How a Spy Implant Turned Ledger's Authorized Resellers Into an Attack Vector

Transcript

Typically, this kind of attacks, inserting implants into wallets, used to be very expensive. So, it would be done on very specific targets. For example, you would create 10 or 20 spy units and then you would ship those to addresses you've got from a leak to people telling them, "We're sorry, your information was leaked or the device you've got has an issue. Please use this one instead." And that's something that actually happened. The one thing that has changed is that this new implant is made for mass production and ease of installation. Let me say that we're likely going to see a lot more of it in the future. [music] Hey everyone, just a quick note about

today's episode. Shortly before we streamed, Ledger released two [music] announcements that we didn't see until after the show and so didn't get to discuss. One was an announcement by Ledger about the investigation into this incident. Their blog post said that a highly organized criminal group over months bought quote genuine ledger devices, opened them, fitted customuilt hidden components designed to capture the recovery phrase during setup and put them back into distribution through resellers in Southeast Asia. Everything Mark and Jont and I discussed in this episode is still relevant. But notice Ledger only admits that the reseller issue existed in Southeast Asia, contradicting reports that devices bought in Europe also had issues. The Ledger [music] blog post says, quote,

"We followed every lead, including sending teams to local [music] markets, including Germany, to spot, buy, and open a number of devices from stores, and we also examined samples from warehouses. Every unit examined was clean. So, Ledger itself has not found corroborating evidence that devices being sold by resellers in Europe were also compromised, which you'll hear us discuss in the show." After that post, the company then announced their new device, the Ledger Atom, which is being marketed as quantum ready, has a secure element chip, a privacy switch, AI agent features, and the ability to access DeFi protocols. However, with the timing of the announcement, the tweet was getting ratioed hard with comments like quote, "Whoever thought it's a good idea

announcing a new product right after everything that took place recently needs to be fired ASAP." Although we didn't get to discuss this development, it'll be interesting to see what the reception is to this device going forward given the awkward timing of the launch. Other than that, enjoy the [music] show. Hi everyone, welcome to Unchained, [music] your nohigh resource for all things crypto. I'm your host Laura Shin. Thanks for joining this live stream. First, we'll take a quick word from the sponsors who make the show possible.

This episode is brought to you by Nexo, the premier digital assets wealth platform. Earn daily interest on your crypto or borrow funds all through one platform trusted by more than 10 million clients. Find out more at nexo.com. GEO restrictions to eligibility and terms apply. Before we get started, I want to ask you for something. We're making a bunch of decisions right now about Unchained. what we make next, when we go live, what we should be doing more of, and I'd rather hear from you before we make them than [music] after. So, we put together a survey. It takes just a few minutes. It's anonymous, and there's a box where you can tell me what we could be doing better. I read all the responses. The link is in the show notes, or you can snap the QR code on screen or go to unchained crypto.com/servey.

Thanks. Today's topic is the leisure reseller hacks. Here to discuss are Mark Carpoolis, chief executive officer at Carpoolus Labs and John T, Seal 911 contributor and founder of Penglin Intelligence. Welcome Mark and John T. >> Hello. >> This past week, the crypto community has been stunned by a series of hacks that appears to have been months, if not a year or more, in the making. An estimated $100 million or more has been stolen from Ledger hardware wallets purchased from a reseller in Southeast Asia known as CryptoBillis. John T, as far as I can tell, you were the first person to tweet about the hack just as it started. Tell us how you became aware

of it. >> Yeah, hi Laura. Yeah, thanks for having us. So, yeah, as you said, aside from my day job, I'm a contributor to a project called Seal 911. If you don't know us, we're a group of about 25 vetted security researchers who essentially operate a 247 free emergency hotline for anybody experiencing a crypto emergency to get some expert advice. So that's anything from big companies who've lost hundreds of millions of dollars all the way to, I don't know, your granddad who's suffered a fishing attack or something. So naturally, as soon as the theft started coming through, people started reporting to seal 911 saying, "Hey, my ledge has been drained." And

you know, when we get an influx of about five reports that say exactly the same thing, we start getting concerned. And my main role at C911 and more generally my experience, I'm non-chain analysts, so I look at the blockchain data to try and work out what's happened. So I immediately started looking at these thefts and noticed that the inflows to the theft addresses were significantly larger than the amounts that were being reported as lost from the victims who reached out to see 911. What this tells me is that actually the scale of this thing is much larger than just the victims that we're talking to. I've got by my last count over 100 million lost in this particular wave of instance. But

