Ledger says a covert implant in some devices sold by reseller CryptoBilis read users' recovery phrases off the screen and sent them to attackers over a mobile network. The company describes the thefts as a physical supply chain attack, not a breach of its software. Onchain researchers estimate losses of up to $93.2 million.
Covert hardware inside some Ledger devices sold by Southeast Asian reseller CryptoBilis captured users' 24-word recovery phrases and sent them to an attacker over a mobile phone network, Ledger said in an investigation update on X.
How the implant stole recovery phrases
Ledger said the spy chip sat inside the device enclosure. When a user set up the signer and the screen displayed the recovery phrase, the implant's microcontroller recognized and decoded the words, then transmitted them over LTE using an eSIM.
Anyone holding the recovery phrase can recreate the wallet elsewhere and move the funds without the physical hardware wallet. According to Ledger, the implant did not modify the Secure Element or the operating system, and did not alter transactions or signatures. Ledger's Donjon team found the mechanism, The Defiant reported.
Losses and the scope of the investigation
Ledger has not confirmed the total number of victims or the value stolen. Onchain researchers, however, estimated losses of up to $93.2 million across more than 300 wallets, and Tether froze $10 million of its USDT stablecoin tied to the theft.
Ledger said every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis. It is still examining reports of implants in other devices and locations.
One such report came from Mark Karpelès, who said on Oct. 13 that a Ledger Flex bought at Singapore airport was "confirmed to contain a spy implant". Buyer Ben Yorke named Metapod as the seller. The Defiant noted that no fund loss has been confirmed for this Flex, and that the purchase history and implant finding rest on Yorke's and Karpelès's accounts.
What Ledger tells customers
CryptoBilis has stopped selling Ledger signers, according to Ledger. Customers who bought one from the reseller should not initialize it, and those who already used one should move assets to a new device with a newly generated recovery phrase.
Ledger also cautioned holders of tampered devices against sending them to anyone before speaking with Ledger Support or local law enforcement.
Sources: CoinDesk, The Defiant
Trading involves risk.
Risk Disclaimer
