Peter Bui Warns of Tampered Ledger Devices

Peter Bui has warned about reported thefts involving physically modified Ledger hardware wallets, citing approximately $80 million in losses in his video. His account centers on devices sold through Southeast Asian retailer CryptoBilis and the potential exposure of recovery phrases, a security concern relevant to holders of ADA and other crypto assets.

Hidden Hardware in Ledger Wallets

Drawing on posts from former Mt. Gox CEO Mark Karpelès and other community members, Bui reviews photographs of an additional electronic assembly inside Ledger Nano devices.

He describes a module with an eSIM component that could transmit information to an attacker. His explanation links the suspected implant to possible exposure of sensitive wallet data, including recovery phrases. The mechanism is presented as his account of the investigation.

Poor soldering, residual flux, and scratched-off chip markings feature in his examination of the photographs. Bui interprets the removed markings as an attempt to conceal the component’s identity.

His account follows investigators’ efforts to determine whether the problem extended beyond devices sold in Southeast Asia, before attention narrowed to CryptoBilis. He also relays a claim that public disclosure alerted the attackers, who subsequently drained compromised wallets. That sequence forms part of the information he recounts, rather than a finding independently established in the video.

A Fraudulent Ledger Email Adds Another Threat

The discussion moves from physical devices to impersonation when Bui displays an email received that morning. It presented itself as a Ledger security notification and invoked threats associated with new AI models. Checking the sender revealed Hive Management rather than the expected Ledger identity.

The example illustrates the phishing scenario he describes: an apparent security warning creates urgency, directs the recipient to a fraudulent website, and encourages installation of a supposed update.

Bui connects targeted messages of this kind to an earlier breach of Ledger customer information. Exposed email addresses, in his explanation, give scammers a way to approach people known to own hardware wallets.

He recommends purchasing directly from the manufacturer to reduce risks associated with intermediaries. His email example addresses a separate point of exposure after purchase, when an impersonator attempts to gain the owner’s trust.

Cardano Signing and Offline Storage

For his own Cardano transactions, including delegated representative activities, Bui uses a Keystone hardware wallet. QR code signing is the practical advantage he emphasizes, describing it as easier than working through lengthy transactions with repeated button presses on a Ledger.

He also advocates greater openness in wallet hardware, firmware, and software so their design can be examined. His Keystone discussion includes disclosure that he receives commissions through affiliate links below the video.

Paper wallets appear as another option for keeping access credentials offline, including for ADA holdings. Bui describes them as potentially the safest option at that moment and mentions encrypting private keys. This remains his personal assessment; the video does not demonstrate their setup or compare storage methods through security testing.

Returning to the suspected implants, Bui urges Ledger owners to inspect their devices and promises links to identification materials. His closing warning concerns the interval between exposure and theft: credentials could already be compromised while funds remain untouched, leaving an attacker able to act later.