Tampered Ledgers: How Far Does the Supply Chain Attack Go?

Transcript

investment perspective, it's such a turnoff because basically you're telling me like, hey, we think we're the best. We think there's nowhere to grow and like the best use of capital is just to to to buy back the token. And obviously, we know that's not the real answer for a lot of these companies, but they're basically getting bullied into buying and and burning the token. And I think that's just like it's just crazy, right? So, I think one thing, that's one thing. The second thing is I think generally some companies don't see a path to like becoming 10x bigger and so they're using that basically to to allocate the capital and make kind of investors happy, right? Like I would rather a founder like come to me and say my stable coin is like $8 billion of supply. I see like a clear market or pathway to becoming like 50 billion. I'm

going to use the capital to do this like 100% like I I'd rather have that instead of kind of buying back the the token. Imagining a world where Ethereum acrews like several billions of dollars is just very very hard to imagine if not clearly impossible right because we have two things it's basically the base layer is used to store assets like not much activity is happening at the base layer so it's not producing a lot of fees and basically activity has been outsourced to these layer 2s and frankly like mainly two layer 2s it's base and Robin Hood and like there are other layer twos like lighter and but it's basically like five to seven layer twos that have like 99% % of the activity and those fees they're not acrewing to to Ethereum right like I I made the point with Robin

Hood like Robin Hood was making several millions of dollars a day and basically Ethereum base layer was acrewing $100 like literally $100 to $200 right I think from a value crew perspective like it's pretty clear and I I kind of I've written about this where Ethereum has this um you know franchise model where basically it's scaling through franchises right like really base and Robin Hood you can think of it as a as as a McDonald's franchise right I just the Ethereum foundation and people around Ethereum haven't internalized it and they're not realizing but growth is not happening anymore uh at the Ethereum layer 1. we were talking about this and today if I had like a normie friend that comes to me and that wants to buy Bitcoin for the first time I I I would probably recommend him an ETF to to be

completely transparent which which was not the case like I think three or four years ago and I think internally even for people like myself which you know I've been self custodying for years I'm actually thinking now of consolidating a lot of the custody that I have because it's just like so hard to keep up with what it's happening in terms of AI breakthroughs quantum and you don't only have that like even crypto protocols like a closing, right? Like I I don't know if you know you've seen this, but like abstract, which is a layer 2, is closing, and they're basically giving their users like a month to to withdraw funds, which is completely nuts. Like a month, like imagine imagine you're on holiday like in Australia for 2 months and you come back, it's like they should give at least a year or something like,

you know, that that makes more sense. And so I think from that perspective, there are just so many angles right now where you could either lose your funds or forget about it. Like to your point, if OpenAI has figured this out, right, it's already been moved into classified sections of the government, like it's being used for cyber security. I think the bigger concern for crypto, like that gives us a window to act and and I think if there's anything to these rumors, and again, I give them relatively low probability of being true, but if there's anything to the rumors that like OpenAI is coordinating with the EF or whatever, like we'll see things happening in pretty short order that tell us because the real risk is like with as with all the AI stuff is that the Chinese models are not far behind.

And in that case you do have you know first of all they're open weights but there's also an adversarial part to it. You have maybe some number of months if open AI was able to do this with their cutting edge frontier model. Then you have some number of months before a Chinese model is going to be able to do it. Right? So that's that's like the clock if this were to actually be the case. People had to create these tokens that were not going to ever return value. There's no dividends. There's no buybacks. There's nothing. We're never going to do that. It's just governance. Because if you said that you were going to do that, you were at serious risk of violating securities law. Now the good news I think is that that's changing right and so what comes along with that I think is increased scrutiny on teams

who aren't doing it right so if you're a big protocol and you are monetizing or have potentially the the ability to monetize and you have a token or you're thinking about issuing one you ought to have a story for how to drive value to that token that's actually rooted in something real right like not some like moon math we're setting up the incentive so perfect it's like no we're charging a fee and then we're distributing those fees or we're using those fees to buy back the token in this like programmatic way the way that like say unis swap or other you know big projects are now doing and the other thing I'll say is that I don't think that's like a small the point of governance tokens and governance in general for project is that you're supposed to be like it's to provide economic security right um so

it's not just like oh the token doesn't matter I don't buy that excuse anymore right the regulatory excuse is going away >> I think it's just a different dynamic when Zach then makes something public, it lights a fire under everyone cuz it's kind of like, wait, if this this bro on Twitter can tweet this, why didn't anyone do anything about this beforehand? But the other thing is just knowledge. A lot of people don't understand the moneyaundering dynamics. A lot of the teams don't understand like the especially the centralized exchanges. It's a clear day DPRK hack, but then they'd see really strong Chinese indicators and Chinese language and Chinese everything on the accounts that were laundering the money. And if you don't have any like open- source public reporting on the the laundering dynamics, you're basically like one by one trying to explain and to convince

