Ledger’s Genuine Check authenticates a wallet’s Secure Element but does not attest to the rest of the device, according to the company’s threat model, limiting what a passing check can establish.
Ledger’s Donjon threat model describes a process in which the Secure Element responds to a challenge from a Ledger server. That exchange verifies the security chip’s authenticity, the document says. It does not establish whether other hardware in the wallet has been changed if the original chip remains installed.
Former Mt. Gox CEO Mark Karpelès said Ledger Support had presented the chip as a way to spot physical tampering. He argued that an add-on designed to intercept signals should therefore cause the check to fail. His account of the support exchange is unverified.
In an Oct. 15 response, Ledger said genuine devices had been altered after leaving its control, with hidden components added to capture recovery phrases during setup. The devices later returned to circulation through resellers in Southeast Asia, the company said. Ledger described the incident as a localized distribution-channel attack and said its Secure Element, operating system and servers were not compromised.
The company’s account places the changes in the distribution channel; users whose wallets were drained bore the losses. EconoTimes previously covered a fake Ledger update page warning after the device-tampering case.
Ledger said it would publish more details about the incident but gave no date for that update.
