Unchained

A hidden implant read Ledger seed phrases off the screen and sent them out over an eSIM. Mark Karpelès and SEAL 911's Jonty discuss what that means for self-custody.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at ⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.

— Laura

========================================================

An estimated $100 million or more has been drained from Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. The devices carried a hidden implant that reads the seed phrase off the screen and sends it out over an eSIM.

Jonty, founder of Pangolin Intelligence and a SEAL 911 contributor, and Mark Karpelès, CEO of Karpelès Lab, join Laura Shin to trace how the attack was found and how far it may reach.

They cover drains dating back to September 8, a tampered Ledger Flex bought from Metapod at Singapore's airport, the two MediaMarkt devices a buyer in Europe traced to distributor Aqipa, and Tether's $10 million freeze.

Mark argues Ledger's manual sends mixed signals by picturing the device's insides while warning that opening it voids the warranty, then opens a Nano X on camera to show what to look for.

The open question is whether self-custody's best defense against malware has become its newest attack surface.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guests:

⁠⁠⁠⁠⁠⁠⁠⁠⁠Mark Karpelès - CEO of Karpelès Lab Inc.

⁠⁠⁠⁠⁠⁠⁠⁠⁠Jonty - Founder of Pangolin Intelligence and Contributor to SEAL 911

Timestamps

🎬 00:00 Intro

🚨 03:50 How Jonty spotted the Ledger drains through SEAL 911 victim reports

📡 05:52 How the implant reads a 24-word seed phrase and sends it out by eSIM

🛫 11:33 Mark on the spy implant he found in a Ledger Flex bought in Singapore

🕵️ 15:16 CryptoBilis or a distributor? Mark and Jonty on who could be behind it

📣 17:38 Nexo: Generate daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🇪🇺 18:19 MediaMarkt and Aqipa: has the Ledger implant reached Europe?

🛒 27:00 Buying direct vs. through a reseller, and why Vietnam needs resellers

🔐 31:30 Ledger's 'tamper-proof' notice and whether self-custody is dead

🔧 36:45 Mark opens a Nano X on camera to show how to check for an implant

🧊 40:33 Tether's $10M freeze and why Jonty says recovery could take years
Learn more about your ad choices. Visit megaphone.fm/adchoices

A Ledger reseller's devices shipped with a hidden LTE modem inside. Taylor Monahan lays out how it passed the genuine check and why panicking now costs more.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at Nexo.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for.

⁠⁠⁠Our listener survey⁠⁠⁠ takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.

— Laura

========================================================

Genuine Ledger devices sold through the reseller CryptoBilis shipped with an LTE chip and eSIM wired inside, intercepting seed phrases on their way to the screen. The losses are estimated at $70 million to $100 million over roughly four months.

Kain Warwick, Taylor Monahan, and Austin Griffith trace how the implant passed Ledger's genuine check, why panicked users are now losing money to phishing and fake apps, and whether an iPhone or a DIY build makes a better hardware wallet.

They also cover the recording device planted in OpenAI's office, the decade-old XRP infinite mint bug that earned a $250K bounty, and why Taylor finds Google's Chrome payouts and $40K compute bills the more interesting math.

Then StarkNet's talk of becoming an L1 turns into a debate over whether Ethereum will need L2s at all. Kain's answer: the most Ethereum-equivalent chain is Ethereum itself.

Hosts:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Kain Warwick⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Host of Uneasy Money and Founder of Infinex and Synthetix

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Taylor Monahan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Security Expert

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Austin Griffith⁠⁠⁠⁠ - Co-host of Uneasy Money and Builder Enablement at Ethereum Foundation

Timestamps

🎬 00:00 Intro

🔐 01:32 Why a Ledger reseller became the entry point for a supply chain attack

📡 09:15 Taylor on how the CryptoBilis attack moved past fake devices and scratchers

🧯 19:01 Why Taylor says panicked Ledger owners now face the bigger risk

💸 20:17 Why Austin sees DIY hardware wallets as the future

🕵️ 30:34 How Taylor “demixed” Zcash by following the gas trail

📣 34:52 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🎙️ 35:37 What the bug planted in OpenAI's office says about AI espionage

🛠️ 41:42 Austin's homemade Alexa, blood wallet, and AI-run electronics bench

🪙 48:04 Why a decade-old XRP infinite mint bug points to AI-assisted hunting

🧮 51:04 Is $250K enough? Taylor compares the XRP bounty to Google's Chrome payout

⛓️ 01:00:30 StarkNet wants to become an L1: why Kain thinks that's where L2s end up

🏚️ 01:11:03 How MegaETH shows why L2 ecosystems struggle to keep their apps
Learn more about your ad choices. Visit megaphone.fm/adchoices

The boys regroup after TOKEN2049. Ledgers sold through CryptoBilis, an authorized reseller in Malaysia, came with an LTE implant that read seed phrases off the screen, an OpenAI engineer was caught with a listening device, Papertrade launches 1000x perps where losing money mints you tokens, and the hosts argue over Nikita Bier's claim that technical moats are dead.

