Skip to content

Back to the catalog

Ledger confirms spy chip implant behind wallet crypto thefts
bleepingcomputer.comarticle

Ledger confirms spy chip implant behind wallet crypto thefts

Ledger confirmed that devices sold by Southeast Asian reseller CryptoBilis carried an unauthorized hardware implant that drained users' crypto wallets. Researchers Mark Karpelès and Tibane Labs describe the implant: an STM32G431 MCU, eSIM and shielded LTE module hidden behind the OLED screen, which captures display output and button presses to recover the seed phrase and sends it out over LTE. The article covers two implant variants, the telltale antenna wire, and Ledger's guidance (avoid unauthorized resellers, move funds to a new seed). Ledger also warns that its Genuine Check cannot detect implants when the original Secure Element is intact.

TL;DR Tampered Ledger Nano X units from reseller CryptoBilis carried an LTE/eSIM spy implant that exfiltrated seed phrases; teardown details from Karpelès and Tibane Labs.
Open original ↗
Document

What it is

A supply-chain attack on Ledger hardware wallets sold through CryptoBilis, a Malaysia-based reseller. At least one device was confirmed by Ledger to carry an unauthorized hardware implant. The page calls the model "Ledger X" and "Ledger Nano X" interchangeably. Ledger has not said which models are affected. It describes the affected volume as "limited" and says all fund-drain reports trace to CryptoBilis devices.

How it works

The implant sits inside the case and captures display output and button presses to recover the seed phrase. It then sends the phrase out over LTE through an eSIM. Tibane Labs found two variants:

Variant 1Variant 2
PowerOriginal battery replaced with a smaller one, which powers both the implant and the walletOriginal battery kept
PlacementUnder the battery and antennaIn the foam-padding space under the OLED
AntennaTaped across the top of the battery and LTE moduleRuns along the top edge
ConcealmentNot statedMCU and eSIM markings scraped off
SourceAmazon Japan, China-based seller shipping from MalaysiaYahoo! Auctions Japan

Karpelès' sample appears to be variant 2. Tibane says it uses a designed, panelised flex PCB from a board house, not a hand-built one-off. That points to a manufactured, repeatable operation.

Preconditions / Affected

  • The device was bought outside Ledger's recommended channels, including marketplace sellers who ship from Malaysia and CryptoBilis.
  • Price was a signal. Tampered units were reportedly sold for nearly half the original price.
  • The page says no other Ledger resellers are known to be shipping compromised units. Ledger has also told authorized resellers not to restock returned products.

What to do

  • If you bought from CryptoBilis and have not set up the device, do not start setup.
  • If you already set it up, move assets to a new Ledger signer with a new seed.
  • Buy only from authorized resellers.
  • Open the case and look for an unexpected antenna wire along the top edge or across the battery. A smaller-than-stock battery is another sign. This is the only tell the page gives.

Caveats

  • Ledger's Genuine Check cannot detect added implants when the original Secure Element is intact. A passing check proves nothing here.
  • How and when the tampering happened is still unclear.
  • The device model is not confirmed by Ledger. It comes from researcher reports. Karpelès did not name CryptoBilis as the vendor of the device that was examined.
  • Ledger's formal confirmation covers one device so far.

Organisations named here

  • Karpeles Lab
  • Mark Karpelès
  • STM32G431KBU6
  • Tibane Labs

Technologies named here

  • Ledger X / Ledger Nano X hardware wallets
  • Ledger X unit bought on Yahoo! Auctions, Japan
  • Ledger
  • Ledger Genuine Check

Techniques named here

  • Supply-chain attack
  • Anti-analysis
  • Visual tell-tale
  • Sources

Threat actors named here

  • CryptoBilis

Related in Hardware & RF