Ledger supply chain attack drains $4.8M from a scammer as South Korea moves to block 27 overseas crypto exchanges

Ledger’s reseller network in South East Asia was suspended this week after tampered devices in the supply chain were used to steal more than $103.4 million from 530 addresses. The ugly little twist: one of the affected users was a scammer, who lost 60 Bitcoin, worth about $4.8 million, to a device that reportedly recorded seed phrases.

1. According to Chainalysis, the scammer bought three new Ledgers that contained spyware designed to capture seed phrases. The attackers drained all three wallets into the same address, which made the loss easier to track on-chain and, for once, easier to explain.
2. Chainalysis said the scammer had been running a “task scam,” where people were paid to fake sales and reviews of real items. Victims were later shown a “negative balance” and told to add their own money in order to get paid. So yes, the person running the scam may also have been getting scammed by their own setup.
3. Ledger said all confirmed thefts to date are from Asia, despite reports of tampered Ledgers appearing in Europe and forcing MediaMarkt to suspend sales. The company asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to remove Ledgers from sale.
4. Trezor also said it will shut down some of its more distant resellers from Jan. 1 because it cannot maintain the same level of vigilance it applies closer to home. There are no reports of tampered Trezors.
5. In the middle of the hardware wallet mess, Ledger launched Atom, a $849 device that combines a crypto wallet with Android apps kept separate from sensitive wallet operations. Ledger says the device would block the implants used in the Asian thefts and can detect tampering even when switched off.

Separate from the hardware wallet story, South Korean authorities have approved measures to block domestic access to 27 websites operated by unregistered crypto exchanges and other virtual asset service providers, including KuCoin, MEXC, Phemex and Bitrue. The Financial Intelligence Unit said the blocking measures will now apply to internet websites as well as apps on Apple and Google.