Before the sweep

An extra circuit board. An antenna. An LTE module and an eSIM. That is what hardware hacker Joe Grand found inside a Ledger Nano X after its owner, who had bought it from an online marketplace in Thailand, cracked the case and sent it to him. As Kim Zetter reports at Zero Day, the implant did nothing until the owner set the wallet up. Then it copied the recovery phrase character by character as the device drew it on its own screen, and sent it out through the nearest cell tower.

Grand reported the implant to Ledger on March 4. Months later, when he followed up, someone at Ledger told him the company had found no evidence the implants had been used to steal crypto. Last week they were. A coordinated sweep took about $102 million from roughly 315 accounts tied to wallets sold by CryptoBilis, an authorized Ledger reseller in Malaysia.

Ledger's answer was accurate, and it measured the wrong thing. An implant that harvests seeds and waits produces no thefts right up until the day it produces all of them, and the attacker picks the day. For that kind of attack, a theft count of zero is not reassurance. It is the expected reading. The signal was the harvest, and the harvest could be measured.

It was being measured. A researcher in Japan bought ten Nano X wallets from unauthorized sellers and found implants in all ten, in five different designs. He traced their transmissions to servers in a Hong Kong data center and determined that in June at least 90 implanted devices were sending seed phrases there. In September, Mark Karpelès opened a wallet that had arrived shrink-wrapped from Malaysia and found a flexible circuit colored to match Ledger's own board, with a part number, AC-A2016-NANO-V1.1, silk-screened onto its antenna. His reading of that label:

All of that arrived before the sweep, and the order matters because of what a leaked seed costs to fix. Before the sweep, the owner generates a new seed on a device they trust and moves the funds: an afternoon and some network fees. After the sweep there is nothing left to fix.

Zetter notes the attackers may have been waiting to accumulate wallets with large balances, and that Karpelès's posts on October 8 may have hurried them; news of the heists broke the next day. Either way, the thieves chose the date. The only thing the defenders controlled was how much warning owners got before it.

A warning about a seed-stealing implant is worth everything before the sweep and nothing after it.

The fair defense of Ledger is that its standing advice covered the March evidence. Grand's implants all turned up in wallets from fly-by-night online sellers, and Ledger and Trezor have told customers for years to buy only from them or from authorized resellers. A company can't recall wallets it never sold. That's true, and it misses twice. Advice about where to buy protects the next customer. It does nothing for the people who had already bought and set up their wallets, whose seeds were already sitting on a server. And by October the advice itself had stopped holding. CryptoBilis was authorized, and a buyer in Germany has since found implants in two Nano X units from two MediaMarkt stores, a chain Ledger lists as an authorized reseller in four countries.

The implant was built to keep the theft count at zero until the people who planted it decided otherwise. A zero the attack produces is not evidence against the attack. It is the attack, working.