to pass through a number of hands. There's a supply chain there, a logistics chain, where these ledger devices essentially physically go from A to B. And that's what's going to need to be scrutinized is the hands that these devices have passed through evidently at some point in that process. somebody has, or a group of people who have tampered with the devices. Ultimately, I don't think

ledger supply chain is public, so it's not something that we're going to be able to know as private individuals looking at this attack from the outside. So, yeah, it's something I imagine ledger is actively scrutinizing, and I know law enforcement from various jurisdictions is definitely actively scrutinizing. All right. So in a moment, we'll talk about other jurisdictions where this hack may have spread, but first we'll take a quick word from the sponsors who make this show possible. What if your crypto could do more than just sit in your wallet? NXO is a digital assets wealth platform where you can generate daily interest on your crypto or borrow funds against your assets.

Today, NXO serves more than 10 million clients. Find out more at nexo.com. One more thing. We've got a listener survey open. It takes just a few minutes. It's anonymous and it changes what we make next. Use the QR code on screen or go to unchained crypto.com. slash survey. The link is in the show notes.

Back to my conversation with Mark and John T. On October 11th, a crypto user named Zero X Johannes tweeted, PSA, the ledger incident isn't limited to Asia. This is a device purchased in store from an official reseller in Europe. A legitimate device doesn't have any of these cables that can be seen in picture too. This even seems to be an old version of the spy implant, even though the device was purchased a couple weeks ago, the newer versions usually hide the implant by the screen so it's easier to miss. The next day, he tweeted, update, I can confirm that the ledger supply chain is compromised in Europe as well. I just purchased

a second device from a different media market location today, recorded the unboxing process, and discovered spyware once again. So do we have any sense of how widespread this issue is in Europe and have you logged any victims in Europe? I can certainly say on the victim side from victim reports that I'm aware of. I'm not aware of any devices that have been bought in Europe leading to a drain. So I can't corroborate that from the victim reports that I'm aware of. Okay. For the device itself, Zerikyrianis actually sent it to me and to leisure one of each devices.

And the one sent to me arrived today. So I already had a look inside and confirmed that it had a spy implant. I also confirmed that the way it was installed was slightly different to the things I've seen here. So I'm not sure if it's the same method of installation. It sure is the same implant. Meanwhile, a ledger has pulled all the sales of ledger in MediaMark and said, I believe today that they have verified all the inventory and said that nothing. was compromised.

So I don't know much at this point with those, we have those two devices that one person had bought from two different locations that have been compromised. So I don't know. I mean, we're liking a lot of information here. Okay. Well, so the second device that Johannes bought was not a return. And he tweeted, quote, store records show the infantry originated from Akipa, GMBH, while Ledger's CTO was unsure if Akipa serves as the direct distributor between

Ledger and Media Marked, it appears to be the case. Given that Akupa distributes across Europe, any physical retail store receiving stock through them may be at risk. And then he said, quote, Ledger should initiate an immediate product recall to protect users. Would you agree that that would be a good move for the company? That's probably very complex of a question right now. And why it would be a good idea to suspend sales, at least, for any store that gets their ledgers from Akipa, the main issue we have right now is that it's not easy to know if a device being sold on the shelf is compromised or not. You can verify very easily when you open it, but I don't think ledger has opened every single thing they had in stock

in media markets, that would be days of work to do this, and that would put all the inventory basically and sellable. So I don't know exactly the situation at this point. The fact is, as the end user, it's very easy to verify when you buy your ledger if it's compromised or not, especially if it's a nano-X, it can be open easily. When it's open, the implant is very obvious, at least for no. But the way it is right now, I don't think ledger wants,

to cause a panic and passage they probably don't want to say anything they haven't confirmed first. But I do still think that one person, even just one person finding one implant into a location when there was none, especially from an authorized reseller, is a very, very big issue. Oh, and I'm sorry, Media Mark is an authorized or unauthorized reseller? They are authorized. They are on the judge websites. Okay. I think it's fair to say that if Johannes's account can be corroborated by ledger, then obviously stopping the sales, but potentially recalling devices from Europe could be a prudent security measure.

But I imagine they have access to far more information than we do, and they don't want to act on information that they can't cooperate. So I imagine that's why they haven't done it yet. But really, without the information that they have access to, it's hard to answer the question. Okay. So I know we don't have all the information, but now that we do know, it's not just Cryptobilis, it's also Metapod in Southeast Asia. Now we have these ones in Europe. And obviously, I know Trezor is also taking some precautions. One key is stopping reselling through crypto billis. I'm curious, if you were to put a theory of kind of how, and even with Mark's blog

post from starting from a year ago, with the pieces that you know, what does it seem happen? Like somebody maybe came up with this way of perpetrating this hack and then tested it. That's my theory based on the blog post and then kind of executed it in a large sweep. But yeah, I'd love to hear you talk a little bit about what you think is in the realm of possibility. Typically, this kind of attacks inserting implants into wallets used to be very expensive. So it would be done on very specific targets. For example, you would create 10 or 20 spy units,

and then you would ship those to addresses you've got from a leak to people telling them, sorry, your information was leaked or the device you've got has an issue. Please use this one instead. And that's something that actually happened. The one thing that has changed is that this new implant is made for mass production and the ease of installation. Let me say that we're likely going to see a lot more of it in the future.

