Ledger is investigating reported cryptocurrency thefts involving customers who bought hardware wallets from Southeast Asian reseller CryptoBilis. The Ledger hack reports emerged after blockchain investigator Specter identified approximately $86.96 million in suspicious transfers across 98 addresses on multiple networks.
The company has requested that CryptoBilis halt sales and deliveries during this investigation period. Additionally, in its press release on October 9th, Ledger Security issued security guidelines for clients who recently acquired their devices via the reseller.
Despite this suspected Ledger hack, however, there is no known hardware flaw linked to it. There is still no confirmation on how the wallets in question got hacked or if there is one reason for the losses.
Why Did Ledger Suspend CryptoBilis Sales?
According to Ledger, the firm received alerts about missing funds from customers in Southeast Asia that acquired its products via CryptoBilis. Ledger instructed an urgent halt in the sale and delivery of the device pending investigations.
Also Read: Mastercard XRP Ledger Hackathon Set for October in New York
Users that had acquired their devices from the reseller in the previous 90 days were asked not to activate any unused wallets. Users that had activated their devices were encouraged to think about moving their funds to another Ledger signer with a different recovery phrase.
This was part of the security measures taken by the company in light of recent Ledger hack worries among hardware wallet users. At the moment, however, Ledger hasn’t revealed any evidence of device manipulation or the source of the breach.
How Much Crypto Was Reportedly Stolen?
Specter, a blockchain analyst, has estimated the losses at $86.96 million, having analyzed 98 addresses. This result comes after several complaints of users about illegal withdrawal from wallets connected with Ledger devices.
The Ledger hack attack included the networks of Bitcoin, Ethereum, and TRON. Specter traced the transfer from many wallets, while it is still unclear how many customers have been affected by the analysis.
Previously, security researcher tanuki42 estimated the losses to be over $72 million. This amount turned out to be less than the one calculated by Specter, but none of these amounts is the total loss of Ledger.
Also, it is necessary to note that 98 addresses do not mean 98 victims of attacks. There has been no confirmation that all the suspicious transactions were done by the customers of CryptoBilis. Thus, there are two different problems that need to be investigated in connection with the Ledger hack.
Can Crypto Be Stolen Without a Ledger Device?
Private keys are protected by hardware wallets because they operate in isolation from regular Internet-based systems. Transactions must be approved on the device, hence limiting the chances of any attack coming from far away.
The recovery phrase of a wallet enables a different user to recreate the wallet in a different place. For Ledger devices, the recovery phrase is made up of 24 words, which back up the private keys of the wallet.
Anybody who gains access to those 24 words can easily recover the wallet even without having the hardware in their possession. A passphrase can also provide security for different accounts when properly set.
This is how some form of crypto hacking takes place without accessing the hardware in question. Nevertheless, it is yet to be determined whether recovery phrase theft has been behind the Ledger hacks.
What Should Ledger Users Do Next?
The instructions from Ledger on how to secure accounts warn clients that they should never reveal recovery phrases via websites, apps, or any kind of message.
Clients using CryptoBilis for whom the 90-day period applies should comply with the instructions from Ledger. Those who think about transferring their assets should create a new recovery phrase using a trustworthy device and confirm the destination address.
For the time being, investigations of the Ledger hacks continue. Losses that are estimated have brought up security issues, but they have not proved a problem with Ledger hardware wallets.
Also Read: XRP Ledger Lending Vote Advances: Will XRP Reclaim $1.60?
Be the first to comment