at that point, we didn't know the exact cause of the losses. The only way that we were going to really work that out was if we had more victims reporting to us so that we could start to look for patterns. So that's why I went on Twitter and posted the theft addresses and asked for people to reach out. >> And Mark, your company actually had a blog post about this type of attack which was first seen a year ago, I guess, and has seen successive improved versions. explain how the attack works. >> So the attack works by installing into the wallet ledger in this case an extra module that will be looking at the screen as you set up your device initially. And when you set up your

device on the screen will be shown your seed phrase which is basically the password that is going to protect everything you're going to store on this wallet. The seat is made of 24 words. So as you see the words and write these on paper the implant will also be watching taking note of every single word and as you reach the end which is 24 words the implant will be sending your password basically to the attacker using the mobile model that is included in the implant.

>> Yeah. Yeah. It's so clever because, you know, Ledger, it's supposed to have this hardware component that is sort of impenetrable, but then they just attached something on there that, you know, bypasses that completely and it's just looking at the screen and then has a little eim that just sends it out, you know, the way that any of, you know, of our information on our mobile phone gets sent. Cryptobillis was rather quickly identified as the reseller whose devices were being hacked. What do we know about cryptobillis? >> And either one of you can respond.

>> I this point we don't have a lot of information. The first thing that came up to be known is that the founder of Cryptobillis had sold the company about 6 months prior, but we don't know at this point if this has a direct connection with this event or not. What was clear however is that a lot of the victims had bought their wallet from cryptobillis. Some people who had bought the from crypto also open these and found an implant inside.

>> Yeah, I guess I guess more fundamentally than this the reason that this attack is very scary is that cryptobillis was an authorized reseller of Ledger devices. I.e. It's one of the vendors that Ledger has approved to resell their hardware wallets. It was authorized across Indonesia, Malaysia, and the Philippines. So, also multiple jurisdictions. And yeah, that's what makes this supply chain incident different from many other hardware wallet fake versions of hardware wallets that we've seen in the past being sold.

Yeah, I did want to ask. So, I know we can't know exactly for sure what happened, but I did see some people taking that fact that the company had been sold last spring. And then the owner also said, quote, "We were legally bound by contract confidentiality to hold off on public announcements until October 19th." So, the timing of the hack and the relationship to that date is very interesting. But I did see some people making what could be a logical leap that potentially the new owners of Cryptobillis are implicated somehow. So I thought it was interesting. I saw

Ledger announce that they had asked Cryptobillis to pause all sales and shipments of Ledger devices because there is a possibility that the Cryptobillis owners are actually you know >> like somehow yeah potentially the source of the hack. I I'm curious for your thoughts on that. >> Yeah. So I guess at this point nothing is confirmed. So I I don't want to you know accuse people of anything. Certainly that timing is interesting. But I guess something else that is interesting that's that's come out which might go against the the argument that that Cryptobillis is is maybe the source of the compromise is that there are

other authorized resellers of ledger devices in Southeast Asia who are known to have sold tampered devices and also this has resulted in in in cryptocurrency being stolen. So this is an issue that's not just limited to crypto billis but so far to be clear I'm not aware of any reports of ledgers being drained from outside of Southeast Asia. >> Okay. And wait so I'm sorry that was the other devices sold elsewhere that was also in this wave of hacks. >> So from the onchain analysis whilst there was obviously this wave that sort of caused all the stuff in the media and us to be aware of this incident. There

was a large wave of attacks on October 9th. Through onchain analysis, it actually looks as though that whoever is responsible for these hacks has drained cryptocurrency previously. So there is evidence of drains prior to October 9th. The earliest that I'm aware of is September 8th, so about a month prior, but these are much smaller in value. And this will be why it won't have caused the massive spotlight that we now have on crypto billets. And for September 8th, were those devices sold via Cryptobillis or from those other resellers that you mentioned in Southeast Asia?

>> Other resellers based in Southeast Asia. This is now confirmed, but yeah, I want to be super clear that outside of what Ledger has stated publicly, i.e. resellers in Southeast Asia. I'm not aware of any reports of cryptocurrency being traded outside of that. Yeah, I mean I did see some tweets where people named other resellers in Southeast Asia, but we'll talk about that later. >> I think Mark actually has himself looked at devices from other resellers in Southeast Asia. >> Yes, I actually received one device that was purchased at the airport in Singapore from Metapod, which is also authorized reseller of Ledger.

