Hidden Implant in Ledger Hardware Wallets Enables $93 M Crypto Theft; npm Trusted‑Publishing Flaw Exposes 1,500 Packages
What Happened — Researchers discovered a covert firmware implant in Ledger hardware wallets that was used to siphon roughly $93 million in cryptocurrency from users. In a separate supply‑chain issue, Bloom Security found that npm’s Trusted Publishing feature allowed an attacker to push malicious versions of more than 1,500 packages without ever compromising a maintainer’s credentials.
Why It Matters for Trust & Control Assurance
- The Ledger incident illustrates the risk of hidden code in third‑party hardware – a scenario continuous control‑assurance programs are built to detect, document, and remediate through supply‑chain risk monitoring.
- The npm flaw shows how inadequate package‑publishing controls can let adversaries inject malicious code at scale, underscoring the need for automated evidence collection on software‑supply‑chain controls.
- Both events map to the Supply‑Chain Risk Management control objective, which feeds into many frameworks (e.g., NIST CSF 2.0) and can be continuously validated with Verisq’s Vendor Risk Management capability.
Who Is Affected
- Crypto‑asset holders and custodial services that rely on Ledger or similar hardware wallets.
- Software developers, DevOps teams, and organizations that consume open‑source npm packages.
Recommended Actions
- Validate firmware integrity on all hardware wallets using cryptographic hash verification and maintain a trusted‑source inventory.
- Implement continuous third‑party risk monitoring – ingest vendor attestations, firmware signing logs, and supply‑chain provenance data into a central Trust Center.
- Enforce strict publishing policies for open‑source dependencies: require signed releases, enforce two‑person review, and monitor package registries for unauthorized version pushes.
- Collect and retain audit evidence (hashes, signing certificates, CI/CD logs) to demonstrate due diligence during regulator or auditor inquiries.
Technical Notes
- Ledger implant leveraged a stealthy boot‑loader modification that executed after user authentication, bypassing the device’s secure element.
- npm Trusted Publishing flaw required only registration of an abandoned GitHub repository name; no credential theft was needed. GitHub has issued a patch, but many packages remain exposed.