Ledger says hidden chips sent CryptoBilis wallet phrases over LTE

Ledger says an unauthorized chip hidden inside some devices sold by Southeast Asian reseller CryptoBilis copied users’ 24-word recovery phrases during setup and sent them over a mobile network. The phrase can unlock a wallet’s funds, so anyone whose phrase was exposed could lose their crypto. Ledger’s investigation update says attackers opened genuine devices, fitted hidden parts and returned them to distribution through resellers.

How did the chip capture the recovery phrase?

When a user set up an affected device, its screen showed the recovery phrase. Ledger’s security team says the implant read the words from the display, then sent them over LTE, a mobile data network, using an embedded SIM. A recovery phrase is a set of words that can restore access to a crypto wallet.

Ledger says the implant did not change the device’s Secure Element, the chip designed to protect its keys, or its operating system. The company described the incident as a physical attack on distribution after devices left its control, rather than a breach of Ledger’s systems. Its team says it is still investigating who tampered with the devices and where in the distribution chain it happened.

How many wallets were affected?

Ledger has confirmed at least one device with an unauthorized implant and says every confirmed loss in the Oct. 9 incident involved a signer sold by CryptoBilis, according to CoinDesk’s report on Ledger’s findings. Ledger has not confirmed the total number of victims or the value stolen. CoinDesk reported that onchain researchers estimated losses of up to $93.2 million across more than 300 wallets. That figure is an estimate, not a total confirmed by Ledger.

Ledger says it examined devices bought from stores and samples from warehouses, and found those units clean. It has asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong while it investigates. The company says it is working with law enforcement and security researchers to trace funds and investigate the attackers’ infrastructure.

What should CryptoBilis buyers do?

Ledger says buyers who have not set up a CryptoBilis device should not initialize it. People who have already used one should move their assets to a new device with a newly generated recovery phrase. The company says it will publish more technical details later. It has not said who implanted the chips or exactly how many devices were altered.

References

• investigation update — ledger.com
• CoinDesk’s report on Ledger’s findings — coindesk.com