$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant

What it is

A supply-chain compromise of Ledger hardware signers sold through the Southeast Asia reseller CryptoBilis. Someone along the distribution chain manually soldered an unauthorized hardware implant onto the circuit boards. The theft was disclosed on October 9. On October 13, Ledger confirmed that every confirmed fund loss involved a CryptoBilis-sold signer.

How it works

The implant sits inside the enclosure and reads the data shown on the screen. During setup the signer displays the 24-word recovery phrase. When the implant detects those screens, its microcontroller decodes the words and sends them over LTE using a provisioned eSIM.

The implant only intercepts information. It does not modify the device's OS, transactions or signatures. So the device behaves normally and signs correctly, and the attacker simply ends up holding the seed.

Preconditions / Affected

• The signer was bought through CryptoBilis, the only channel Ledger links to confirmed losses.
• The recovery phrase was displayed during setup on the compromised device. Ledger's advice implies that a device not yet set up has not exposed its seed.
• Ledger's advice is scoped to purchases in the last 90 days.

What to do

Ledger's guidance, quoted from the page:

• If you bought from CryptoBilis in the last 90 days and have not started setup, do not initiate setup.
• If you have set up the device, "consider moving assets to a new Ledger signer (with new seed)."

Moving funds to a new seed is the point. Re-initializing the same device, or restoring the same phrase elsewhere, would not help, because the attacker already holds that phrase. The page gives no detection method, such as how to check a unit for the implant. Ledger told the reseller to stop selling its devices and told customers to stop using them.

Caveats

• The $86M figure comes from on-chain investigator Specter ("may top $86 million"). Ledger says it has not confirmed the number of affected users or the total stolen.
• The page does not say how many devices were tampered with, or at which point in the chain the modification happened.
• The 90-day window is Ledger's guidance for purchases. The page does not say that older purchases are safe.