And inside this device there was also a spy implant that was configured to take the information. So the restation was a ledger flex which is not the same as the nano X. It's a bit more of a complex device and I was very surprised to see how advanced was the technology used to spy on the screen basically. >> And was it the exact same as what's been used in this recent wave? It's not the exact same in the sense that it's a version that's fully customized for the Ledger Flex, which is very different from the one we've seen on the Leisure Nano X, but it's still the same kind of boards on the same process of having

three chips. one which is monitoring the screen and taking note of the passphrase. One that is communicating with the mobile network to send what has been captured and an EIM which is basically a data contract to actually send the data online >> and when you say it's quite sophisticated like what was different about it? >> We've seen actually a number of versions of the implant. The very first version that was found was found late last year and was presented I think in May or late April this year. It's basically a board with some wires that connect to different point of the ledger. So it's very easy to see. It's very unnatural.

And from that version we've seen versions that have an orange flex board which looks more professional but it's still a lot of work to install. Um the new version we're seeing have black boards and actually for the Nano X the board will basically just fall into place. If you just put it on the board, move it a bit, it just clips. And then you just have to put some point of solder to it. And very clearly the spy implant has been improved. And whoever is doing this is learning and making improvements and not just very small improvement, but very giant leaps doing real research with a lot of funding to create those boards. And the board I

found into the Ledger Flex actually had some of the components built specifically for the Ledger Flex which I've built myself some electronics and did some things among other things. The flex use a lot of very small connectors which is known as heros connectors and they have mastered building flex extenders that connect between the original ledger connector and the board where it's supposed to go to take a copy of the signal going to the screen and so sensing for the process they've already have a lot of budget I would say because you don't build this without doing a lot of trial and error we need you need a

lot of test devices too. And the the technology that behind this clearly is not something that just came from a few days with they spent months of research and development building this. >> Okay. Yeah, that was the impression I got from your blog post because you had seen, you know, similar versions a year ago. I did want to ask just one last question about this. So, you know, we floated this theory that potentially the new owners of CryptoBillis could be the culprits, but also since other resellers have these compromised devices that potentially there could be another theory. I was just wondering if you either one of you could walk through what the universe of potential scenarios

are in terms of who the culprits might be or how this compromise was inserted into these devices. It's very difficult to say at this point. The timing of the purchase of crypto of course looks very suspicious but generally we like to consider that unless proven guilty you're innocent. So I don't want to go too far in this direction. The question that remains is because we're seeing the same kind of implants in other resellers outside of Malaysia like in Singapore.

There is more to this story than we know today. I would guess that law enforcement is investigating and I don't know if there's much we can say at this point without I mean I would rather see what law enforcement comes with rather than trying to guess what could it be because there could be so many things and yet just guessing without evidence we might not be any good for the investigation. I guess on a broad level obviously to get from the ledger factory to the shops in Singapore or Malaysia or wherever they're being sold, these devices have to pass through a number of hands. Like there's a supply chain there, a

logistics chain where these ledger devices essentially physically go from A to B. And that's what's going to need to be scrutinized is the hands that these devices have passed through. Evidently, at some point in that process, somebody has or a group of people have tampered with the devices. Ultimately, I don't think Ledger supply chain is public. So, it's not something that we're going to be able to know as private individuals looking at this attack from the outside. So, yeah, it's something I imagine Ledger is actively scrutinizing and I know law enforcement from various jurisdictions is definitely actively scrutinizing. All right, so in a moment we'll talk about other jurisdictions where this hack may have spread, but first we'll take a quick word from the

sponsors who make the show possible. What if your crypto could do more than just sit in your wallet? Nexo is a digital assets wealth platform where you can generate daily interest on your crypto or borrow funds against your assets. Today, Nexo serves more than 10 million clients. Find out more at nexo.com. One more thing, we've got a listener survey open. It takes just a few minutes. It's anonymous [music] and it changes what we make next. Use the QR code on screen or go to unchanged crypto.com/servey.

The link is in the show notes. Back to my conversation with Mark and Jant. On October 11th, a crypto user named 0x Yannes tweeted, "PSa, the Ledger incident isn't limited to Asia. This is a device purchased in store from an official reseller in Europe. A legitimate device doesn't have any of these cables as can be seen in picture two. This even seems to be an old version of the spy implant even though the device was purchased a couple weeks ago. The newer versions usually hide the implant by the screen so it's easier to miss. The next day he tweeted, "Update.

