Ledger: Spy Chip in CryptoBilis Wallets Sent Keys Over Mobile Network
Ledger says covert hardware inside devices sold by CryptoBilis read recovery phrases from screens and sent them to attackers over LTE. It calls the thefts a physical supply-chain attack, not a software breach.
A covert implant in some CryptoBilis-sold Ledger devices grabbed users' 24-word recovery phrases off the screen and transmitted them over a mobile network, Ledger says. More than 300 wallets may have lost up to $93.2 million, per onchain researchers.
CryptoBilis-sold Ledger devices had a nasty extra, according to Ledger: a covert chip that watched the screen and snitched your seed phrase. The company gave its first public account Tuesday on X.
The spy inside the box
Ledger said the implant sat inside the device enclosure. When a user initialized the signer and the recovery phrase appeared on screen, the chip’s microcontroller recognized and decoded the words, then transmitted them over LTE using an eSIM. The recovery phrase is the master key to a crypto wallet. Anyone who has it can recreate the wallet elsewhere and move the funds without needing the physical Ledger device.
Ledger said the implant did not modify the device’s secure element, its operating system, transactions, or signatures. It called the thefts a physical supply-chain attack rather than a breach of Ledger’s software or internal systems.
The damage
Ledger said it had confirmed one affected signer contained an unauthorized implant and that every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis. It has not confirmed total victims or value stolen. Onchain researchers estimated losses of up to $93.2 million across more than 300 wallets. Tether froze $10 million of its USDT tied to the theft. CryptoBilis has stopped selling Ledger signers, Ledger said.
The takeaway: Ledger says customers who bought from CryptoBilis should not initialize the device. If you’ve already used one, move assets to a new device with a newly generated recovery phrase.
Summary written by Oh Cannot from the original report by CoinDesk. Not financial advice.