For what's happening right now, I wouldn't be able to say for sure if those two devices were just having a lot of luck in a way, finding the only two infected device in all of MediaMarked or if there are more devices. It's quite possible too that devices are being, not all the devices are being infected. Maybe they only did half of the stock or they only did some boxes. Or maybe they found a different way to inject implanted devices inside the stocks of MediaMark specifically. So it's very difficult to know at this point who is happening. But the one thing that I can say for now that it's easy to do is to verify if a device has been implanted or not. when you're going to use it for yourself. So there's no reason to panic at this point.

Just have a look and be safe about it. I was just going to give my point of view and I'll caveat. This is speculation. Given that we know whoever is responsible for this incident has also been responsible for devices being sold from multiple resellers leading to drains, I would speculate that potentially this is occurring at potentially a layer above,

the actual resellers themselves, maybe a distributor or something like that. But again, this is hard to know without ledgers input. Something that I do think swings in the favour of this not being incredibly widespread is actually the loss amount. Whilst $100 million is obviously a very substantial amount of money, I would have expected by now to see losses, like consider all losses from places outside Southeast Asia if this was massively more widespread. The fact that we haven't is good and I think a good sign that hopefully this is a contained issue. But yeah, we'll see in the coming days. And as Mark said, the best thing you can do right now is if you're really concerned, you can verify yourself. The one thing I would say, and I think Taylor has been saying this all week, but

definitely don't panic. Something that we are dealing with at C-1-911 and we deal with this a lot is when people panic, they tend to make silly mistakes and actually like this leads to them bringing themselves more risk than if they just did nothing, they might break their ledger in the process of opening it and not have access to the seed phrase, so lose their money, or try and transfer their assets to a fresh wallet and make a mistake in that process and lose access to the money. We do get reports of this kind of stuff happening. So whatever you do, do it carefully and with some due thought and attention. All right. So I do also want to ask, I've always heard that it's best to buy directly from the manufacturer. And so I actually hadn't realized just how extensive their authorized reseller lists were.

I don't think I realized just how common it was for people to buy from resellers. So I'm curious, even before this incident, was there some sort of hierarchy of security in terms of where you would purchase? Was it that buying from the manufacturer was the best? Authorized reseller was second. How did people think of that? Because It just was a surprise to me that people were trusting resellers. I think if you care purely about physical security, minimizing the number of hands that devices are passed through before they reach you is a sensible approach. So obviously buying directly from ledger in this case would be the best way to minimize that risk. But that may bring about other risks.

So there are legitimate reasons why somebody might want to buy from an authorized reseller. We've seen a lot in the past of various hardware wallet companies or logistics providers for those companies getting breached and that leaking data. Some people might want the option of purchasing a hardware wallet in person in a store with cash, so they don't have their personal data leaked on the internet. Another reason is even more basic than this, why authorise resellers are used in certain countries have tough laws on the import and export of hardware wallet or cryptographic devices. So on such jurisdiction is actually Vietnam. Vietnam, you have to have a license to be able to import cryptographic devices. So if devices are being shipped from France, as an individual buying that device is pretty tricky and you could get turned away at customs.

So that's why they're authorised resellers in those jurisdictions. I think it's a trade off, but purely on the physical security side, obviously buying directly from the producer is going to minimize that number of hands and decrease the risk of a supply chain compliance. Well, I don't know if you saw Leonidas, NFT, tweeted that ledger should end their authorized reseller program immediately. I'm curious. So I understand the trade-ups that you mentioned, but what do you think of that suggestion? Well, I would say that's probably too drastic. But there are steps that leisure can probably take to make sure that this kind of issues cannot happen or would be much more difficult to cause in the future. One thing, I don't know exactly how, for example, the handoff of crypto release happened,

if ledger was notified and if ledger vetted the new operators of the company, there are also a few things that leisure could be doing on their side that would make their product more safe to sell, such as temporary-revent packaging, so that if you know if your ledger has been opened before or not, while a lot of those missiles can be defeated in some ways, It's always a game of the cat-on-mouthed, basically, of trying to just move faster than the other. But for this thing, one thing I do things that Ledger could have been doing because it sounds like this is not a new issue. It's been discussed for at least six months.