I can confirm that the Ledger supply chain is compromised in Europe as well. I just purchased a second device from a different media market location today, recorded the unboxing process and discovered spyware once again. So, do we have any sense of how widespread this issue is in Europe? And have you logged any victims in Europe? I can certainly say on the victim side from victim reports that I'm aware of I'm not aware of any devices that being bought in Europe leading to a drain. So I can't corroborate that from the victim reports that I'm aware of.

>> Okay. For the device itself actually sent it to me and to ledger one of each devices and the one sent to me arrived today. So, I already had a look inside and confirmed that it had a spy implant. I also confirmed that the way it was installed was slightly different to the one things I've seen here. So, I'm not sure if it's the same method of installation. It's surely the same implant. Meanwhile, Ledger has pulled all the sales of ledger in media mark and said I believe today that they verified all the inventory and say that nothing was compromised.

So I don't know much at this point with those we have those two devices that burn personnel bought from two different locations that have been compromised. So I don't know. I mean we're lacking a lot of information here. >> Okay. Well, so the second device that Johannes bought was not a return and he tweeted, quote, "Store records show the inventory originated from a Akipa GmbH." While Ledger's CTO was unsure if Akipa serves as the direct distributor between Ledger and Media, it appears to be the case. Given that Akipa distributes across Europe, any physical retail store receiving stock through them may be at

risk. And then he said, quote, "Ledger should initiate an immediate product recall to protect users." Would you agree that that would be a good move for the company? >> That's probably very complex of a question right now. And why it would be a good idea to suspend sales at least for any store that gets their ledgers from Akipa once. I mean the main issue we have right now is that it's not easy to know if a device being sold on the shelves is compromised or not. You can verify very easily when you open it but I don't think Ledger has opened every single thing they had in stock in Med

that would be days of work to do this and that would put all the inventory basically unsellable. So I don't know exactly the situation at this point. The fact is as the end user it's very easy to verify when you buy a ledger if it's compromised or not especially if it's a nano X it can be opened easily what it's open the impl is very obvious at least for now but the way it is right now I don't think Ledger wants to cause a panic and as such they probably don't want to say anything they haven't confirmed first but I do still think that one person even just one person finding one implant into a location when there was none, especially from an

authorized reseller is a very very big issue. >> Oh, wait. And I'm sorry. Media marked is an authorized or unauthorized reseller. >> They are authorized. They are on Ledger's website. >> Okay. I think it's fair to say that if Johannes's account can be corroborated by Ledger, then obviously stopping the sales, but potentially recalling devices from Europe could be a prudent security measure. But I imagine they have access to far more information than we do and they don't want to act on information that they can't cooperate. So I imagine that's why they haven't done it yet. But really without the information that they have access to, it's hard to answer the question.

>> Okay. So I know we don't have all the information [laughter] but now that we do know it's not just cryptoillis it's also metapod in Southeast Asia now we have these ones in Europe and obviously I know treasure is also taking some precautions one key is stopping reselling through crypto billis I'm curious if you were to put a theory of kind of how and even with Mark's blog post from starting from a year ago with the pieces that you know what does it seem happen like somebody maybe came up with this way of perpetrating this hack and then tested it. That's my theory based on the blog post and then kind of executed it in a large sweep.

But yeah, I would love to hear you talk a little bit about what you think is in the realm of possibility. >> Typically, this kind of attacks, inserting implants into wallets, used to be very expensive. So it would be done on very specific targets. For example, you would create 10 or 20 spy units and then you would ship those to addresses you've got from a leak to people telling them, "We're sorry, your information was leaked or the device you've got has an issue. Please use this one instead." And that's something that actually happened.

