[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4RAF8NyL-5TVIn90RA3C9CyaHgOj-iWvVFKHm-ZwFFE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"dd8a2c16-bacb-413c-a4e2-3df412c06aad","hardware-implant-in-reseller-crypto-wallets-drains-86m","8d15ba39-6de6-43a2-80ca-28e20743256d","Hardware Implant in Reseller Crypto Wallets Drains $86M","Attackers compromised the hardware supply chain by physically implanting malicious components inside Ledger signing devices before they reached end users, enabling silent interception of recovery phrases via LTE transmission. This attack highlights the critical danger of purchasing security-sensitive hardware through unofficial or third-party resellers, where physical integrity cannot be guaranteed. Recovery phrases represent the ultimate cryptographic secret — once captured, all assets in a wallet are permanently at risk with no recourse. The incident underscores that even purpose-built security hardware provides zero protection if the device itself has been tampered with prior to delivery.","**Immediate actions:**\n- Stop using any Ledger hardware purchased through unauthorized or third-party resellers and transfer assets to a verified clean wallet immediately.\n- Verify the authenticity of all existing hardware wallets using the manufacturer's official tamper-evidence checks and attestation tools before further use.\n\n**Supply chain safeguards:**\n- Purchase security-critical hardware exclusively from the manufacturer's official website or verified authorized retailers with documented chain of custody.\n- Inspect all received hardware for signs of physical tampering, unexpected components, or packaging irregularities before first use.\n- Maintain an inventory of all security hardware purchases including serial numbers, purchase source, and delivery records for auditability.\n\n**Long-term improvements:**\n- Establish a formal hardware procurement policy that mandates supply chain verification steps for any cryptographic or authentication device.\n- Educate all users handling cryptocurrency assets on the risks of gray-market hardware and the irreversible consequences of recovery phrase exposure.\n- Implement periodic hardware integrity reviews and subscribe to manufacturer security advisories to receive timely alerts about compromised product batches.",[12,13,14,15,16,17,18,19],"CIS Control 2: Inventory and Control of Software\u002FHardware Assets","CIS Control 15: Service Provider Management","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SR-11: Component Authenticity","NIST SA-12: Supply Chain Protection","ISO\u002FIEC 27036: Information Security for Supplier Relationships","NIST CSF ID.SC-2: Suppliers and third-party partners of information systems are identified and prioritized","NIST CSF PR.AT-1: All users are informed and trained on supply chain risks",{},"published","2026-10-13T12:21:47.281861+00:00","2026-10-13T12:21:47.245+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fwww.securityweek.com\u002F86-million-crypto-heist-linked-to-ledger-signer-hardware-implant\u002F","86-million-crypto-heist-linked-to-ledger-signer-hardware-implant-6377b2","$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":36,"name":37,"slug":38,"description":39,"color":40},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[43,47,51],{"slug":44,"name":45,"problem":46},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":48,"name":49,"problem":50},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":52,"name":53,"problem":54},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]