Ledger says ‘spy’ chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network
Ledger says ‘spy’ chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network
Ledger announces MediaMarket Saturn also stopped selling devices after a customer found a corrupted signer in Germany. It also it is investigating who tampered with the devices.
Updated Published
- Ledger said an unauthorized implant in some devices sold by Southeast Asian reseller CryptoBilis captured users’ 24-word recovery phrases from the screen and transmitted them over a mobile network.
- The company described the thefts as a physical supply-chain attack, not a breach of its software or internal systems, and said it was investigating where the devices were tampered with.
- Ledger urged CryptoBilis customers not to initialize unused devices and advised those who had used them to transfer their assets to a new device with a newly generated recovery phrase.
Covert hardware implanted in some Ledger crypto wallet devices sold by Southeast Asian reseller CryptoBilis read users’ 24-word recovery phrases from the gadget screen and sent them to an attacker over a mobile phone network, Ledger said Tuesday in an investigation update on X.
Ledger said the spy chip sat inside the device enclosure. When a user set up the signer and the screen displayed the recovery phrase, the implant’s microcontroller recognized and decoded the words, then transmitted them over LTE, a data transmission technology used by cellphones, utilizing an eSIM.
The recovery phrase is the master key to a crypto wallet. Anyone who has it can recreate the wallet elsewhere and move the funds without needing the physical Ledger device or changing any transactions on it.
The account is the first public explanation of the mechanism behind the CryptoBilis-linked thefts. Ledger said the implant did not modify the device’s secure Element, the chip designed to protect private keys, or its operating system. It also did not alter transactions or signatures. The incident was a physical supply chain attack rather than a breach of Ledger’s software or internal systems.
Ledger also took to X to announce that the investigations will continue until they determine who tampered with their devices and new policies around resellers.
“Ledger is reviewing its reseller controls and anti-tamper protections,” CTO Charles Guillemet said on X. “We invite researchers and other vendors to work with us on tamper-detection and chain-of-custody practices.”
Ledger CEO Pascal Gauthier said Ledger is “reviewing the controls that apply to our direct sales and to resellers, and we will share what we can.” He also said the CryptoBilis has topped selling Ledger signers and that the “investigation is ongoing to determine who tampered with these signers or where in the distribution chain it happened.”
Mark Karpeles, the former CEO of bitcoin exchange Mt. Gox, claimed he found a spy implant in a Ledger Flex bought at the Singapore Airport.
Ledger also released a statement on X saying MediaMarkt Saturn stopped selling its devices, following a report of a “spy” implant from one customer in Germany.
Ledger said it had confirmed one affected signer contained an unauthorized implant and that every confirmed loss in the Oct. 9 incident involved a device sold by CryptBilis. It said it had not verified a theft involving a signer purchased elsewhere and was examining reports of implants in other devices and locations.
The French company has not confirmed the total number of victims or the value stolen. Onchain researchers, however, estimated the losses were up to $93.2 million across more than 300 wallets, with Tether freezing $10 million of its dollar-pegged stablecoin USDT tied to the theft.
CryptoBilis has stopped selling Ledger signers, according to Ledger. The company told customers who bought one from the reseller not to initialize it. Customers who have already used one should move assets to a new device with a newly generated recovery phrase, it said.
UPDATE (Tuesday, Oct. 13 at 12:35 UTC): Adding quotes from Ledger CEO and CTO after fourth paragraph and information of a Ledger Flex bought at Singapore Airport that was allegedly tampered with.
UPDATE (Tuesday, Oct. 13 at 13:30 UTC): Adding Ledger announcement that MediaMarkt Saturn stopped selling Ledger devices after one in Germany was found with a “spy” implant.
