Unknown attackers have been intercepting and manipulating Ledger Nano X hardware wallets so they can read and exfiltrate users’ seed phrases. Rather than compromising the Secure Element, the criminals add a small intercept chip that watches the data sent from the Secure Element to the built‑in screen, recognizes the displayed characters, and pairs that with a tiny LTE modem/eSIM and antenna powered by the device battery to transmit seed phrases back to them. Security researchers and blockchain observers link this method to more than 300 compromised devices and roughly 93-100 million US dollars stolen and subsequently laundered through mixers; Ledger has acknowledged at least one confirmed financial loss tied to a manipulated device.
Analysis attributes many of the tampered units to a dealer called Cryptobilis operating out of Southeast Asia (Malaysia), with reports of a recent change of ownership and devices sold via international marketplaces. The tampering has evolved from crude, hand‑modified sticks with replaced batteries to professionally produced generations that leave the original battery and exterior largely intact - attackers often remove protective foam under the screen to hide components, so visual inspection reveals little beyond a thin antenna wire. Ledger has prohibited the dealer from further sales and advises customers who bought from Cryptobilis to stop using affected devices and move holdings to other wallets.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A bug has been identified in Rust's borrow checker where struct's lifetime requirements can be bypassed through covariant field assignment. This issue could potentially lead to unsafe memory access in Rust programs. (github.com)
CFTC staff were instructed to retract an analysis they conducted on suspicious oil trades involving Iran. The directive raises questions about regulatory transparency and oversight in commodities trading. (bloomberg.com)
Social media engagement for Reform UK figures has declined following Ukrainian strikes on Russian data centres, which significantly reduced bot activity linked to Russian information operations. This decrease in automated activity has led to lower interaction levels on Reform UK posts in the UK and across Europe. (thelondoneconomic.com)
Google releases a second edition of its SRE book, reflecting a decade of lessons and industry changes. The new edition addresses modern challenges like AI workloads, complex dependencies, and automation in site reliability practices. (cloud.google.com)
Michael Smith was sentenced to 18 months for using AI and thousands of bots to flood music streaming platforms with fake plays, earning him over $8 million in royalties. This case is the first DOJ prosecution involving AI-assisted music streaming fraud. (nytimes.com)
AI models can embed encrypted backdoors that hide arbitrary capabilities, making them provably difficult to elicit even with full access to model weights. This challenges the reliability of capability evaluations and limits the effectiveness of capability audits. (arxiv.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.