Ledger confirmed finding an unauthorized hardware implant inside one customer’s Ledger device while investigating reported thefts tied to Southeast Asian reseller CryptoBilis, prompting the reseller to halt all hardware wallet sales. Security researcher Mark Karpelès examined a suspicious Ledger Nano X and reported additional electronics hidden behind the display; a technical analysis shared by Tibane Labs described a microcontroller, cellular hardware and connections to the screen data lines that could capture information displayed during setup. Ledger said it is contacting affected customers, working with authorities and developing protections against physical tampering, advised users who bought from CryptoBilis not to set up devices, and recommended transferring funds to a new wallet initialized with a fresh recovery phrase. Ledger also emphasized it has found no evidence its internal systems were compromised and warned users to ignore any recovery-phrase requests.
Blockchain analysts have attempted to quantify suspected losses: Bitquery estimated about $92.9 million removed from 311 wallets across Bitcoin, Ethereum, TRON, BNB Chain and Polygon, with roughly $70.5 million in TRON USDT and $16.8 million in Bitcoin; it reported roughly $10 million frozen and transfers routed through mixers like Tornado Cash. PublicAML reported additional ETH movements. Ledger has not independently confirmed those totals, the number of victims or that the implant caused the thefts. Former CryptoBilis executives say they transferred control earlier in 2026.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Tesla Fremont is applying to increase emissions from its Giga presses, raising concerns about toxic heavy metal pollution near a school. The local air regulator is accused of pushing the permit changes without proper oversight or public awareness. (anonymous94538.substack.com)
Nvidia is accused of attempting to negotiate a deal with Anna's Archive to gain high-speed access to a large collection of pirated books. The controversy suggests Nvidia may have sought stolen data to enhance its AI language models. (tomshardware.com)
Phishing emails are increasingly targeting AI assistants by exploiting their inability to distinguish between safe and malicious content. Users should limit AI permissions and verify actions manually to prevent security breaches. (malwarebytes.com)
Ukraine has conducted a drone attack on a second major tech site inside Russia, marking an expansion of its targeting efforts. The attack specifically hit a data center operated by Yandex, a Russian technology company. (reuters.com)
Small AI models may soon be capable of self-replicating on IoT devices without centralized control, making them difficult to shut down. These AI worms could autonomously identify and infect various hardware, including cheap smart devices, posing new cybersecurity risks. (anthropic.com)
A US government kill switch could potentially disable European Commission technology, raising concerns about control and security. Existing tech like Microsoft Teams already has such shutdown capabilities, indicating a lack of understanding among EC officials. (theregister.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.