The one thing that has changed is that this new implant is made for mass production and ease of installation. which leads me to say that we're likely going to see a lot more of it in the future. For what's happening right now, I wouldn't be able to say for sure if those two devices were just join is having a lot of luck in a way finding the only two infected device in all of media marked or if there are more devices. It's quite possible too that devices are being not all the devices are being infected. Maybe they only did the half of the stock or they only did some boxes or maybe they found a different way to

inject implanted devices inside the stocks of Media Mark specifically. So it's very difficult to know at this point how it's happening. But the one thing that I can say for now that is easy to do is to verify if a device has been implanted or not when you're going to use it for yourself. So there's no reason to panic at this point. just have a look and be safe about it. >> Oh, I was just going to give my point of view and I'll caveat this is speculation given that we know whoever is responsible for this incident has also been responsible for devices being sold from multiple resellers leading to drains. I would speculate that

potentially this is occurring at potentially a layer above the actual resellers themselves, maybe a distributor or something like that. But again, this is hard to know without Ledgers's input. Something that I do think swings in the favor of this not being incredibly widespread is actually the loss amount. Whilst $100 million is obviously a very substantial amount of money, I would have expected by now to see losses like considerable losses from places outside Southeast Asia if this was massively more widespread. The fact that we haven't is good and I think is a good sign that hopefully this is a contained issue. But yeah, we'll see in the coming days. And as Mark said, the best thing you can do right now is if

you're really concerned, you can verify yourself. The one thing I would say, and I think Taylor has been saying this all week, but definitely don't panic. Something that we are dealing with at Seal 911, and we deal with this a lot, is when people panic, they tend to make silly mistakes and actually like this leads to them bringing themselves more risk. And if they just did nothing, they might break their ledger in the process of opening it and not have access to the seed phrase, so lose their money or try and transfer their assets to a fresh wallet and make a mistake in that process and lose access to the money. We do get reports of this kind of stuff happening. So, whatever you do, do it carefully and with some due thought and attention.

>> All right. So, I do also want to ask, I've always heard that it's best to buy directly from the manufacturer. And so I actually hadn't realized just how extensive their authorized reseller lists were. I don't think I realized just how common it was for people to buy from resellers. So I'm curious, even before this incident, was there some sort of hierarchy of security in terms of where you would purchase? Was it that buying from the manufacturer was the best, authorized reseller was second? How did people think of that? because it just was a surprise to me that people were trusting resellers.

>> I think if you care purely about physical security, minimizing the number of hands that devices are passed through before they reach you is a sensible approach. So obviously buying directly from Ledger in this case would be the best way to minimize that risk. But that may bring about other risks. So there are legitimate reasons why somebody might want to buy from an authorized reseller. We've seen a lot in the past of various hardware wallet companies or logistics providers for those companies getting breached and that leaking data. Some people might want the option of purchasing a hardware wallet in person in a store with cash so they don't have their personal data leaked on the internet. Another reason is even more basic than this why authorized resellers

are used in certain countries have tough laws on the import and export of hardware wallet or cryptographic devices. So one such jurisdiction is actually Vietnam. Vietnam you have to have a license to be able to import cryptographic devices. So if devices are being shipped from France as an individual buying that device is pretty tricky and you could get turned away at customs. So that's why the authorized resellers in those jurisdictions. I think it's a it's a trade-off but purely on the physical security side. Obviously buying directly from the producer is going to minimize that number of hands and decrease the risk of a supply chain compromise.

Well, I don't know if you saw Leonita's NFT tweeted that Ledger should end their authorized reseller program immediately. I'm curious. So, I understand the trade-offs that you mentioned, but what do you think of that suggestion? >> Well, I would say that's probably too drastic, but there are steps that Leisure can probably take to make sure that this kind of issues cannot happen or would be much more difficult to cause in the future. One thing I don't know exactly how for example the handoff of cryptobill happened if ledger was notified and if ledger vetted the new operators of the company there are so a few things that ledger could be doing on their side that would

make their product more safe to sell such as pumparent packaging so that if you know if your ledger has been opened before or not while a lot of those methods can be defeated in some ways it's always game of the cat and mouse basically of trying to just move faster than the other. [snorts] But for this thing, one thing I do think that Ledger could have been doing because it sounds like this is not a new issue. It's been discussed for at least six months. ledger could have maybe what I would have seen a good idea is to tell people that when buying a ledger from a third party even an authorized seller to maybe

have a look inside and verify that the hardware is as shown into the manual that ledger provides because Ledger actually provides in the manual of each device picture of the inside of the device how things should be but on the same page ledger also writes that opening your device will the warranty. So that's kind of why showing pictures of the inside if you say at the same time that the warranty is going to be void if you look inside. I said the fact that this has been known by Ledger for a while should have at least triggered Ledger to issue some generic guidance so that maybe some customers would look at their device. In the case of a reseller