Welcome to The Chopping Block, where crypto insiders Haseeb Qureshi, Tom Schmidt, Tarun Chitra, and Robert Leshner chop it up about the latest in crypto. This week is a late-night episode recorded right after TOKEN2049.

The hosts compare notes on a TOKEN2049 with zero Lambos and a quiet Marquee, then get into the CryptoBilis hack, where Ledgers sold by an authorized reseller in Malaysia came with a hidden chip and an eSIM that sent seed phrases home over LTE. Robert calls it a software supply chain attack made physical, Tarun explains it to a bar owner as North Korea buying the liquor distributor, and an OpenAI engineer caught with a listening device has Haseeb arguing that the choke points of a high-trust society are breaking down. Then Tom and Haseeb unpack Papertrade, the 1000x perps exchange where losing trades mint PAPER, and Tarun asks how long anyone will keep losing money for a token. Finally, Nikita Bier says technical moats are dead: Tarun half agrees, Haseeb calls it a fake story, and he explains why AI still writes investment memos like a growth investor.

Listen to the episode on Apple Podcasts, Spotify, Pods, Fountain, Podcast Addict, Pocket Casts, Amazon Music, or on your favorite podcast platform.

Show highlights

🔹 TOKEN2049 felt more institutional this year: Marquee was a normal nightclub all week, Franklin Templeton and Nasdaq took the stage, and Tarun saw zero Lambos.

🔹 Tarun says nothing in crypto feels like frontier tech anymore outside of Zcash and quantum, and remembers the robotic shrimp farm that pivoted into an L2.

🔹 Normal people have the Big Mac index; crypto people have the nightclub index.

🔹 Ledgers sold through CryptoBilis, an authorized reseller in Malaysia, carried a hardware implant with an eSIM that read the seed phrase off the screen and sent it over LTE. About $80 million was stolen.

🔹 CryptoBilis' founders say they sold the company to a Chinese buyer months ago and were under a confidentiality agreement until October 20th. Trezor has already cut off its authorized resellers.

🔹 Robert says someone has now prototyped buying a vendor to run a supply chain attack, and Tarun explains it to a bar owner as North Korea buying the liquor distributor.

🔹 Haseeb's PSA: buy hardware wallets directly from the manufacturer. Tom is skeptical of see-through cases and points to Ledger's honeypot problem.

🔹 An OpenAI engineer allegedly hid a recording device behind a TV in a conference room, and ChatGPT searches about how to build one gave it away.

🔹 Haseeb says the choke points of a high-trust society are breaking down as AI makes complex attacks easier, and Tom asks why nobody has tried to steal a frontier model's weights.

🔹 Papertrade offers 1000x leverage at Hyperliquid's mid-market price with zero slippage, losing traders mint PAPER, and it is doing about $32 million in weekly revenue.

🔹 Tom explains how Papertrade's house works and how one trader moved Hyperliquid's price to farm it. Tarun says everything hangs on the PAPER token.

🔹 Nikita Bier says technical moats are dead. Haseeb calls it a fake story: AI can one-shot a compiler, but nobody uses the one-shotted Photoshop clones.

🔹 Haseeb says the incumbents have AI too, Tarun says the superstar-engineer advantage is gone, and Robert explains why models never see the real investment memos.

Hosts

⭐️Haseeb Qureshi, Managing Partner at Dragonfly

⭐️Tom Schmidt, General Partner at Dragonfly

⭐️Tarun Chitra, Managing Partner at Robot Ventures

⭐️Robert Leshner, Founder & CEO of Superstate

Disclosures
Learn more about your ad choices. Visit megaphone.fm/adchoices

ARK Invest's Lorenzo Valente says quantum fears and the Ledger hack are speeding up the death of self-custody, that Ethereum has to pick a lane, and buybacks are “crazy.”

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at https://unchainedcrypto.com/go/nexo-podcast-sn.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.

