Ledger's security team discovered an unauthorized hardware implant in a wallet sold by Southeast Asian reseller CryptoBilis. The implant captures a device's 24-word recovery phrase during setup and transmits it via LTE. While Ledger has not confirmed the total number of affected users or the exact amount lost, on-chain investigators have traced over $86 million in suspected thefts.
The discovery of a hardware implant capable of stealing recovery phrases poses a significant risk to users of hardware cryptocurrency wallets, potentially leading to substantial financial losses and eroding trust in device security.
Ledger's security research team has identified an unauthorized hardware implant within a Ledger device, also known as a signer, sold by Southeast Asian reseller CryptoBilis. The implant, discovered on October 10th, is designed to capture the 24-word recovery phrase displayed during the device's setup process. According to Ledger's analysis, the implant's microcontroller decodes these words and transmits them via LTE using an embedded eSIM. Ledger emphasized that this implant does not alter the device's secure element or operating system, nor does it affect transaction signatures.
CryptoBilis has ceased sales of Ledger devices pending the outcome of the investigation. While Ledger has not officially confirmed the total number of affected users or the precise value of funds lost, on-chain investigator Specter has reportedly traced over $86 million in suspected thefts across Ethereum, Tron, and Bitcoin networks. Figures circulating online regarding losses have not been fully verified by Ledger.
The company is also investigating reports of similar implants in devices sold elsewhere and is reviewing claims of tampered devices purchased in Europe. Ledger has advised CryptoBilis customers who have not yet set up their devices not to proceed and to contact Ledger Support. Those who have already set up their devices are urged to move their assets to a new device with a new recovery phrase and to avoid entering any recovery phrase on a CryptoBilis-purchased device. Users who believe they have lost funds or possess a tampered device are instructed to file a report with local law enforcement and consult Ledger Support before attempting to open or send their device.
Pick the topics you care about. Get only what matters, on your cadence.