like crypto business which seems to have a lot of victims, some of the crypto customers even if just one person out of 100 would have opened their ledger and found something would have prompted other people to do the same very likely reduced the total amount lost this time or this attack to be detected a lot sooner. >> Yeah. Something that was interesting is Sebastian V. St. I'm I'm actually not sure who this person is says quantum physicist on their profile, but he tweeted that he remembered reading something about, you know, Ledger advertising that there's no anti-tampering sticker on the box. And so he dug up his old box and he

photographed, you know, yeah, it it came with a little notice saying, "There is no anti-tampering sticker on this box. A cryptographic mechanism checks the integrity of your Ledger devices internal software each time it is powered on. The secure element trip prevents any interception or physical replacement attempt. Ledger devices are engineered to be tamperproof. So yeah, it's kind of concerning that they were bragging about that and obviously it didn't matter. So now considering that we saw this cold card hack that happened in August, now we're seeing this Ledger one, I'm curious to hear your opinion on self- custody at the moment. Do you think it's dead? Do

you think it's just temporarily unsafe? Do you feel like there's just new best practices that people need to follow in order to be able to self-custody? What's your kind of philosophical take on the whole self-custody ethos and movement? >> Self- custody is here for a big reason is that people's computers get virus and get hacked. One thing, one term we use a lot in IT security is attack surface which is basically what entry points there is into an IT system that would allow someone to get inside. And for computer you are connected to the internet. You browse the internet to open a number of websites all day.

Typically you will be plugging devices USB keys inside your computer. So all of these things are risk factors that cold wallet or hardware wallets are here to alleviate. So by having your private key and performing the signature on a separate device which has a limited connectivity option like for polony USB and Bluetooth which basically limits the attack surface you protect your cryptocurrencies from all those viruses or things that can infect your computer.

And I believe that self custody on cold wallets or hardware wallets has been successful and has reduced the crypto theft from virus enough for those criminal groups to move to find ways to attack those devices. and Ledger having I believe the largest market share in terms of wallets out there was probably the first target basically where there was the most to gain and that would make sense that Ledger was the first being attacked here >> certainly on the T 911 side I can say that the losses from people using hot wallets i.e wallets where the keys to

those wallets are held on a computer that's connected to the internet or a phone or something like this that causes significantly more loss than we see from hardware wallets. So yeah, it's still the case that getting malware onto devices and that malware exfiltrating keys is a major issue and I do think that hardware wallets have a place to solve that issue. Although I would agree that we're going through a really tough spot at the moment and I think the security failings not just in this instance with Ledger but the data breaches the entropy issues across various different companies make this a really tough D. I know that there are other people I know my friend Zack XPTt has been arguing that people should use

isolated iPhones essentially just to do transaction signing. That's one option. But personally, I'm still of the opinion that for a retail user that's maybe not super savvy, the best way forward if you want to self- custody, of course, you don't have to. There are other options. You can entrust an exchange for your security or I know people are now advocating for buying things like ETFs if you just want to buy the mainstream coins. But I personally would advocate that hardware wallets are probably still the best solution for retail users that want to self-custody. Clearly, at least right now, I would definitely buy devices directly from the producers and don't rely on the reseller network. And if you do get devices delivered, get

them delivered to an address that is not your own. And I wouldn't use any personally identifying information in doing so. So I hope that these producers of hardware wallets do some serious threat modeling and reduce this attack service even further because clearly it's not up to scratch. It's sad that we have to learn this in the way that we do but I still think that's the way forward. Yeah, you can obviously mask your email address like you know your iPhone will offer to do that for you and then you can use like privacy.com I think has like a credit like a temporary credit card or something that you can use you know like if you manage to pay in staples or whatever then that could also be an option but yeah there's I

think there's multiple ways to go about it. Mark, can you walk us through how anybody who currently owns a hardware device can check to make sure that their device is safe? >> Yes. I mean, at this point, the only devices that are known to be affected are ledgers devices. So, depending on which device you have, it can be more or less difficult. The Ledger Nano X, uh, the NOS are the easiest to check. So if you have bought for example a nano X you can just uh open the the box first. I'll go through the the whole process.

Uh when you open it you have your uh new right here. And it's actually very easy to open because you just remove the the metal pin here and uh with a knife you just be careful to not cut yourself up. Let me be careful here. And you twist a little bit and it will open uh very easily. And the easiest is to hold it upside down so the buttons don't go everywhere.

