{"id":21286,"date":"2026-10-13T12:09:51","date_gmt":"2026-10-13T12:09:51","guid":{"rendered":"https:\/\/news.theck1.no\/?p=21286"},"modified":"2026-10-13T12:09:51","modified_gmt":"2026-10-13T12:09:51","slug":"store-bought-hardware-crypto-wallets-had-secret-chips-installed-that-enabled-stealing-crypto-recovery-phrases","status":"publish","type":"post","link":"https:\/\/news.theck1.no\/?p=21286","title":{"rendered":"Store-bought hardware crypto wallets had secret chips installed that enabled stealing crypto recovery phrases"},"content":{"rendered":"

AI-rewritten:<\/strong> This is a summary of an article from Tom’s Hardware, rewritten by AI (Qwen, running locally) to make it easier to read. The facts come from the original article – read it for the full story.<\/p>\n

Tom’s Hardware • Bruno Ferreira • October 13, 2026<\/strong><\/div>\n\n

Cryptocurrency users are warned that some hardware wallets sold by resellers in Southeast Asia and Europe contain secret chips designed to steal recovery phrases. At least $93 million has reportedly been stolen from affected balances so far, though wallets sold directly by Ledger remain unaffected. The investigation points to a Malaysian reseller named Cryptobilis, which has stopped selling all brands of hardware wallets. Researcher Mark Karpel\u00e8s found that these devices often include eSIM and LTE modules to transmit data.<\/p>\n

<\/p>\n

The theft mechanism involves hiding a flexible printed circuit board under the display to capture images of the private key entered during initial setup. This data is then sent via the hidden communication modules. Ledger advises anyone who bought from Cryptobilis in the last 90 days not to perform their first setup, as that is when the exfiltration occurs. For those who have already set up, the company recommends moving assets to a new wallet with a fresh seed.<\/p>\n

Similar hacked units were found in Germany at MediaMarkt by Johannes, who discovered identical modifications on multiple brand-new devices. Stock records linked one unit to Aqipa GmbH, a European distributor, suggesting the issue may extend beyond Asia. While earlier hacks used hand-made implants, recent findings show manufactured bolt-ons, indicating a potential production line intercepting and modifying wallets in bulk. Ledger is publishing guides for users to verify physical integrity by inspecting components and downloading software only from official sources.<\/p>\n

\n

Source:<\/strong> Tom’s Hardware • Bruno Ferreira • October 13, 2026<\/p>\n

Read the original article at Tom’s Hardware →<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

AI-rewritten: This is a summary of an article from Tom’s Hardware, rewritten by AI (Qwen, running locally) to make it easier to read. The facts come from the original article – read it for the full story. Tom’s Hardware • Bruno Ferreira • October 13, 2026 Cryptocurrency users are warned that some hardware wallets sold<\/p>\n

READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-21286","post","type-post","status-publish","format-standard","hentry","category-it-hardware"],"_links":{"self":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/posts\/21286","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=21286"}],"version-history":[{"count":0,"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/posts\/21286\/revisions"}],"wp:attachment":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21286"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21286"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}