An owner of a Ledger Nano S hardware wallet, known by the pseudonym Anchor Drops, reported the theft of at least 10 BTC and raised questions with the device’s manufacturer.
According to the user, they also lost $1.5 million in NFTs.
“The wallet was purchased directly from you. The seed phrase was stored in a secure location and never entered online. I did not sign any malicious transactions. Everything is in my physical possession, and I haven’t used the device for two months. Can you explain what happened?” wrote Anchor Drops.
A community member under the pseudonym KDean responded, identifying a suspicious Ethereum transaction approved by the user on February 22, 2022, tagged as Fake_Phishing5443.
“Sorry to hear, man. Looks like the phishing happened a few years ago and just woke up,” he wrote.
This transaction explains the loss of NFTs, but it remains unclear how it could have contributed to the theft of bitcoins, noted Fuzzland’s lead security researcher Tony Ke in a comment to Cointelegraph.
Senior researcher at Cyvers, Hakan Unal, suggested that the perpetrator’s actions might have granted access to all blockchains supported by the wallet.
The Ledger team took a similar stance:
“As far as we know, the user fell victim to a phishing attack involving an ETH wallet. We suspect user error also occurred on the Bitcoin side.”
In response to Anchor Drops’ inquiries, the hardware wallet developers recommended contacting law enforcement to track and block the stolen assets. The support team assured their readiness to assist in the investigation.
“Ledger wallets have never been hacked remotely (or physically), such incidents often result from phishing attacks or pre-authorized approvals,” stated the Ledger team.
Back in December 2023, hackers compromised the Ledger Connect Kit library for decentralized applications, causing user losses of approximately $600,000.