these exchanges who are often Chinese by the way like no no we swear these are money launderers who know that they're laundering money. If you follow me on Twitter postbbit even pre-bbit you would see me bitching at the a lot of the exchanges for for not giving >> reacting to this. Yeah. >> Yeah. But I mean the amount of times that I have sat there and explained to the exchanges yes they're Chinese but they they're working like really handinhand with DPRK. Not all potential encryption breakthroughs are equivalent. Something big enough that it's going to break almost all forms of currently usable cryptography, like public private key cryptography, has far bigger implications than crypto. Like, yeah, your coins are going to zero, but do you realize private internet communications are now impossible? So, we're back to like the 1990s where you can't put your

credit card on the internet at all. Right? This becomes a totally different level of problem than the problem of hey we have some blockchain specific issues to deal with because in that case great ecommerce is dead and like email is no longer private. Those are call it step function levels of problems far above the Bitcoin blockchain. Right? And I know crypto people like to look at and think about the crypto system, but look outside into the world at the implications of some of the predictions you're making and you'll realize this is a little bit like, hey, if stable coins break because the US Treasury defaults, it's like, hold on, if the US Treasury defaults, nobody cares about the stable coins. I also think there's been a big misunderstanding of information security in this space, which is to say people

have looked at tools that allow them to self-custody or things that they sort of have a mental model of keeping the private seed safe that ironically rely upon a bunch of things like vendors you cannot really do diligence or devices that you can't easily take apart and understand. And this is where people have got themselves into trouble because hypothetically, just hypothetically, if you had created a MetaMask hot wallet, which everybody will tell you is not safe, and just written the private key down somewhere secure, put it in a fully encrypted password manager, and then never transacted with that thing, nothing's been stolen, right? That is the answer. If you just stuck it in, I don't know, Protop Pass, you're >> I don't know. I think Joe Lubman's going to push back on that, that MetaMask isn't safe. Um, for sure.

>> No, no. I'm saying that's the perception that hot not safe. I'm not agreeing, but I'm saying the meme was it's not safe unless you're using like a cold storage wallet. And this to me is a misunderstanding of the security surface. When you're an individual, you have limited time and limited ability to verify. You should actually be oversolving for simplicity. If you want to do these things and that is not what people have been doing is we've looked at political realignment. We've thought a lot about right left. What we haven't thought a lot about is young people versus old people because the argument is basically boomers are like, "We've been promised all these benefits. We need to get paid these benefits. Yes, the budget is large, but just raise taxes, right? Cuz we need to get these things." And the counterpoint, you know,

I hear this from my students is I wasn't even born when you guys voted these things for yourself and then you ran up a negative $40 trillion tab on this thing by running a huge deficit. Why the hell do you expect me to pay for that? Sounds like your problem. And I think the political parties are going to start having a reckoning of if you really start moving aggressively to defend benefits for the elderly. You are going to lose all of your young voters because young people rightly are pointing out, hey, we weren't a party to this agreement. Like the 65year-olds don't get to vote amongst themselves to steal all of our stuff to pay for their things. Like we're not cool with that.

>> What if your crypto could do more than just sit in your wallet? Nexo is a digital assets wealth platform where you can generate daily interest on your crypto or borrow funds against your assets. Today, Nexo serves more than 10 million clients. Find out more at nexo.com. One more thing, we've got a listener survey open. It takes just a few minutes. It's anonymous and it changes what we make next. Use the QR code on screen or go to unchainedcrypto.com/servey. The link is in the show notes.

$540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the DeFi TVL if you're wondering. That's according to Dune Research Commissioned by 1 in. But there's a solution. 1-in Aqua is the new shared liquidity platform. It lets LPS back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because the LPs don't have to split their tokens across positions, they can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1in.com/ By the people,

hey baby hey hey Heat. Heat.

Backyat. Hi everyone, welcome to Unchained, your no hype resource for all things crypto.

I'm your host Laura Shen. Thanks for joining this live stream. First, we'll take a quick word from the sponsors who make the show possible. This episode is brought to you by Nexo, the premier digital assets wealth platform. Earn daily interest on your crypto or borrow funds all through one platform trusted by more than 10 million clients. Find out more at nexo.com. GEIO restrictions to eligibility and terms apply. Before we get started, I want to ask you for something. We're making a bunch of decisions right now about Unchained. What we make next, when we go live, what we should be doing more of, and I'd rather hear from you before we make them than after. So, we put together a survey. It takes just a few minutes.

It's anonymous and there's a box where you can tell me what we could be doing better. I read all the responses. The link is in the show notes or you can snap the QR code on screen or go to unchained crypto.com/servey. Thanks. Today's topic is the leisure reseller hacks. Here to discuss are Mark Carpoolis, chief executive officer at Carpoolus Labs, and John T, Seal 911 contributor and founder of Panklin Intelligence. Welcome, Mark and John T.

