Skip to the article
Web3 Hub

Markets, protocols and policy, reported

Ledger says implant sent CryptoBilis wallet phrases over LTE

Ledger says a hidden implant in CryptoBilis-sold wallets read 24-word recovery phrases from device screens and sent them over LTE, exposing funds to theft.

By Web3 Hub Newsroom2 min read

Ledger says implant sent CryptoBilis wallet phrases over LTE

Ledger said on Tuesday, Oct. 13, that an unauthorized implant in some CryptoBilis-sold devices read users’ 24-word recovery phrases from the screen and transmitted them over LTE. The company’s investigation update, reported by CoinDesk, described a physical supply-chain attack that could let someone recreate a wallet and move its funds.

How did the implant capture the recovery phrase?

Ledger said the implant sat inside the device enclosure and used a microcontroller to recognize and decode the phrase when it appeared on the screen during setup. It then sent the words over a mobile network using LTE and an eSIM.

The recovery phrase can restore a wallet on another device, so an attacker with the words can access its funds without the original signer. Ledger said the implant did not alter the device’s Secure Element or operating system, and did not change transactions or signatures.

How many devices and losses has Ledger confirmed?

Ledger said all confirmed losses in the Oct. 9 incident involved devices sold through CryptoBilis, a Southeast Asian reseller, and described the number of affected devices as limited. It has not confirmed the total number of victims or the value stolen.

On-chain researchers estimated losses of up to $93.2 million across more than 300 wallets, CoinDesk reported; that figure is not a Ledger-confirmed total. BleepingComputer’s report on Ledger’s earlier statements said the company had confirmed an implant in at least one affected device and that CryptoBilis had suspended hardware-wallet sales.

What should CryptoBilis customers do next?

Ledger told customers who have not set up a CryptoBilis device not to initialize it. Those who already used one should move their assets to a new device with a newly generated recovery phrase, the company said.

Ledger said its investigation is continuing to determine who tampered with the devices and where in the distribution chain it happened. It is also reviewing reseller controls and anti-tamper protections.

References