cryptographile

A security researcher just documented a large-scale counterfeit Ledger Nano S Plus operation selling compromised devices across multiple online marketplaces. The fake units look identical to the real thing but contain completely different hardware. Instead of Ledger's secure element chip, the counterfeits run an ESP32 microcontroller with modified firmware labeled "Nano S+ V2.1." Seeds and PINs are stored in plain text and transmitted to attacker-controlled servers. Any wallet initialized on the device is drained. The operation goes beyond the hardware. The sellers also distribute a fake version of Ledger Live built with React Native and signed with a debug certificate. It intercepts transactions and exfiltrates sensitive data to multiple command-and-control servers. The campaign spans five attack vectors: compromised hardware, Android APKs, Windows executables, macOS installers, and iOS apps distributed through TestFlight to bypass App Store review. This comes days after ZachXBT documented a separate fake Ledger Live app that made it through Apple's Mac App Store review process. That operation drained over $9.5 million from more than 50 victims, including musician G. Love, who lost 5.92 BTC after entering his recovery phrase into what he believed was the legitimate app. The pattern is clear: the attack surface for hardware wallet users has shifted from firmware exploits to supply chain and distribution fraud. The devices themselves remain secure. The problem is that users are being intercepted before they ever touch a real one. Ledger's own "genuine check" feature can be bypassed when the hardware itself is compromised at the source, which makes where you buy the device as important as how you use it. The rules haven't changed, but they've never been more important: buy hardware wallets only from the manufacturer. Never enter your recovery phrase into any software. If a companion app asks for your 24 words on a screen, it's a scam. Every time.

Happy Tax Day, New York. We’re taxing the rich.

BREAKING: President Trump says the US Navy will begin "blockading any and all ships" trying to enter or leave the Strait of Hormuz. "Any Iranian who fires at us, or at peaceful vessels, will be blown to hell," he says.

"There are reports that Iran is charging fees to tankers going through the Hormuz Strait — They better not be and, if they are, they better stop now!" - President DONALD J. TRUMP

JUST IN: 🇮🇷 Iran to require ships passing through the Strait of Hormuz to pay tolls in Bitcoin, FT reports.

Netanyahu just said that he wants to continue the war in Lebanon, in violation of the agreement Trump made. This is the first Israeli attempt to scuttle the ceasefire. Let's see how Iran responds - I think they'll fire more missiles at Israel now.