>> Hello. Sorry. >> This past week, the crypto community has been stunned by a series of hacks that appears to have been months, if not a year or more, in the making. An estimated $100 million or more has been stolen from Ledger hardware wallets purchased from a reseller in Southeast Asia known as CryptoBillis. John Ty, as far as I can tell, you were the first person to tweet about the hack just as it started. Tell us how you became aware of it. >> Yeah, hi Laura. Um, yeah, thanks for having us. Um, so yeah, as you said, um, aside from my day job, I'm a contributor to a project called Se 911. If you don't know us, um we're a group of about 25 vetted security researchers who

essentially operate a 247 free emergency hotline for anybody experiencing a crypto emergency to get some some expert advice. So that's anything from big companies who've lost hundreds of millions of dollars all the way to, I don't know, your your your granddad uh who's who's suffered a fishing attack or something. Um so naturally um as soon as these thefts started coming through um people started reporting to seal 911 uh saying hey my my ledge has been drained and uh you know when when we get an influx of about five reports that say exactly the same thing um we start we start getting concerned and um my main role at at 911 and more generally my my

experience I'm I'm an onchain analyst so um I look at the blockchain data to try work out what's happened. So I immediately started looking at uh these thefts and noticed that the inflows to the theft addresses were significantly larger than the amounts that were being reported as uh lost from from the victims who reached out to seal 911. What this tells me is that um actually the scale of this thing is is much larger than just the victims that we're talking to. Um, and actually now I mean I' I've got by my last count over 100 million lost uh in in this particular wave of uh instance. Um, but this is at that point we didn't know the the exact

cause of the losses. The only way that we were going to really work that out was if we had more victims reporting to us so that we could start to look for patterns. So that's why I uh went on Twitter and posted the theft addresses and asked for people to reach out. And Mark, your company actually had a blog post about this type of attack which was first seen a year ago, I guess, and has seen successive improved versions. Explain how the attack works. >> So the attack works by uh installing into the uh the wlet ledger in this case uh an extra module that will be looking at the screen uh as you set up your

device initially. And when you set up your device on the screen will be shown your seed phrase uh which is basically the password that is going to protect everything uh you're going to store on this uh wallet and the seat is made of 24 words. So as you see the words and write these on paper uh the implant will also be uh watching taking note of uh every single word and as you reach uh the end which is 24 words the implant will be sending the your password basically uh to the attacker uh using the uh mobile model that is included in the implant.

>> Yeah. Yeah. It's so clever because um you know Ledger it's supposed to have this hardware component that is sort of impenetrable um but then they just attached something on there that uh you know bypasses that completely and is just looking at the screen and then has a little eim that just sends it out you know the way that any of in you know of our information on our mobile phone gets sent. So, um, CryptoBillis was rather quickly identified as the reseller whose devices were being hacked. What do we know about CryptoBillis and either one of you can respond?

>> Mhm. I this point we don't have a lot of information. Uh the first thing that came up uh to be known is that the founder of Cryptobillis uh had sold the company uh about six months prior but we don't know at this point if uh this has a direct connection with this event or not. Uh what was clear however is that a lot of the victims had bought their wallet from cryptobillis and uh some people who had bought the right from to crypto also open this and found uh an implant inside.

>> Yeah I guess I guess more fundamentally than this um the reason that this attack is very scary is that cryptobillis was an authorized reseller of ledger devices i.e. It's one of the vendors that Ledger has approved to resell their hardware wallets. Um it was authorized across uh Indonesia, Malaysia and and the Philippines. Um so also multiple jurisdictions. Um and yeah, that's that's that's what makes this uh supply chain incident different from uh many other sort of hardware wallet fake fake versions of hardware wallets that we we've seen in the past being sold.

Yeah, I did want to ask. So, I know we can't know exactly for sure what happened, but I did see some people, you know, taking that fact that the company had been sold last spring. And then, uh, the owner also said that um, quote, "We were legally bound by contract confidentiality to hold off on public announcements until October 19th." So the timing of the hack and you know the relationship to that date is very interesting. But I did see some people you know making what could be a logical leap that potentially the new um you know owners of Cryptobillis are uh you

know implicated somehow. Um so I thought it was interesting. I saw Ledger announced that they had asked Cryptobillis to pause all sales and shipments of Ledger devices. Um because uh there is a possibility that cryp the cryptobillis owners are actually you know um >> like somehow yeah potentially the source of the hack. I I'm curious for your thoughts on that. >> Yeah. So I guess at this point nothing is confirmed. Um, so I I don't want to uh, you know, accuse people of anything.

Certainly that timing is interesting. Um, but I guess something else that is interesting that's that's come out which might go against the argument that that uh, Cryptobillis is is maybe the source of the compromise is that there are other authorized resellers of Ledger devices in Southeast Asia who are known to have sold template devices. And also uh this has resulted in in in u cryptocurrency being stolen. So uh this this is an issue that's not not just limited to to crypto billers. Um but so far uh to be clear, I'm not aware of any reports of ledgers being drained um from outside of Southeast Asia.