— Laura

========================================================

Justin Drake warned that ECDSA, the cryptography securing Bitcoin and Ethereum, could break before Q-Day, in the worst case "in months, not years," and an attack on Ledger devices sold through a third-party reseller has led to about $100 million in losses. Lorenzo Valente, Director of Research, Digital Assets at ARK Invest, says both threats speed up a trend ARK already saw: self-custody is slowly dying.

He tells Laura Shin why ARK favors a barbell of exchanges that own the user and infrastructure like Solana, Uniswap, and Aave, and why he would point a first-time Bitcoin buyer to an ETF. They also cover Satoshi's coins, why Ethereum's L1 accrues so little while Robinhood makes millions, and why he calls the buyback craze irrational.

Plus: ARK's tokenized venture fund, Cloudflare's agentic commerce plans, and why Binance has never swapped out its USDT despite earning no yield. If he's right, crypto's next wave of users may never hold their own keys.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guest:

⁠⁠⁠⁠Lorenzo Valente - Director of Research, Digital Assets at ARK Invest

Timestamps

🔭 01:27 Why Lorenzo says crypto investing is moving from '0 to 1' to '1 to 100'

🧮 08:41 Justin Drake's ECDSA warning and why RIAs keep asking ARK about quantum

💸 16:42 Nexo: Generate daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🏋️ 17:31 The barbell: why Lorenzo favors exchanges and core crypto infrastructure

🪙 24:34 Satoshi's coins and why Lorenzo is less worried about Bitcoin's quantum fix

🔐 26:28 Ledger, Bitget, and why Lorenzo sees 'nowhere to hide' in hardware wallets

🍔 30:11 Ethereum's 'franchise model' and why Lorenzo says L1 value accrual is broken

🔥 38:04 Why Lorenzo thinks crypto has gone 'crazy' over token buybacks

📈 45:17 Why ARK thinks tokenized equities could pass stablecoin supply in 3 years

🤖 51:04 Cloudflare, AI bots, and why L1s are still orders of magnitude too slow

💵 54:05 Why Binance never dropped USDT, and what that says about Tether and Circle
Learn more about your ad choices. Visit megaphone.fm/adchoices

A bridging bug cost NEAR Intents $3.8 million. Alex Shevchenko reveals how a coded tweet and a Signal invite encrypted with the attacker's key got the funds back.

========================================================

Thank you to our sponsor!

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Visit⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ to swap tokenized securities, crypto and more. Simple. Secure. Self-custodial. Whatever asset you’re buying - swap it at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

========================================================

Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.

— Laura

========================================================

NEAR Intents halted services after an attacker exploited a bug in its Omni bridging infrastructure and walked off with $3.8 million. Twelve hours after announcing the hack, the team tweeted at the suspect: "We have identified you, sir."

Alex Shevchenko, GM of NEAR Intents, joins Laura Shin to walk through how the attacker got the protocol to credit USDT deposits on BNB Chain that never happened, why NEAR Intents covered the loss from its own pockets, and how a Signal invite encrypted with the attacker's public key opened a private channel that ended with the funds coming back, partly in XMR.

He also lays out how Shield, NEAR Intents' detection system, kept 99% of the more than $50 million tied to the Bitget hack from passing through, and why he thinks shielded Zcash could face Monero's fate.

His argument: crypto that protects thieves can never become the economic backbone its builders want.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guest:

⁠Alex Shevchenko - GM of NEAR Intents

Timestamps

🚨 01:43 How an Omni bridging bug let an attacker fake deposits and drain $3.8M

🌐 02:37 What NEAR Intents is, and how it relates to NEAR Protocol and near.com

⚙️ 05:01 How the hack worked and how the identified that it had occurred

💧 09:51 1inch Aqua: Back multiple positions with one token balance at https://1inch.com/aqua

🚔 10:55 Law enforcement, and how NEAR Intents identified a suspect within 12 hours

🔐 17:51 The Penn and Teller playbook: a Signal invite only the attacker could decrypt

🏎️ 22:52 Why Alex says a bug bounty beats hacking, Lambo included

🛡️ 26:24 Shield: how NEAR Intents kept 99% of Bitget hack funds off the protocol

⚖️ 32:07 Does blocking stolen funds make NEAR Intents centralized? Alex says no

🕶️ 40:17 Can shielded Zcash stay clean, or will it follow Monero's path?
Learn more about your ad choices. Visit megaphone.fm/adchoices