Ledger confirmed an unauthorized hardware implant in a device sold by reseller CryptoBilis. The module was reportedly designed to capture the recovery phrase from the screen during initial setup and send it via LTE.
CryptoBilis has suspended sales of all hardware wallets during an investigation. Ledger confirmed an unauthorized implant in one device and said its systems were not compromised.
On September 7, Galaxy Research reported that 97.09 BTC had been spent from multisig vaults attributed to the third wave of the Coldcard exploit. Coinkite recommends that users of affected versions migrate their funds to a new seed.
Ledger’s security bulletin warns of a bug in the Ethereum app versions 1.19.0 through 1.22.2. A fix is available in version 1.22.3.