>> Okay. And wait, so I'm sorry that was um the the other devices sold elsewhere that was also in this wave of hacks. Uh so from the onchain analysis um whilst the there was obviously this wave that sort of caused the all the all the stuff in the media and us to be aware of this this incident. There was a large wave of attacks on October 9th. um through onchain analysis um it actually looks as though that uh whoever is is responsible for these hacks uh has has drained cryptocurrency previously. Um so there are there is evidence of drains prior to October 9th. The earliest that I'm aware of is September 8th. So about

a month prior. Um but uh these are are much smaller in value and and this is this is this will be why it won't have caused the the the massive uh spotlight um that that we now have on on Cryptobillis. >> And for September 8th um were those devices sold via Cryptobillis or from those other resellers that you mentioned in Southeast Asia? >> Uh other resellers based in Southeast Asia. Um this this uh yeah this this is now confirmed. Um uh but yeah, I want to be super clear that uh outside of what what the ledger has stated publicly, i.e. resellers in Southeast Asia, I'm not aware of any reports um uh of of

cryptocurrency being drained outside of them. >> Okay. Yeah. I mean, I did see some tweets uh where people named other resellers in Southeast Asia, but we'll we'll talk about that later. And I think I think Mark actually uh has has uh has himself looked at devices from other resellers in Southeast Asia. >> Yes. >> Yes. I actually received one device uh that was purchased at the airport in Singapore from uh Metapod which is also uh authorized reseller of crypto of ledger.

And uh inside this device there was also uh spy implant that was uh configured to uh take the information. So the deviceation was a ledger flex which is not the same as the uh the dox. It's a bit more of a complex device and I was very surprised to see how uh advanced was the technology used uh to uh spy on the screen basically. >> And was it the exact same as as what's been used in in this recent wave? Uh it's not the exact exact same in the sense that it's an it's a version that's

fully uh customized for the Ledger Flex which is very different from the one we've seen on the Leisure Nano X but uh it's still the same kind of boards on the same process of having three chips uh one which is uh monitoring the screen and taking note of the passphrase one uh that is uh communicating with the mobile network to comm to to send the what has been captured and uh an EIM which is basically a data contract to actually send the data online.

>> Okay. Okay. And when you say it's quite sophisticated like what was different about it >> uh for I mean we've seen actually a number of versions of the implant. Uh the very first version that was uh found was found late uh last year and was presented uh I think in May or late April this year. It's basically a board with uh some wires that connect to different point of the ledger. So it's very uh easy to see. It's very unnatural.

And uh from that version, we've seen versions that have an orange flex uh flex board which uh looks more professional, but it's still a lot of work to install. And the new version we're seeing have a black board. And actually for the uh Nano X, the board will basically just fall into place. You just put it on the board, move it a bit, it just clips. And then you just have to put some point of solder to install and uh very clearly uh the board I mean the the spy implant has been improved and uh whoever is doing this is learning and making uh improvements

uh and not just very small improvement but very giant leaps uh doing real research with uh a lot of funding to create those boards and the boards are found into the Ledger Flex uh actually had some of the uh components built specifically for the Ledger Flex uh which uh I've built myself some electronics and did some things uh among other things. The flex use a lot of very small connectors which is known as heroce connectors and they've mastered building uh flex extenders that connect between the original uh ledger connector

and the board where it's supposed to go to take a copy of the signal going to the screen and so sensing for the process. So they've really uh have a lot of budget I would say because you don't build this without uh doing a lot of trial and error. We need you need a lot of test devices too and uh the the technology that's behind this clearly uh is not something that just came uh from a few days. They spent months of research and development building this.

>> Okay. Yeah, that was the impression I got from your blog post because you had seen, you know, similar versions a year ago. Um, I did want to ask just one last question about this. Um, so you know, we floated this theory that potentially the new owners of CryptoBillis could be the culprits, but also since other resellers have these compromised devices that potentially there could be another theory. I was just wondering if you um either one of you could walk through, you know, what what the universe of potential scenarios are in terms of like who the culprits might be or or how this um you know uh compromise was inserted into these devices.

>> Uh it's very difficult to say at this point. Uh the timing of the purchase of crypto of course looks very suspicious. Uh but generally we like to consider that unless proven guilty you're innocent. So I don't want to go too far in this direction. Uh the question that remains is because we're seeing the same kind of implants in other resellers outside of uh Malaysia like in Singapore. Uh there is more to this story than we know today. And uh I would guess that law enforcement is uh investigating and I don't know if there's much we can

uh say at this point without uh I mean I would rather see what uh law enforcement come up with uh rather than trying to guess uh what could it be because there could be so many things uh and yet just guessing without evidence we might uh not be any good for the investigation because on a broad level um obviously to get from the ledger factory to the uh shops in Singapore or Malaysia or or wherever they're being sold um these devices have to pass through a number of hands like there's there's a a supply

chain there a logistics chain uh where these ledger devices essentially physically go from A to B. Um, and that's that's what's going to need to be scrutinized is um the hands that these devices have passed through. Evidently, at some point uh in in in that process, somebody has uh or or a group of people have uh tampered with with the devices. Um ultimately, I I don't think ledger supply chain is public, so it's not something that we're going to be able to know as as private individuals looking at this this attack from the outside. Um so uh yeah it's something I imagine Ledger is actively I hope Ledger is actively scrutinizing and I know uh law

enforcement from various jurisdictions is is definitely actively scrutinizing. So >> all right so in a moment we'll talk about uh other jurisdictions where this hack may have spread. But first we'll take a quick word from the sponsors who make the show possible. What if your crypto could do more than just sit in your wallet? Nexo is a digital assets wealth platform where you can generate daily interest on your crypto or borrow funds against your assets. Today, Nexo serves more than 10 million clients. Find out more at nexo.com.

