Skip to main content
Blockfront

Crypto markets, protocols and policy

Ledger says CryptoBilis devices hid LTE chips that stole recovery phrases

Ledger says hidden LTE implants in devices sold by CryptoBilis captured wallet recovery phrases during setup; the company is reviewing reseller controls.

Blockfront Editorial

2 min read

Ledger says CryptoBilis devices hid LTE chips that stole recovery phrases

Ledger said on Oct. 13 that an unauthorized implant in some devices sold by Southeast Asian reseller CryptoBilis captured users’ 24-word recovery phrases and sent them over LTE, exposing wallets to theft. The company’s findings, reported by CoinDesk, describe a physical attack on devices after they left Ledger’s control.

How did the implant capture recovery phrases?

Ledger said the implant sat inside the device casing and used a microcontroller to recognize and decode the words displayed on screen during setup. It then transmitted them over LTE using an eSIM, according to the company’s investigation update.

A recovery phrase can recreate a wallet elsewhere, allowing whoever has it to move the funds without the physical device. Ledger said the implant did not alter the Secure Element, operating system, transactions or signatures.

How many wallets were affected?

Ledger has not verified the total number of victims or the value stolen. Onchain researchers estimated losses of up to $93.2 million across more than 300 wallets, CoinDesk reported; Ledger said the figures were not confirmed.

Ledger said all confirmed losses in the Oct. 9 incident involved devices sold by CryptoBilis. The company has also examined reports of implants in other devices and locations, but has not confirmed theft involving a Ledger signer bought elsewhere.

What is Ledger changing?

In its Oct. 15 response, Ledger said it asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong while it investigates. It also directed sellers to keep devices off display and hand them to customers at purchase.

Ledger said CryptoBilis stopped selling its signers. It advised customers who bought an unused device from the reseller not to initialize it; those who already used one should move assets to a new device with a newly generated recovery phrase. The investigation into who tampered with the devices and where remains ongoing.

Sources and documents