Ledger could have maybe, what I would have seen a good idea, is to tell people that when buying a ledger from a sub-party, even as far as we sell, to maybe have a look inside and verify that the hardware is as shown into the manual that Leisure provides. Because Leisure actually provides in the manual of each device picture of the inside of the device, how things should be. But on the same page, Leisure also writes that opening your device will rule the warranty. So that's kind of why showing pictures of the inside if you say the same time the warranty is going to be void if you look inside? I think the fact that this has been known by ledger for a while should have at least triggered

a ledger to issue some generic guidance so that maybe some customers would look at their device. In the case of a reseller like Cryptobiles, which seems to have a lot of victims, some of the Cryptobiles customers, even if just one person out of 100, would have opened their ledger and found something, would have prompted other people to do the same, very likely reduced the total amount loss this time or this attack to be a lot sooner. Yeah, something that was interesting is Sebastian V. Sta. I'm actually not sure who this person says quantum physicist on their profile, but he tweeted that he remembered reading something about, you know, ledger advertising that there's no anti-tampering sticker in the box. And so we dug up

his old box and he photographed, you know, yeah, it came with a little notice saying, there is no anti-tampering sticker on this box. A cryptographic mechanism checks the integrity of your ledger devices internal software each time it is powered on. The secure element trip prevents any interception or physical replacement attempt. Ledger devices are engineered to be tamper-proof. So, yeah, it's kind of concerning that they were bragging about that and obviously it didn't matter. So now, considering that we saw this cold card hack that happened in August, now we're seeing this ledger one, I'm curious to hear your opinion on self-custody at the moment. Do you think it's dead? Do you think it's just temporarily unsafe? Do you feel like there's just new

best practices that people need to follow in order to be able to self-custody? What's your kind of philosophical take on the whole self-custody ethos and movement? Self-custody is here for a big reason is that people's computers get virus and get hacked. One thing, one term we use a lot in IT security is attack surface, which is basically what entry points there is into an IT system that would allow someone to get inside. And for a computer, you are connected to the internet, you browse data. open a number of websites all day. Typically, you will be plugging devices, USB keys, inside your computer. So all of these things are risk factors that cold wallet or hardware wallets are here

to alleviate. So by having your private key and performing the signature on a separate device which has a limited connectivity option, like for the only USB and Bluetooth, which basically limits the attack surface, you protect your cryptocurrency. You protect your cryptocurrency, from all those viruses or things that can infect your computer. And I believe that self-custody on cold wallets or hardware wallets has been successful and has reduced the crypto theft from virus enough for those criminal groups to move to find ways to attack those devices. And leisure having, I believe, the largest market share in terms of wallets out there

was probably the first targets, basically, where there was the most to gain. And that would make sense that Ledger was the first being attacked here. Certainly on the C-R-N-1-1 side, I can say that the losses from people using hot wallets, i.e. wallets where the keys to those wallets are held on a computer that's connected to the internet or a phone or something like this, that causes significantly more loss than we see from hardware wallets. So yeah, it's still the case that getting malware onto devices and that malware exfiltrating keys is a major issue. And I do think that hardware wallets have a place to solve that issue, although I would agree that we're going through a really tough spot at the moment.

And I think the security failings, not just in this instance with ledger, but the data breaches, the entropy issues across various different companies make this a really tough though. I know that there are other people. I know my friend Zach XPT has been arguing that people should use isolated iPhones essentially just to do transaction signing. That's one option. But personally, I'm still of the opinion that for a retail user that's maybe not super savvy, the best way forward if you want to self-custody. Of course, you don't have to. There are other options. You can entrust in exchange for your security or I know people are now advocating for buying things like ETS if you just want to buy the mainstream coins.

But I personally would advocate that hardware wallets are probably still the best solution for retail users that want to self-custody. Clearly, at least right now, I would definitely buy devices directly from the producers and don't rely on the reseller network. And if you do get devices delivered, get them delivered to an address that is not your own and I wouldn't use any personally identifying information in doing so. So I hope that these producers of hardware wallets do some serious threat modeling and reduce this attack service even further because clearly it's not up to scratch.

It's sad that we have to learn this in the way that we do, but I still think that's the way forward. Yeah, you can obviously mask your email address, like, you know, your iPhone will offer to do that for you. And then you can use, like, privacy.com, I think has like a credit, like a temporary credit card or something that you can use, you know, like if you manage ship pay in staples or whatever, then that could also be an option. But yeah, I think there's multiple ways to go about it. Mark, can you walk us through how anybody who currently owns a hardware device can check to make sure that their device is safe? Yes. I mean, at this point, the only devices that are

known to be affected are ledgers devices. So depending on which device you have, it can be more or less difficult. The ledger nanoX, the nanoS are the easiest to check. So if you have bought, for example, a nanoX, you can just open the box first. I'll go through the whole process. When you open it, you have your new wallet right here. And it's actually very easy to open because you just remove the metal pin here. And with a knife, you just be careful to not cut yourself. Up, let me be careful here. And you twist a little bit and it will open very easily.