One more thing, we've got a listener survey open. It takes just a few minutes. It's anonymous and it changes what we make next. Use the QR code on screen or go to unchainedcrypto.com/servey. The link is in the show notes. Back to my conversation with Mark and Jonty. On October 11th, a crypto user named 0x Johannes tweeted, "PSa, the ledger incident isn't limited to Asia. This is a device purchased in store from an official reseller in Europe, a legitimate device doesn't have any of these cables, as can be seen in picture two. This even seems to be an old version of the spy implant, even though

the device was purchased a couple weeks ago. The newer versions usually hide the implant by the screen, so it's easier to miss. The next day, he tweeted, "Update. I can confirm that the Ledger supply chain is compromised in Europe as well. I just purchased a second device from a different media market location today, recorded the unboxing process, and discovered spyware once again." So, do we have any sense of how widespread this issue is in Europe? And have you logged any victims in Europe? >> I can certainly say on the on the victim side from victim reports that I'm aware of. I'm not aware of any devices that been bought in Europe leading to a a

drain. Um, so I I can't corroborate that from from the the victim reports that I'm aware of. Um, >> okay. For the device itself, I mean, uh, Zerx joins actually sent it to me and to ledger one of each, uh, devices and, uh, the one sent to me arrived today. So, I already had a look inside and confirmed that it had uh, a spy implant. I also confirmed that the way it was installed was slightly different to the one things I've seen here. So I'm not sure if uh it's uh the same uh method of installation. It's surely the same implant.

Uh meanwhile ledger has pulled all the sales of ledger in media marked and uh said I believe today that they uh have verified all the inventory and say that nothing was compromised. So I don't know much at this point with those we have those two devices that uh one person have bought from two different locations uh that have been uh compromised. So I don't know uh I mean we we're lacking a lot of information here.

>> Okay. Well, so the second device that uh Johannes bought was not a return and he tweeted quote store records show the inventory originated from a a keepa GmbH. While Ledger's CTO was unsure if Akipa serves as the direct distributor between Ledger and Media, it appears to be the case. given that Akipa distributes across Europe, any physical retail store receiving stock through them may be at risk. And then he said, quote, Ledger should initiate an immediate product recall to protect users.

Would you agree that that would be a good move for the company? >> That's probably very uh complex of a question right now. and why it would be a good idea to suspend sales at least uh for any uh store that gets their ledgers from Akipa. Uh once I mean we the main issue we have right now is that it's not easy to know if a device uh being sold on the shelves is compromised or not. You can verify very easily when you open it. Uh but I don't think uh Ledger has opened every single thing they had in stock uh in media that would be uh days of work

to do this and that would put all the inventory uh basically unsellable. So I don't know exactly the situation at this point. Uh the the fact is as the end user it's very easy to verify when you buy a ledger uh if it's uh compromised or not especially if it's a nano X it can be opened easily uh what it's open is the impl is very obvious at least for now uh but the way it is right now I don't think Ledger wants to cause a panic and uh person they probably don't want to

say anything they haven't confirmed first. Uh but I do still think that one person even just one person finding uh one implant into a location when there was none especially from an authorized vessel is uh a very very big issue. >> Oh wait, and I'm sorry um media marked is an authorized or unauthorized reseller. >> They are authorized. They are on the ledgers website. Okay. >> I I think it's fair to say that um if if Johannes's um account can can be corroborated by Ledger, then obviously um certainly stopping stopping the sales, but potentially recalling devices

from Europe could be a prudent prudent like security measure. Um, but obviously I I imagine I I don't want to talk for Ledger, but I imagine that they're uh they have access to far more information than than we do and uh they don't want to act on information that they can't cooperate. So, um I I imagine that's why they haven't done it yet. But really really without the information that they have access to, it's it's hard to hard to answer the question. >> Okay. So um so again I know we we don't have all the information but now that we do know you know so it's not just cryptobillis it's also metapod in Southeast Asia now we have these ones in

Europe um you know and and obviously I I know treasure treasure is also taking some precautions one key they're uh you know um stopping uh reselling through crypto bills I'm curious like I if you were to put a theory of kind of like how and and even you know with Mark's blog post from um starting from a year ago like like with the pieces that you know what does it seem happen like somebody maybe came up with this way of of you know perpetrating this hack and then tested it. That's my that's my theory based on the blog post and then kind of executed

it in a in a large sweep. Um but yeah, I would love to hear you talk a little bit about what you think uh is in the realm of possibility. >> Yes, typically this kind of uh attacks inserting implants into uh wallets used to be very expensive. So it would be done on very uh specific targets. For example, you would uh create 10 or 20 uh spy units and then you would ship those to addresses you've got from a leak to people telling them uh we're sorry we're sorry your information was leaked or the device you've got has an issue. Please use this one instead. And uh that's something that actually happened. Uh the

one thing that has changed is that this new implant is made uh for mass production and uh ease of installation. Uh leads me to say that we're likely going to see a lot more of it in the future. Uh for what's happening right now, I wouldn't be able to say for sure if those two devices were uh just join is having a lot of luck in a way. uh finding the only two uh infected device in all of media marked or if there are more devices.

