Skip to content

Back to the catalog

Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network
coindesk.comarticle

Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network

Ledger says some hardware wallets sold by the reseller CryptoBilis contained a covert implant inside the enclosure. Its microcontroller recognised the 24-word recovery phrase when it was displayed during setup and sent it to attackers over LTE using an eSIM. Ledger says its secure element, OS, transaction signing and internal systems were not compromised. Onchain researchers estimate up to $93.2M lost across more than 300 wallets, and Tether froze $10M of USDT. Ledger's guidance is not to initialize units bought from the reseller and to move funds to a new device with a fresh phrase if already used.

TL;DR Ledger says a hidden LTE/eSIM implant in CryptoBilis-sold wallets read seed phrases off the screen and exfiltrated them, with up to $93.2M stolen.
Open original ↗
Document

What it is

Ledger's first public account of the CryptoBilis-linked thefts. It is a physical supply-chain attack, not a software flaw. An implant inside the enclosure of some Ledger signers sold by the Southeast Asian reseller CryptoBilis read the recovery phrase off the screen during setup. Ledger posted the update on X on Tuesday (Oct. 13); the thefts are tied to an Oct. 9 incident.

How it works

The implant's microcontroller recognized and decoded the 24 words as they were displayed, then sent them over LTE using an eSIM. Because the attacker holds the phrase, they can rebuild the wallet elsewhere and move funds. No device access is needed, and nothing on the device is altered. Ledger says the secure element, OS, transactions and signatures were untouched, so on-device signing checks would not have caught this.

Preconditions / Affected

  • The unit was bought from CryptoBilis and the recovery phrase was shown on screen during setup.
  • Ledger has confirmed an unauthorized implant in only one signer.
  • Every confirmed loss in the Oct. 9 incident involved a CryptoBilis-sold device.

What to do

  • Do not initialize a Ledger bought from CryptoBilis.
  • If you already used one, move assets to a new device with a newly generated recovery phrase. Do not reuse the old phrase.

Caveats

  • Ledger has not verified a theft involving a signer bought elsewhere, but it is examining reports of implants in other devices and locations. Provenance outside CryptoBilis is not cleared.
  • Ledger has not confirmed total victims or value stolen. The up to $93.2M across more than 300 wallets figure is an onchain-researcher estimate, with $10M of USDT frozen by Tether.
  • CryptoBilis has stopped selling Ledger signers, according to Ledger.

Technologies named here

Techniques named here

  • Physical supply-chain attack

Threat actors named here

Related in Hardware & RF