Today’s Field Note

Ledger has confirmed what looks like an organized group tampering with hardware wallets sold through unauthorized channels in Asia (reportedly via reseller CryptoBilis), and is now telling buyers to treat set-up devices as compromised. Separately, a HashKey Chain admin swapped the deposit contract, moved 142,818 USDT, then restored the original code about six minutes later, a reminder that a three-of-five multisig with instant upgrade rights is a live backdoor whether or not it was benign this time. Both items point at the same unglamorous truth: the attack surface is supply chain and admin keys, not clever on-chain math. If you bought a Ledger from anyone other than Ledger directly, assume the seed is known. If you hold funds on an upgradeable contract, know who controls the keys.

Today’s Move

  • If your Ledger came from a reseller (especially CryptoBilis or any Asia-based marketplace), move all assets to a device bought directly from Ledger, initialized by you, with a freshly generated recovery phrase. Never reuse the old seed.
  • Leave any unused or unexpectedly “pre-set-up” Ledger uninitialized and do not enter funds. A device that arrives with a seed or PIN is tampered.
  • If you use HashKey Chain, check which contracts hold your deposits and confirm the multisig signer set. Treat instant-upgrade contracts as custodial.
  • Audit upgradeable DeFi positions generally today: identify proxy admins, timelocks (or lack thereof), and withdraw from anything with a three-of-five or smaller multisig and no delay.
  • Verify your real hardware wallet’s firmware and recovery phrase were generated on-device, offline, before trusting it with size.

Resources

  • https://thedefiant.io/news/security/ledger-blames-organized-group-for-months-long-wallet-tampering-campaign
  • https://thedefiant.io/news/security/ledger-wallet-tampering-what-is-confirmed-and-what-owners-should-know
  • https://thedefiant.io/news/security/hashkey-chain-admin-moves-142-818-usdt-with-temporary-contract-swap
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.