Ledger details implant attack on CryptoBilis wallet sales
Ledger says a hidden implant in CryptoBilis-sold wallets read 24-word recovery phrases and sent them over LTE; it is tightening reseller checks as the inquiry continues.
By Web3 Hub Newsroom2 min read
Ledger said on Oct. 15 it was tightening reseller controls after criminals altered genuine devices to capture recovery phrases during setup, putting affected customers’ wallets at risk. In its response to the hardware implant attack, the company said the devices were returned to distribution through resellers in Southeast Asia.
How did the implant capture the recovery phrase?
The implant read the 24-word phrase from the device screen and sent it over LTE using an eSIM, Ledger said in an update reported by CoinDesk. Its microcontroller recognized and decoded the words when they appeared during setup.
Ledger described the incident as a physical attack on device distribution, not a compromise of its software, internal systems or secure element. The recovery phrase can be used to recreate a wallet and move its funds without the original device.
Which devices were affected, and what should buyers do?
Ledger said every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis, a Southeast Asian reseller. It confirmed one affected signer contained an unauthorized implant; it has not confirmed the total number of victims or the value stolen.
Ledger told CryptoBilis customers not to initialize unused devices. Customers who already used one should move their assets to a new device with a newly generated recovery phrase, the company said.
What changes is Ledger making to sales?
Ledger asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. It also told its reseller network that returned devices must never be resold, and directed stores to keep products off shelves and hand them to customers at purchase.
The company said it is working with law enforcement and the security community, and will share more technical details when it can. Its investigation into who tampered with the devices and where in the distribution chain it happened is ongoing.
References
- response to the hardware implant attack — ledger.com
- CoinDesk — coindesk.com