A Brazilian safety researcher has warned others of the most recent counterfeit Ledger gadget rip-off aimed toward stealing customers’ crypto.
Posting as “Past_Computer2901” on the “ledgerwallet” Reddit channel on Thursday, the safety researcher mentioned they bought what they thought was a respectable Ledger gadget for private use, however quickly realized after it arrived that it was a complicated counterfeit aimed toward stealing person funds.
“This is not meant to trigger panic, however slightly to function a critical warning — I’m truthfully nonetheless a bit shaken by the sheer scale of this operation,” they mentioned.
Scammers are adopting more and more refined methods to focus on customers choosing self-custody, from provide chain assaults to social engineering and approval scams.
Earlier this month, greater than 50 victims have been tricked into revealing their seed phrases on a pretend Ledger Stay app that made its solution to the Apple App Retailer by way of a bait-and-switch technique. The victims misplaced a mixed $9.5 million earlier than Apple took down the malicious app.
How the counterfeit Ledger gadget rip-off works
The researcher mentioned he purchased the Ledger Nano S Plus from a Chinese language market, which was priced the identical because the official Ledger retailer. The packaging and the itemizing additionally appeared respectable at first.
Nevertheless, after they linked the gadget to the real Ledger Stay app — which was fortunately already put in on their laptop — it failed Ledger’s built-in “Real Examine.”
This prompted them to drag aside the gadget, discovering modified {hardware} and firmware designed to seize and expose delicate pockets knowledge.
The safety researcher mentioned the scammers goal first-time Ledger customers, because the QR code that comes within the field would usually direct customers to obtain a malicious model of the Ledger Stay app that might present a pretend “Real Examine.”
Customers persevering with to observe the prompts will ultimately enable scammers to acquire a person’s seed phrases and drain funds at any time.
“Keep protected on the market. Solely obtain Ledger Stay from ledger.com. Solely purchase {hardware} from ledger.com,” the safety researcher mentioned.
“In case your gadget fails the Real Examine — cease utilizing it instantly.”
After pulling aside the gadget, they found clear indicators of tampering, together with scraped chip markings and a WiFi and Bluetooth antenna embedded contained in the unit.
Authentic Ledger {hardware} merchandise are designed to maintain non-public keys absolutely offline.
Associated: Musician loses $420K Bitcoin ‘retirement fund’ by way of pretend Ledger app
The safety researcher then seemed into the firmware, placing the “chip into boot mode,” which initially recognized the gadget as a Nano S Plus 7704 with an connected serial quantity.
Nevertheless, as soon as the boot sequence accomplished, one other producer’s title confirmed up: Espressif Methods, a publicly listed Chinese language semiconductor firm primarily based in Shanghai.
Cointelegraph reached out to Espressif for remark however didn’t obtain a direct response.
Journal: What’s a ‘Community State’ and are there real-life examples? Massive Questions
