upvote
Selling Ledger wallets or compromised Ledger wallets? My understanding was a reputable reseller (Cryptobilis) was bought and then the wallets were modified via the reseller chain. This isn’t on Ledger it’s a (literal) supply chain attack. Unless MediaMarkt was buying via the reseller?
reply
according to this guy, compromised (https://x.com/0xJohannes_/status/2109240472933671125). Interestingly, Mediamarkt removed the device from their shop quickly after (https://www.mediamarkt.de/de/product/_ledger-sas-nano-s-plus... now 404).
reply
They would remove them regardless of known compromise, because they have no way to verify it in-house and it’s the simplest PR and legal strategy.
reply
> This isn’t on Ledger it’s a (literal) supply chain attack.

Supply chain attack?

"Can't do shit, not my problem."

If it was that easy to shed responsibility.

reply
TBF that characterization was mine. It’s not been Ledger’s response AFAIK.
reply
I don't know coin stuff, but if top comment's...

"We're talking here about a tiny eSIM implant and a little CPU doing OCR on the fonts appearing on the hardware wallet's screen to read the secrets during set up. So the secure element ain't tampered with."

...is accurate...it's one of the rare times I'd agree there's nothing they can do. And I was all prepared to storm in here saying "convenient excuse!"

reply
>there's nothing they can do

The device should have bricked itself after someone opened it up to put hidden stuff inside. Also showing the key phrase to the user instead of keeping it secret to the secure element is a questionable decision.

reply
people do need the option to repair devices, especially when they contain valuable information, so I don't see an automatic bricking to be a reasonable solution
reply
I would love to know if I can use one of this to get unlimited data worldwide.

Jokes aside, keystone wallets are air gapped. And not air gapped but awesome the lesser known but imo best of all, gridplus lattice1.

Heck, even a trezor, despite their mail provider being hacked, is better.

I, however, dont endorse the iPhone idea.

Just don’t buy ledger, terrible company. Many of my friends are getting endless spam because of them. The key backup is a disaster after they promised it was not possible to retrieve it. Their software stack is closed source.

This is imo the last nail in the coffin for them. They should refund all the money lost, and issue a worldwide recall.

Lots to hate about them.

reply
There's a medium. Something ironically close to apple's 'non fully approved and supply chained repair' thing (especially when we consider the case of a screen that could be OCRing data and tossing it out later).

'You have unexpected components. You may want to have your device inspected or risking compromise of x/y/z. Should we continue or lock it down'?

reply
If you can't back up your keys, then what?
reply
I'd rather have to buy another wallet than have to worry that someone is able to drain it.
reply
I wonder what the liabilities are for that
reply
Not much unless you can show that they knew about it. Otherwise, they are just as much a victim.
reply
They are liable. In Germany the seller of a product is responsible not the producer.
reply
Then they have to be insured. Or the limit of their liability must be capped at the cost of the product or something. Otherwise they would have to reverse engineer every product they carry and just about every retailer would run the risk of being out of business any time someone pulls something like this. That’s obviously not happening.
reply
I'd assume a company like that would have insurance for this. They'd be able to reimburse the customer knowing they'd get paid back from an insurance claim. That is, if they are actually insured for these kinds of losses.

A few years ago, the Canon camera battery supply chain was intermingled with knock offs. The seller I bought from was exchanging for legit batteries or reimbursement when a customer made a claim.

reply
Why doesn't it surprise me that the shittiest company Media Markt is somehow involved in this. These guys are about to close shop anyway, rest in piss Mediamarkt.
reply