Alert: Brazilian Discovers Scary Scam Using 'Spy Chip' to Steal Cryptos
The hardware wallet market just got a red alert straight from a Brazilian investigation. Security researcher Vinicius Pinheiro bought a Ledger Nano S from a Chinese marketplace and, upon opening the device, found a spy movie-like scenario: the original security chip was swapped with a cheap component that had its ID ground off.
While disassembling the wallet, Vinicius discovered that the installed firmware (a non-existent version called 'Nano S+ V2.1') was programmed to act as a spy. Every character of his PIN and every word of his seed phrase were captured and sent in plain text to a remote server controlled by the criminals at the moment of input.
A hardware wallet is a physical device, similar to a USB stick, that stores private keys to access cryptocurrencies on the blockchain. It remains disconnected from the internet most of the time, preventing malware from directly stealing keys from a computer or mobile device.
To use it, the device connects via USB or Bluetooth to software like Ledger Live. The user sends transaction data to the device, which signs it with the internal private key and returns the confirmed version, never exposing the key to the network. Models like the Ledger Nano S support over 5,500 coins across 20 different blockchains, including Bitcoin and Ethereum. The setup requires a PIN of 4 to 8 digits and generates a 24-word seed phrase, kept solely by the user.
The investigation continues
The case doesnโt seem to be isolated, and Vinicius Pinheiro has already indicated that the 'rabbit hole' could go even deeper. On his social media, the researcher stated: 'I will dig deeper by purchasing more models from the same store to check how far the counterfeiting goes. A full technical report for Ledger is in progress. More updates coming soon.'
Source: Hardware.com.br
$BTC $ETH $XRP
The hardware wallet market just got a red alert straight from a Brazilian investigation. Security researcher Vinicius Pinheiro bought a Ledger Nano S from a Chinese marketplace and, upon opening the device, found a spy movie-like scenario: the original security chip was swapped with a cheap component that had its ID ground off.
While disassembling the wallet, Vinicius discovered that the installed firmware (a non-existent version called 'Nano S+ V2.1') was programmed to act as a spy. Every character of his PIN and every word of his seed phrase were captured and sent in plain text to a remote server controlled by the criminals at the moment of input.
A hardware wallet is a physical device, similar to a USB stick, that stores private keys to access cryptocurrencies on the blockchain. It remains disconnected from the internet most of the time, preventing malware from directly stealing keys from a computer or mobile device.
To use it, the device connects via USB or Bluetooth to software like Ledger Live. The user sends transaction data to the device, which signs it with the internal private key and returns the confirmed version, never exposing the key to the network. Models like the Ledger Nano S support over 5,500 coins across 20 different blockchains, including Bitcoin and Ethereum. The setup requires a PIN of 4 to 8 digits and generates a 24-word seed phrase, kept solely by the user.
The investigation continues
The case doesnโt seem to be isolated, and Vinicius Pinheiro has already indicated that the 'rabbit hole' could go even deeper. On his social media, the researcher stated: 'I will dig deeper by purchasing more models from the same store to check how far the counterfeiting goes. A full technical report for Ledger is in progress. More updates coming soon.'
Source: Hardware.com.br
$BTC $ETH $XRP