Ledger reports that a ‘spy’ chip embedded in CryptoBilis Ledger devices transmitted wallet keys via mobile network
The hardware wallet manufacturer has publicly disclosed how a clandestine component in devices sold by CryptoBilis could have stolen users’ master keys without any modifications to Ledger’s software.
Ledger revealed that a covert implant in certain hardware wallets distributed by CryptoBilis captured users’ recovery phrases from device screens and sent them to attackers over an LTE mobile network.
Ledger characterized the thefts as a physical supply-chain attack that did not compromise its software, internal systems, secure element, or transaction-signing process.
Onchain researchers estimate that over 300 wallets lost up to $93.2 million.
According to Ledger’s investigation update on X on Tuesday, a covert hardware implant in some Ledger crypto wallet devices sold by Southeast Asian reseller CryptoBilis read users’ 24-word recovery phrases from the device screen and transmitted them to an attacker via a mobile phone network.
Ledger stated that the spy chip was located inside the device’s enclosure. When a user set up the signer and the screen displayed the recovery phrase, the implant’s microcontroller recognized and decoded the words, then transmitted them over LTE, a data transmission technology used by cellphones, utilizing an eSIM.
The recovery phrase serves as the master key to a crypto wallet. Anyone possessing it can recreate the wallet elsewhere and transfer funds without needing the physical Ledger device or altering any transactions on it.
This account provides the first public explanation of the mechanism behind the CryptoBilis-linked thefts. Ledger indicated that the implant did not modify the device’s secure Element, the chip designed to protect private keys, or its operating system. It also did not alter transactions or signatures. The incident was a physical supply chain attack rather than a breach of Ledger’s software or internal systems.
Ledger confirmed that one affected signer contained an unauthorized implant and that every confirmed loss in the October 9 incident involved a device sold by CryptBilis. The company stated it had not verified a theft involving a signer purchased elsewhere and was examining reports of implants in other devices and locations.
The French company has not confirmed the total number of victims or the value stolen. Onchain researchers, however, estimated the losses were up to $93.2 million across more than 300 wallets, with Tether freezing $10 million of its dollar-pegged stablecoin USDT tied to the theft.
CryptoBilis has stopped selling Ledger signers, according to Ledger. The company advised customers who purchased one from the reseller not to initialize it. Customers who have already used one should move assets to a new device with a newly generated recovery phrase, it said.
