Uneasy Money: Why Ledger's Supply Chain Became a Nearly $100M Target
Uneasy Money: Why Ledger's Supply Chain Became a Nearly $100M Target
2 hours ago•Unchained•Laura Shin
Podcast1 hr 18 min
Listen to Episode
Note: AI-generated summary based on third-party content. Not financial advice. Read more.
Quick Insights
  • For meaningful crypto holdings, buy hardware wallets only through trusted channels and consider a simple multisig setup; don’t respond to urgent security warnings or use overly complex backups.
  • ETH has a constructive capacity-expansion outlook, but the discussion gave no price target or specific buy recommendation.
  • Treat STRK as a speculative watchlist asset: a possible Layer-1 transition could attract interest, but confirm it is retaining applications and users before investing.
Detailed Analysis

Ledger and Trezor (Private companies; hardware-wallet sector)

  • The discussion described a supply-chain attack involving genuine Ledger devices sold through a reseller. The devices reportedly passed Ledger’s genuine-device check but had added components intended to transmit seed phrases. The hosts estimated that roughly $70 million to $100 million was stolen over several months.
  • They emphasized that reports of losses from the modified devices should be distinguished from losses caused by panic-driven phishing, fake apps, and fraudulent calls.
  • The hosts said they still use Ledger and Trezor devices, but would be more careful about where they buy them. They also discussed using multisig and keeping funds across multiple, understandable custody arrangements rather than relying on one device or an overly elaborate backup scheme.

Takeaways

  • Hardware-wallet companies and their authorized distribution channels face a serious security challenge; trust in the supply chain is part of the product’s value.
  • For crypto holders, the practical lesson was to buy through trusted channels, avoid acting in response to urgent warnings, and consider a clear multisig setup for significant holdings. The hosts also warned that overly complicated backup arrangements can themselves lead to lost funds.
  • Ledger and Trezor were discussed as products and companies, not as publicly traded stock opportunities.

Ethereum (ETH) and Layer-2 networks

  • The hosts argued that Ethereum is working to expand its own capacity, which could weaken one traditional reason for using Layer-2 networks: cheaper, more plentiful blockspace.
  • They disagreed on how far that shift will go. One host suggested Layer-2s may become less necessary; another said they could still be useful for consumer applications needing fast, low-cost transactions.
  • Starknet was discussed as an example of a Layer-2 considering a move toward Layer-1 status. The conversation also noted that Layer-2s can struggle to retain applications and users.

Takeaways

  • The discussion presented a mixed outlook for Layer-2s: Ethereum’s capacity improvements could pressure their value proposition, while speed and cost advantages may still support particular use cases.
  • For ETH, the conversation was constructive about Ethereum’s ability to expand its base-layer capacity, but it did not offer a price target or a specific buy recommendation.

Starknet (STRK)

  • Starknet is considering becoming a Layer-1. The hosts suggested that, if investors assign Layer-1 networks a valuation premium, that transition could improve the market’s view of Starknet. They also noted that announcements of this kind can drive token interest.
  • Starknet said it expects to be quantum-resistant by 2027. The hosts treated that as an ambitious technical goal, while questioning how durable such an advantage would be if other networks adopt similar capabilities.
  • The discussion raised ecosystem concerns: applications can leave a network, and Starknet’s former association with dYdX did not ensure that the exchange would remain there.

Takeaways

  • The potential Layer-1 transition and quantum-resistance plan are possible catalysts, but the discussion did not establish that either will translate into lasting adoption or token value.
  • Assess Starknet’s application activity and ability to retain users alongside its technical roadmap; the hosts did not make a specific STRK recommendation or price forecast.

XRP (XRP)

  • The hosts discussed the discovery of an infinite-mint vulnerability in XRP’s code. They said a $250,000 bug bounty was paid and did not describe an exploit of the flaw.
  • Some observers argued the bounty was too small relative to the value at stake. The hosts countered that $250,000 is a substantial reward and noted that large technology companies also set limits on bug-bounty payouts.

Takeaways

  • The incident highlights that even long-established crypto networks can have serious vulnerabilities.
  • For investors, security disclosures and how a project handles them are relevant due-diligence considerations. The transcript did not offer a price outlook or trading recommendation for XRP.

Bitcoin (BTC)

  • Bitcoin was mentioned in a hypothetical discussion about how valuable crypto assets can make supply-chain attacks worthwhile. $80,000 was used rhetorically as an example of a high Bitcoin price, not as a forecast or target.

Takeaways

  • The comments were about security incentives, not Bitcoin’s investment outlook. No buy, sell, or price-target recommendation was made.

Zcash (ZEC), Monero (XMR), Tornado Cash, and Tether (USDT)

  • The hosts said Zcash and Monero remain meaningfully private for ordinary users, but that large, hurried transactions can become easier to trace when users make mistakes in how funds move.
  • They noted that USDT is attractive to attackers for its liquidity but can be frozen, which may encourage rapid transfers into other assets or services.
  • Tornado Cash was mentioned in the context of tracing transactions across services, not as an investment recommendation.

Takeaways

  • The discussion did not present a bullish or bearish investment thesis for ZEC, XMR, USDT, or Tornado Cash.
  • The investment-relevant point was that privacy tools and stablecoins have distinct limitations: privacy can be undermined by transaction patterns, while centralized stablecoins can carry freeze risk.