Uh it's quite possible too that devices are being uh not all the devices are being infected. Maybe they only did half of the stock or they only did some boxes uh or maybe they found a different way to inject uh implanted devices inside the stocks of media mark specifically. So it's very difficult to know at this point uh how it's happening. Uh but the one thing that I can say for now that it's easy to do is to uh verify if a device uh has been implanted or not when you're going to use it for yourself. So there's no reason uh to panic at this point. Just

uh I mean have a look and uh be safe about it. >> Okay. Actually, can you >> Oh, go ahead, Jonty. >> Oh, I was just going to give give my point of view. Um, and I'll caveat. This is this is speculation, but um given that we know whoever is responsible for for this incident um uh has has also been responsible for devices being sold from multiple resellers leading to drains. Um I would I would speculate that um potentially this is occurring at potentially a layer above uh the the actual resellers themselves. Um maybe a distributor or or something like that.

But again, this is hard to know without uh without Ledgers's input. Something that I do think is in like swings in the favor of uh this not being incredibly widespread is actually the the loss amount. Um whilst hund00 million is obviously a very substantial amount of money, um I would have expected by now to to see losses like considerable losses from places outside Southeast Asia if if this was uh massively more widespread. Um the fact that we haven't is is good and I think is a good sign that that hopefully this is this is cont a contained uh issue. Uh but yeah, we we'll see in the the coming days. And as

as Mark said, um like the best the best thing you can do right now is is if if you're if you're really concerned, um you can you can verify yourself. Um the one thing I would say um and I think uh Taylor mentioned this has been saying this all week, but definitely don't panic. Um something that that we are dealing with at se 911 and and we deal with this a lot is when people panic they tend to make silly mistakes and actually like this leads to them bringing themselves more risk than if they if they just did nothing. You know they might break their ledger in the process of opening it and not have access to the seed phrase so lose their money or try and transfer their assets to a to a fresh wallet and make a

mistake in that process and lose access to the money. um we do get reports of this um this this kind of stuff happening. So whatever you do um do it carefully and um like with with some some due thought and attention. >> All right. So I do also want to ask, you know, I've always heard that it's best to buy directly from the manufacturer. And so I actually hadn't realized um just how extensive their authorized reseller lists were. And um also I I don't think I realized just how common it was for people to buy from resellers.

So I'm curious like even before this incident, was there some sort of hierarchy of um you know security in terms of like where you would purchase? Like was it that buying from the manufacturer was the best, authorized reseller was like second? Like how how did people think of that? because um yeah it it just was a surprise to me that um people were trusting resellers. >> I think if you if you care purely about physical security um minimizing the number of hands that devices are passed through before they reach you is a sensible approach. So obviously buying directly from Ledger in this case would would would be the best way to minimize

that risk. But that may bring about um other risks. So there are the legitimate reasons why somebody might want to buy from an authorized reseller. Um we've seen a lot in the past of various hardware wallet companies or or logistics providers for those companies getting breached and that leaking data. Some people might want the option of purchasing a hardware wallet in person in a store with cash uh so they don't have their uh personal uh data leaked on the internet. Um another reason uh that's even more basic than this why why authorized resellers are used in certain countries have um tough laws on the on the import and export of uh hardware wallet or cryptographic devices. So one

such one such jurisdiction is actually Vietnam. Vietnam there's there's you have to have a license to be able to import cryptographic devices. So, um, if if devices are being shipped from France, um, as an individual buying that device, it's it's pretty tricky and you could get turned away at customs. So, that's why they're the authorized resellers in in those jurisdictions. Um, so yeah, I think I think it's a it's a trade-off, but purely on the physical security side, obviously buying directly from uh the the uh producer is going to minimize that number of hands and and decrease the risk of a supply chain compromise.

Okay. Well, so I don't know if you saw Leonita's uh NFT tweeted that Ledger should end their authorized reseller program immediately. I'm curious, do like so I understand the the trade-offs that you mentioned. Um but what do you think of that suggestion? >> Well, I would say that's probably too drastic. uh but there are steps that leisure can probably take to make sure that these kind of issues uh cannot happen or would be much more difficult to cause in the future. One thing uh I don't know exactly how for example the handoff of crypto happened if ledger was notified and if ledger uh vetted the new operators of the company. Uh

there are also a few things that Leisure could be doing uh on their side that would make their product more uh safe to sell uh such as uh temporary evident packaging so that if you know uh if your ledger has been opened before or not. Uh while a lot of those methods can be uh defeated in some ways uh it's always a game of uh the cat and mouse basically of trying to just move uh faster than the other. Uh but for this thing uh one thing I do think that Ledger could have been doing because it sounds like uh this is not a new issue. has been uh discussed for at

least 6 months. uh ledger could have maybe what I would have seen that maybe a good idea is to uh tell people that when buying a ledger from uh a third party even an authorized seller to uh take maybe if you can have a look inside and uh verify that the hardware is as shown into the manual that Ledger provides because Ledger actually provides in the manual of each device picture of the the inside of the device how things should be. But on the same page, uh ledger also writes that opening your device will void the warranty.