And the easiest to hold it upside down so the buttons don't go everywhere. Unlike that, I can see the board of this fresh nano-X, which is clean. Generally, if you look under the screen, this is where you will find the most common. That's where basically the screen output here is all the implants existing today, we'll have to connect to the part right here. If you have nothing behind the screen, I... And actually, you show it a little bit more in the center of the camera? Yes.

It's being hidden by your name and stuff. Yeah, okay. But as long as behind the screen, you leave the screen, you have a number of dots here, which are known at test points. This is where the implant will try to pull data off. There's nothing here, as you can see. So this nanoX is cleaner. The remaining important part is how to bring this back into one piece.

The USB goes on the side of the black button. you just put this face down on this side. So as you can see, it's back like that. And the part on top just goes like this, and it's back into one piece. Okay. And Jonti, for people who do find that their device has been tampered with, what should they do? So I guess, again, to reiterate, don't panic and don't do anything absolutely rash that's going to bring yourself more problems.

But you need to treat the device as compromised and any assets that that device secures needs to be moved to a fresh secure wallet, either another hardware wallet that isn't compromised or if you're looking for temporary placed store assets, you can use a software wallet like Metamast, Phantom, all of those normal sorts of wallets. But yeah, shift the assets from the compromise ledger to the secure wallet and then you've mitigated the problem. If you do have a compromised device like that, please do reach out to C-1-911. We'd love to hear about it and see the device so that we can learn more exactly how this happened and what went down.

Even if you haven't lost assets, if you have lost assets, please report that to police in your local jurisdiction as a matter of urgency. That's the way that your case gets formally registered, I guess, and ultimately it's the police that has the legal authority to do anything about assets that have been lost. So please do that, but also reach out to C-9-1-1, and we can guide you through that whole thing for free. All right. So last couple of questions, it looks like Tether has frozen about $10 million in USCT. There's been 464Eth that has gone through tornado cash. Peck Shield traced a bit less than $4 million to Binance deposit addresses. What do you see as most likely to occur in terms of any recovery of funds?

Yeah, so fortunately because we were notified very, very, very, quickly at still number one, we were able to immediately trace the assets and work with both tether and law enforcement to enable that freeze. I would say if we, if as an industry, we had a better way of responding in these incidents such that we could secure those freezes more quickly. Actually, in this instance, we could have saved a lot of money, probably, you know, multiples of that 10 million, but it's great that we save that 10 million. There is other assets that have been frozen by other entities that have been used to launder these funds. But broadly speaking, asset recovery is an incredibly complex process.

And there's a few things that make this case even more complicated. Namely, this isn't a single hack of one entity that has lost all of their money. It's lots of individuals who are based all over the world who've lost assets. And that complicates things because all of those assets are commingled. And jurisdiction matters a lot with sort of legal cases. So it's not clear exactly which police force is responsible for seizing those assets. I imagine now that the assets are frozen, actually recovering those assets will be an effort that involves lawyers, prosecutors, international law enforcement, cooperation, potentially

interpol, stuff like this in order to exactly work out their process. And unfortunately, that's a process that takes months and years. So, yeah, I'm optimistic that I hope at least some assets can be recovered, but I doubt that will happen any time in the immediate future. And given the complications that you mentioned with the multiple jurisdictions and different types of law enforcement that need to be involved, do you think that there's good onset as case results in some form of justice, or do you think that's a long shot? I think in terms of justice, obviously attribution here, we don't really know who's involved.

And something that I think is going to help that process substantially is that, obviously there's quite a lot of physical evidence trails that have been left in terms of hardware that's been implanted that hardware is calling to places this is sort of both technical but also traditional like police work that can be done to try and identify exactly where these hardware implants were made ultimately until that work is done it's hard to say if these devices are being tampered with from a jurisdiction that may be law enforcement that has jurisdiction over these cases can't reach, then that's going to be really tricky. If these devices are being tampered with close to home in Southeast Asia,

then I think there's much more options available to the appropriate authorities to do something. But yeah, it's hard to estimate odds. I'll be cautiously optimistic. How about that? Okay. All right. Well, thank you both so much for illuminating what has really been a pretty disheartening incident to watch. So thank you both so much for sharing your insights with Unchained. Thank you for having us.

All right. Well, thanks for joining us, and we will catch you all next week. Bye now. Nothing you hear on Unchained is investment advice. This show is for informational and entertainment purposes only, and my guest and I may hold assets discussed on the show. For more disclosures, visit Unchained Crypto.com. Thank you.