NEAR (NEAR) and Solana (SOL)

  • NEAR was used as a comparison in the discussion of whether Starknet might seek Layer-1 status. The hosts questioned why a network perceived as a Layer-1 could receive a higher valuation than a project still operating as a Layer-2.
  • Solana was mentioned as an example of a network that may be better positioned than many chains to support its own ecosystem. Neither asset received a detailed investment analysis.

Takeaways

  • These were comparisons about network positioning, not recommendations to buy NEAR or SOL. The transcript offered no price targets or specific investment thesis for either.

Nexo (NEXO platform; no ticker discussed)

  • A sponsor described Nexo as a digital-assets platform offering daily interest on crypto and borrowing against crypto holdings. The ad cited more than 10 million clients and noted that geographic restrictions, eligibility rules, and terms apply.

Takeaways

  • The transcript provided no interest rates, detailed product terms, or independent evaluation of the platform. Treat the sponsor’s statements as advertising rather than a vetted investment recommendation.

AI and hardware infrastructure

  • The hosts discussed AI-assisted hardware building and the possibility of more people experimenting with DIY hardware, Linux, and hardware wallets.
  • They also discussed local AI computing, including a reported $2.5 million GPU-cluster purchase and the high memory requirements of some models. The conversation portrayed local models as potentially appealing for control and privacy, but acknowledged that the expense may not be worthwhile compared with using leading cloud models.
  • OpenAI and Anthropic were discussed as holders of valuable intellectual property, but no public stock ticker or investment recommendation was given.

Takeaways

  • AI hardware and local computing were presented as emerging technology themes, not as specific investment opportunities.
  • The discussion offered no valuation analysis or recommendation for publicly traded AI, semiconductor, or hardware companies.

NFTs and Blur

  • The hosts described Blur’s shutdown as “the end of an era” and joked about holding NFTs that may become worthless. The tone was negative about the experience of accumulating NFTs with little lasting value.

Takeaways

  • The comments reflect skepticism about NFT-marketplace activity and the durability of some NFT holdings, but provide no specific market forecast or recommendation.
Ask about this postAnswers are grounded in this post's content.
Episode Description
A Ledger reseller's devices shipped with a hidden LTE modem inside. Taylor Monahan lays out how it passed the genuine check and why panicking now costs more. ======================================================== Thank you to our sponsor! Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients. Find out more at Nexo. Geo-restrictions, eligibility and terms apply. ======================================================== Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for. ⁠⁠⁠Our listener survey⁠⁠⁠ takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18. — Laura ======================================================== Genuine Ledger devices sold through the reseller CryptoBilis shipped with an LTE chip and eSIM wired inside, intercepting seed phrases on their way to the screen. The losses are estimated at $70 million to $100 million over roughly four months. Kain Warwick, Taylor Monahan, and Austin Griffith trace how the implant passed Ledger's genuine check, why panicked users are now losing money to phishing and fake apps, and whether an iPhone or a DIY build makes a better hardware wallet. They also cover the recording device planted in OpenAI's office, the decade-old XRP infinite mint bug that earned a $250K bounty, and why Taylor finds Google's Chrome payouts and $40K compute bills the more interesting math. Then StarkNet's talk of becoming an L1 turns into a debate over whether Ethereum will need L2s at all. Kain's answer: the most Ethereum-equivalent chain is Ethereum itself. Hosts: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Kain Warwick⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Host of Uneasy Money and Founder of Infinex and Synthetix ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Taylor Monahan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Security Expert ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Austin Griffith⁠⁠⁠⁠ - Co-host of Uneasy Money and Builder Enablement at Ethereum Foundation Timestamps 🎬 00:00 Intro  🔐 01:32 Why a Ledger reseller became the entry point for a supply chain attack 📡 09:15 Taylor on how the CryptoBilis attack moved past fake devices and scratchers 🧯 19:01 Why Taylor says panicked Ledger owners now face the bigger risk 💸 20:17 Why Austin sees DIY hardware wallets as the future 🕵️ 30:34 How Taylor “demixed” Zcash by following the gas trail 📣 34:52 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt  🎙️ 35:37 What the bug planted in OpenAI's office says about AI espionage 🛠️ 41:42 Austin's homemade Alexa, blood wallet, and AI-run electronics bench 🪙 48:04 Why a decade-old XRP infinite mint bug points to AI-assisted hunting 🧮 51:04 Is $250K enough? Taylor compares the XRP bounty to Google's Chrome payout ⛓️ 01:00:30 StarkNet wants to become an L1: why Kain thinks that's where L2s end up 🏚️ 01:11:03 How MegaETH shows why L2 ecosystems struggle to keep their apps Learn more about your ad choices. Visit megaphone.fm/adchoices
About Unchained
Unchained

Unchained

By Laura Shin

Crypto assets and blockchain technology are about to transform every trust-based interaction of our lives, from financial services to identity to the Internet of Things. In this podcast, host Laura Shin, an independent journalist covering all things crypto, talks with industry pioneers about how crypto assets and blockchains will change the way we earn, spend and invest our money. Tune in to find out how Web 3.0, the decentralized web, will revolutionize our world. Disclosure: I'm a nocoiner.