[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4h6N6f5zwG5o9aEXNdrvP2S6CbshNuy4LafAyS08WBg":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":114},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"bd09a605-a338-4866-98a4-12157bcdd0d6","Ledger confirms spy chip implant behind wallet crypto thefts","ledger-confirms-spy-chip-implant-behind-wallet-crypto-thefts-259b31","Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. [...]","Ledger has confirmed that a hardware implant was found in some of its cryptocurrency wallet devices distributed by Southeast Asian reseller CryptoBilis, leading to user funds being stolen. The company is investigating how and when the devices were tampered with, advising affected users to move their assets to a new device. Researchers have identified two versions of the implant, which captures display output and button presses to steal seed phrases and transmit them via an LTE connection.","Ledger confirms hardware implants in some devices sold by CryptoBilis led to crypto theft.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F12\u002FLedger.jpg","2026-10-12T16:27:23+00:00","2026-10-12T18:00:12.357745+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Ledger X","product",{"name":21,"type":22},"Ledger","vendor",{"name":24,"type":22},"CryptoBilis",{"name":26,"type":19},"STM32G431KBU6",{"name":28,"type":29},"LTE","technology",{"name":31,"type":29},"eSIM","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,18],{"controls":58,"vendors":113},[59,87],{"slug":54,"name":60,"problem":61,"products":62},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":88,"name":89,"problem":90,"products":91},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[92,97,105],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":93,"product_name":94,"url":95,"description":96},"incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",[],{"slug":115,"title":116,"body":117,"framework_refs":118,"framework_notes":127},"hardware-implants-in-crypto-wallets-highlight-critical-supply-chain-risk","Hardware Implants in Crypto Wallets Highlight Critical Supply Chain Risk","Tampered Ledger hardware wallets distributed through a Southeast Asian reseller were found to contain spy chips capable of capturing seed phrases and transmitting them over LTE, resulting in direct theft of user funds. The root cause is a compromised supply chain, where a third-party reseller introduced malicious hardware implants before devices reached end users. This attack is particularly dangerous because it bypasses all software-level security controls — the device appears legitimate while silently exfiltrating the most sensitive cryptographic secrets. It underscores that trust in a hardware product cannot be assumed solely based on brand reputation; the integrity of the entire distribution chain must be verified.",[119,120,121,122,123,124,125,126],"NIST SP 800-161 (Supply Chain Risk Management)","NIST CSF DE.CM-3 (Personnel Activity Monitoring)","CIS Control 12: Network Infrastructure Management","CIS Control 15: Service Provider Management","ISO\u002FIEC 27036: Information Security for Supplier Relationships","NIST SP 800-193: Platform Firmware Resiliency Guidelines","GDPR Article 32 (Security of Processing — integrity and confidentiality)","NIST IR 7622: Notional Supply Chain Risk Management Practices",{}]