The chip that stole more than $90 million from Ledger users costs less than $20 to build, snaps into place with three solder points, and has gone through at least three generations of design. Whoever makes it isn't planning a short run.
Ledger says its own chip and software were never compromised, and that every confirmed case traces back to one Malaysian reseller, CryptoBilis. But implanted devices have also been reported from authorized shops in Singapore and from MediaMarkt in Germany, and Ledger had photos of the newer implant on its website months before the drains.
Camila Russo talks with Mark Karpelès, the former Mt. Gox CEO who now runs Karpeles Lab, and who found the mass-produced implant after buying a half-price Nano X on Amazon Japan. He explains how the board is installed, why he thinks someone is selling it as a product, and why weighing your wallet won't catch it. He also responds to Ledger CEO Pascal Gauthier, who said Mark's Mt. Gox record makes him no white knight, and argues that one well-placed warning could have saved most of the money.
So who is building these implants, and who else is buying them? Mark walks through what to check on your own device, why panicking is the bigger risk, the open-source antenna detector he's building, and why he still thinks self-custody is the whole point of Bitcoin.
"If you have a hardware wallet, it shouldn't contain a mobile antenna."
Guest: Mark Karpelès (Karpeles Lab)Topics: Ledger, Nano X, hardware wallet implant, supply chain attack, CryptoBilis, MediaMarkt, seed phrase, Mt. Gox, Pascal Gauthier, Joe Grand, self-custody, multisig, crypto security, hardware security