And like that I can see the board of this fresh nano X which is clean. Generally if you look under the screen this is where you will find the most common I mean that's where basically the screen output here is. So all the implants existing today will have to connect to the part right here. If you have nothing behind the screen, I go >> you show it a little bit more in the center of the camera. >> Yes. >> It's being hidden by your name and stuff. Yeah. Okay. >> But yeah, as long as uh behind the screen, you lift the screen. Uh you have a number of uh dots here which are known as test points. Uh this is where the uh implant will try to pull data off. Uh there's nothing here as you can see. So

this uh Nano X is clean and the remaining important part is how to bring this back into one piece. Uh the USB goes on the side of the black button. You just put this face down uh on this side. So as you can see it's uh back like that. And the part on top just goes like this and it's back into one piece. Okay. And Jonty, for people who do find that their device has been tampered with, what should they do?

>> So, I guess again to reiterate, don't panic and don't do anything absolutely rash that's going to bring yourself more problems, but you need to treat the device as compromised. and any assets that those devices that device secures needs to be moved to a a fresh secure wallet either another hardware wallet that isn't compromised or if you if you're looking for a temporary place to store assets you can use you know a software wallet like MetaMask Phantom all of the those those normal sorts of wallets but yeah shift the assets from the compromised ledger to the secure wallet and then you've mitigated the problem if you do have a compromised device like that please do reach out to

see 911. We'd love to hear about it and see the device so that we can learn more exactly how this happened and what went down. Even if you haven't lost assets, if you have lost assets, please report that to police in your local jurisdiction as a matter of urgency. That's the way that your case gets formally registered, I guess. And ultimately, it's the police that has the legal authority to do anything about assets that have been lost. So, please do that, but also reach out to CE 911 and we can guide you through that whole thing for free.

>> All right, so last couple of questions. It looks like Tether has frozen about $10 million in UST. There's been $464 ETH that has gone through tornado cash. Hex Shield traced a bit less than $4 million to Binance deposit addresses. What do you see as most likely to occur in terms of any recovery of funds? Yes. So fortunately because we were notified very very quickly at seal number one, we were able to immediately trace the assets and work with both Tether and law enforcement to enable that freeze. I would say if we if as an industry we had a better way of responding in these instance such that we could secure those freezes more quickly. Actually in this instance we

could have saved a lot of money probably you know multiples of of that 10 million but it's great that we saved that 10 million. There is other assets that have been frozen by other entities that are being used to launder these funds. But broadly speaking, asset recovery is an incredibly complex process. And there's a few things that make this case even more complicated. Namely, this isn't a single hack of one entity that has lost all of their money. It's lots of individuals who are based all over the world who've lost assets. And that complicates things because all of those assets are comingled and jurisdiction matters a lot with sort of legal cases.

So it's not clear exactly which police force is responsible for seizing those assets. I imagine now that the assets are frozen. Actually recovering those assets will be an effort that involves lawyers, prosecutors, international law enforcement cooperation, potentially interpol stuff like this in order to exactly work out their process. And unfortunately that's a process that takes months and years. So yeah, I'm optimistic that I hope at least some assets can be recovered, but I doubt that will happen anytime in the immediate future.

>> And given the complications that you mentioned with the multiple jurisdictions and different types of law enforcement that need to be involved, do you think that there's good odds that this case results in some form of justice or do you think that's a long shot? I think in terms of justice, obviously attribution here, we don't really know who's involved. Um, something that I think is going to help that process substantially is that obviously there's quite a lot of physical evidence trails that have been left in terms of hardware that's been implanted. That hardware is calling to places. This is sort of both technical but also traditional like police work that can be done to try and

identify exactly where these hardware implants were made. Ultimately, until that work is done, it's hard to say if these devices are being tampered with from a jurisdiction that maybe law enforcement that has jurisdiction over these cases can't reach, then that's going to be really tricky. If these devices are being tampered with close to home in Southeast Asia, then I think there's much more options available to the appropriate authorities to do something. But yeah, it's hard to estimate odds. I'll be cautiously optimistic. How about that?

>> Okay. [laughter] All right. Well, thank you both so much for illuminating what has really been a pretty disheartening incident to watch. [music] So, thank you both so much for sharing your insights with Unchained. Thank you for having us. >> All right. Well, thanks for joining us and we will catch you all next week. Bye now. Nothing you hear on Unchained is investment advice. This show is forformational and entertainment purposes only and my guest and I may hold assets discussed on the show. For more disclosures, visit unchainedcrypto.com. [music] [music]