Everyone cannot audit their own hardware

In August, I wrote about why everyone cannot be their own bank, following the theft of $116 million in Bitcoin from users of the Coldcard hardware wallet, which suffered from a vulnerability in how it generated keys. In that post, I asked:

Do you trust the developers of a hardware wallet and trust that the device was not tampered with en route to you?

Well, here we are again.

This time, Ledger hardware wallets sold by an authorized reseller in Malaysia were found to have been modified with hardware capable of reading and transmitting the 24-word recovery phrases displayed during setup. Similar tampering has been reported elsewhere in the world, although these cases are so far unverified by Ledger. The attack has been linked to an estimated $93 million in cryptocurrency stolen.

The reseller, CryptoBilis, was acquired earlier this year, with the former CEO claiming a confidentiality agreement prevented former staff from revealing that the company was under new management. This has led to speculation that the purchasers themselves were involved in the attack, although there is no evidence of this yet.

The lesson here is that, once again, crypto is not ready for mainstream adoption. A few in the community will chide the victims for their naivety: sure, they bought a hardware wallet from an authorized reseller, but did they do a full teardown to ensure no additional components were added to the device? But I think many more will quietly recognize this as another case of people who did everything they were supposed to losing everything with basically no recourse.