According to Kaspersky security experts, a modified hardware wallet has been implicated in the theft of nearly $30,000 worth of cryptocurrency.
The loss of 1.33 BTC ($29,585) was related to new tactics, the company explained in a report shared with Infosecurity
“Hardware wallets have long been considered one of the safest ways to store cryptocurrency, but cybercriminals have found new ways to profit by selling infected or fake devices to unsuspecting victims,” commented Stanislav Golovanov, cyber incident investigation expert.
The victim in this case did not make any transactions on the day the money was stolen and the cold wallet was not connected to a computer. Therefore, they only realized the theft later.
Learn more about crypto theft here: ‘Kekw’ malware in Python packages could steal data and hijack crypto
Kaspersky’s investigation discovered that the hardware wallet the victim purchased had been tampered with. Although it looked the same as the original, it was not properly welded and held together with glue and tape.
Security experts explained that the attackers made three modifications to the original bootloader and wallet firmware: they disabled protection mechanisms; replaced the random starting sentence with one of the 20 preset sentences; and only used the first character of any additional passwords.
This gave the attackers 1280 options to access the fake wallet key. As a result, attackers were able to operate the disabled crypto wallet undetected as it appeared to be operating normally. However, the attackers were in full control from the start.
Also, the microcontroller inside the device was different and had read protection mechanisms, and the flash memory was completely disabled. This led Kaspersky researchers to conclude that the victim had unknowingly purchased an already infected hardware wallet.
To keep crypto assets safe, Kaspersky experts advised buying hardware wallets only from authorized sources, inspecting for signs of tampering, verifying firmware and securing initial phrases with a strong password.
The discovery comes months after an American man was accused of fraudulently obtaining 0 million worth of cryptocurrency from the Mango Markets exchange and its clients.
Source link
A recent cybersecurity breach has highlighted a dangerous new trend – adroit cybercriminals are targeting hardware wallets, hoping to gain access to funds stored in them.
Ikaroa, a tech company that focuses on cybersecurity solutions, has identified a concerning exploitation of hardware wallets that resulted in a large theft of nearly $30,000 USD. The malicious actors were able to gain access to the wallets by exploiting vulnerabilities in the hardware itself.
The hackers were able to gain control of the wallet access codes by phishing emails directed to individuals who were using the wallet. Once they had access to the codes, they were able to gain access to the stored funds and transfer them out of the wallet to their own anonymous accounts.
Ikaroa’s analysis of the incident determined that the systems used to manage wallet access are vulnerable to attack. To prevent any future vulnerabilities, it is essential that wallet owners take extra precautions such as using strong passwords, preventing access to phishing emails, and changing access codes regularly.
It is also important for individuals using hardware wallets to make sure their wallets are kept up to date with the latest security updates and that they understand the associated risks. Additionally, it is highly recommended to avoid using the same wallet for multiple transactions or transactions of large value.
Ikaroa is committed to providing users with secure and reliable solutions to protect their digital assets. Our solutions are designed to keep wallet owners safe from cyber attacks and help protect their funds from theft.
With incidents such as this cyber-criminal exploit becoming more common, it is essential that individuals and businesses work together to ensure their wallets are secure and their funds are kept safe. As more security measures are introduced, and if wallet owners take extra precautions, these types of thefts will become increasingly difficult to execute.