So that's kind of like why showing pictures of the inside if you say at the same time that the warranty is going to be void if you you look inside. Uh um as I said the fact that this has been known uh by Ledger for a while uh should have at least triggered uh Ledger to uh issue some direct uh guidance so that maybe some customers would look at the device and in the case of reseller like uh Cryptobillis which seems to have a lot of victims uh some of the crypto customers even if Just one person out of

100 uh would have opened their ledger and found something uh would have prompted other people to do the same and very likely reduced uh the total amount lost this time or allowed this uh attack to be detected a lot sooner. >> Yeah. Something that was interesting is um Sebastian V. Staw um I'm actually not sure who this person is um says quantum physicist on their profile, but he tweeted that um he remembered reading something about, you know, Ledger um advertising that there's no anti-tampering sticker in the box. And so he dug up his old box and he

photographed, you know, yeah, it came with a little notice saying, um, there is no anti-tampering sticker on this box. A cryptographic mechanism checks the integrity of your Ledger devices internal software each time it is powered on. The secure element trip prevents any interception or physical replacement attempt. Ledger devices are engineered to be tamperproof. So yeah, it's um it's kind of concerning that they were bragging about that and obviously um it didn't matter. So, you know, now considering that we saw this cold card hack that happened in August, now we're seeing this Ledger one, I'm curious to hear your opinion on

self-custody at the moment. Do you think it's dead? Do you think it's just temporarily unsafe? Do you feel like there's just new best practices that people need to follow in order to be able to self- custody? You know, what's your kind of philosophical take on the whole self-custody ethos and movement? >> Self- custody is here for a big reason is that people's computers get virus and get hacked. Uh one thing one term we use a lot in uh IT security is attack surface which is basically what uh entry points there is into an IT system that uh would allow someone to get inside and

for computer you are connected to the internet you browse uh the internet open a number of websites all day uh typically you will be plugging devices uh USB keys inside your computer So all of these things are uh risk factors that uh cold wallets or hardware wallets are here to uh alleviate. So by having your uh private key and performing the signature on a separate device which has a limited uh connectivity option like for the colony only USB and Bluetooth which uh basically limits uh the attack surface uh you protect uh your cryptocurrencies from uh all those viruses or things that

can infect your computer. And uh I believe that uh self custody on cold wallets or hardware wallets has been successful and has reduced uh the crypto theft from virus enough for those criminal groups to move to find ways to attack those devices and ledger having I believe the largest uh market share in terms of wlets out there uh was probably the first targets basically uh where there was the most to gain and that would make sense that ledger was the first being attacked here.

Certainly on the T 911 side I can say that uh the losses from people using hot wallets i.e. uh wallets where the keys to those wallets are held on a computer that's connected to the internet um or a phone or something like this. um that attri that that causes significantly more loss than we see from hardware wallets. Um so yeah, it's it's it's still the case that um you know getting malware onto devices and that malware exfiltrating keys is is a major issue and I I do think that hardware wallets have a place to solve that issue. Um although I would agree that we're going through a really tough spot at the

moment and I think the security failings not just in this instance with Ledger but um the data breaches the entropy issues uh you across various different companies uh make make this a really a really tough job. Um, so yeah, I know that there are other people I know I know my friend Zach XBT is has been arguing that people should use um, uh, isolated iPhones essentially just to do transaction signing. Um, that's one option. But personally, I'm still of the opinion that for a retail user that's maybe not super savvy, um, the best the best way forward if you want to self custody, of course you don't have to.

There are other options. you can keep your your uh you can entrust an exchange with your security or I know people are now advocating for buying things like ETFs if you if you just want to buy the the mainstream uh um coins. Um but I yeah I don't I I personally would advocate that hardware wallets are probably still the best solution for um retail users that want to self- custody. But um clearly uh at least right now I would uh definitely buy um devices directly from uh the uh producers and don't rely on the reseller network. Um and uh yeah, if if you do get devices delivered, get them delivered to an

address that is is not your own. And I wouldn't use any personally identifying information in doing so. Um, yeah. So, I I I hope that these these producers of uh hardware wallets like do some serious threat modeling and reduce this attack service even further because clearly it's not up to scratch, but um yeah, it's sad that we have to learn this in the way that we do, but I I I still think that's the way forward. >> Yeah. Yeah. You can um obviously mask your email address like you know your iPhone will offer to do that for you and then you can use um like privacy.com I think has uh like a credit like a temporary credit card or something that

you can use um you know uh like if you manage to pay in staples or whatever then that could also be an option but um yeah there's I think there's multiple ways to go about it. Um, Mark, can you walk us through how anybody who currently owns a hardware device can check to make sure that their device is safe? >> Yes. I mean, at this point, the only devices that are known to be affected are Ledgers uh devices. So, depending on which device you have, it can be more or less difficult. Uh, the Ledger Nano X uh the NOS are the easiest to check. So if you have bought for example a Nano X you

can just uh open the the the box first. I'll go through the the whole process. Uh when you open it you have your uh new right here. And it's actually very easy to open because you just remove the the metal pin here and uh with a knife you just be careful to not cut yourself up. Let me be careful here. And you twist a little bit and it will open uh very easily.

