A major hardware wallet security breach has been discovered affecting Ledger users, with $86 million worth of cryptocurrency stolen from hundreds of wallets. According to This Week in Tech 1105 transcript, the attack involves an unauthorized hardware implant that was discovered in one of the impacted user's devices. The implant uses an embedded SIM card to send information to attackers who can then siphon funds from user accounts without their knowledge. Ledger has confirmed this represents a supply chain attack, where the hardware was compromised during manufacturing or assembly process. Recent security guidance emphasizes that no genuine wallet, exchange or support team will ever ask for your seed phrase, including Ramp Network, making this a critical warning for users to protect their recovery phrases.
A Google advertisement scam has been discovered targeting cryptocurrency wallet users, specifically those searching for Gnosis Safe wallets. According to reports from CoinDesk, the scam involves an advertisement labeled Safe.global that redirects users to a fake wallet clone at wallet-safe.global. The fake page copies the real Safe Wallet app almost exactly, including its latest product banner, making it difficult for users to distinguish between legitimate and fraudulent platforms. This scam operates by targeting users searching for 'gnosis safe', which represents the wallet's previous name before a 2022 rebrand. Security experts now warn that if the seed phrase may have been seen, treat the wallet as compromised, as this represents the most critical vulnerability in crypto wallet security.
Martin Köppelmann, co-founder of Gnosis and creator of the original Safe wallet, has criticized Google's advertising practices. According to CoinDesk, Köppelmann flagged the advertisement on X and argued that while Google often suspends legitimate crypto projects from its ad programs, the company continues to sell its top placement to scammers. He noted that in May, a fake Uniswap site drained roughly $400,000 from multiple wallets, while DeFiLlama recently allowed a fake App Store clone to drain a real wallet to pressure Apple into removing the scam listing.
Security experts recommend several protective measures for users to avoid similar scams. As reported by CoinDesk, these include bookmarking the official address once and using only that bookmark for future access, checking domain letters letter by letter before connecting to avoid lookalike letters like lowercase 'l' instead of uppercase 'I', and cross-checking links through the project's official X account or documentation. Users should also treat any unexpected signature or token approval requests as red flags, as these are common tactics used by fraudulent platforms to gain access to user accounts. Additionally, experts suggest rotating wallets on a monthly basis and considering software wallets or cold storage solutions that don't require transactions on public ledgers. Recent guidance emphasizes that if it's lost but you can still open the wallet, you have a window to fix it, making immediate action crucial when security incidents occur.