And the easiest is to hold it upside down so the buttons don't go everywhere. And like that uh I can see the board of this fresh uh Nano X which uh is clean. Generally if you look under the screen this is where you will find the most uh common uh I mean that's where basically the screen output here is. So all the implants existing today will have to connect to the part right here. If you have nothing behind the screen, I >> to you show it a little bit more in the center of the camera.

>> Yes. >> It's being hidden by your name and stuff. Yeah. Okay. >> Yeah. As long as uh behind the screen, you lift the screen. Uh you have a number of uh dots here which are known at test points. Uh this is where the uh implant will try to pull data off. Uh there's nothing here as you can see. So this uh Nano X is clean and the remaining important part is how to bring this back into one piece. Uh the USB goes on the side of the black button. You just put this face down uh on this side. So as you can see it's uh back like that and the part on top just goes like this and it's back into one

piece. Okay. And Jonty, for people who do find that their device has been tampered with, what should they do? >> So, I guess again to reiterate, don't panic and don't do anything absolutely rash that's going to uh bring yourself more problems. Um, but you need to treat the device as compromised and any assets that those devices that device secures needs to be moved to a a fresh secure wallet. Either another hardware wallet that isn't compromised or if you if you're looking for a temporary place to store assets, you can use um, you know, a software wallet like uh, Metamas, Phantom, all of the those those normal

sorts of wallets. Um but yeah, shift shift the assets from the compromised ledger to the secure uh secure wallet and then um you you mitigated the problem. Um if you do have a compromised device like that, please do reach out to C911. Um we we'd love to hear about it and see the device so that we can learn more exactly how this happened and and what went down. Even if you haven't lost assets, if you have lost assets, uh please please please report that to uh police in your local jurisdiction as as a matter of urgency. Um that's the way that your case gets formally um sort of registered, I guess. And ultimately,

it's the police that has the legal authority to to do anything about uh assets that have been lost. So So please do that, but also reach out to SE 911 and we can we can guide you through that whole thing for free. All right. So, um, last couple of questions. It looks like Tether has frozen about $10 million in UST. There's been 464 ETH that has gone through Tornado Cash. PEX Shield traced a bit less than $4 million to Binance deposit addresses. What do you see as most likely to occur in terms of any recovery of funds?

>> Yeah. So um fortunately because we were notified very very quickly um at seal number one um we were able to um immediately trace the assets and work with both tether and law enforcement to enable that freeze. I would say if we if as an industry we had a better way of responding in these instance um such that we could secure those freezes more quickly um actually in this instance we could have saved a lot of money um probably you know multiples of of that 10 million but it's great that we saved that 10 million there is other assets that have been frozen um by other uh entities that have been used to launder these these funds um but broadly speaking asset recovery is an incredibly

complex proc process. And there's a few things that make this uh case even more complicated. Namely, um this isn't a single hack of one entity that has lost all of all of their money. It's lots of individuals who are based all over the world who've uh who've lost assets. Um and uh that that complicates things because all of those assets are comingled and uh jurisdiction matters a lot with uh sort of legal cases. So it's not clear exactly which police force is responsible for seizing those assets. Um so I imagine now that the assets are frozen, actually recovering those assets will be an effort uh that involves uh lawyers, prosecutors, international law

enforcement um cooperation, uh potentially interpol um stuff like this um in order to exactly work out that process. And unfortunately that's a process that takes months and years. Um uh so yeah I I'm optimistic that I hope at least some assets can be recovered but um I'm I I doubt that will happen anytime in the uh immediate future. And given the complications that you mentioned with the multiple jurisdictions and different types of law enforcement that need to be involved, do you think that there's good odds that this case results in some form of justice or do you think that's a long shot?

>> Uh I think in terms of uh in terms of justice um obviously attribution here we we don't we don't really know who's involved. Um something that that I think is is uh going to help that process substantially is that um obviously there's quite a lot of like physical evidence trails that have been left um in terms of uh you know hardware that's been implanted that hardware is calling to places. Um this is sort of both technical but also traditional like police work that that can be done to try and identify exactly you know where these where these hardware uh implants were uh were made. Um ultimately until until that work is

done, it's hard it's hard to it's hard to say um you know if if these devices are being tampered with from a jurisdiction that you know maybe uh sort of law enforcement that has jurisdiction over these cases can't reach then that's going to be really tricky. um if these devices are being tampered with, you know, close to close to uh home in Southeast Asia, then I think there's much more options uh available to the appropriate authorities to to to do something. Um but yeah, I I it's hard to it's hard to estimate odds. Um but I'm I'll be I'll be cautiously optimistic.

How about that? >> Okay. All right. Well, um, thank you both so much for illuminating what has really been, um, a pretty disheartening incident to watch. Um, so thank you both so much for sharing your insights with Unchained. >> Thank you for having us. So, >> all right. Well, um, thanks uh, for joining us and we will catch you all next week. Bye now. Nothing you hear on Unchained is investment advice. This show is forformational and entertainment purposes only and my guest and I may hold assets discussed on the show. For more disclosures, visit unchanged crypto.com.