Unauthorized hardware implants in Ledger wallets sold by CryptoBilis stole recovery phrases, leading to $90 million in losses. The implants transmitted the phrases via LTE during device setup, according to Ledger’s investigation.
What Happened
Ledger found covert cellular implants in some of its hardware wallet devices sold by Southeast Asian reseller CryptoBilis. The implants captured users’ 24-word recovery phrases from the screen during setup and transmitted them over a mobile network using an eSIM. Ledger confirmed the attack was a physical supply-chain issue, not a software breach. The implants did not modify the device’s secure Element or operating system and did not alter transactions or signatures.
How It Works
The spy chip sat inside the device enclosure. When a user set up the signer and the screen displayed the recovery phrase, the implant’s microcontroller recognized and decoded the words, then transmitted them over LTE. The recovery phrase is the master key to a crypto wallet; anyone who has it can recreate the wallet elsewhere and move funds without needing the physical device. Ledger said the implant is a separate component that reads what appears on the screen during wallet setup and uses a provisioned eSIM to send the data over a standard 4G cellular network.
The Numbers
Losses linked to the tampered devices exceed $86 million, according to blockchain investigator Specter. About $90 million has been stolen from individuals who purchased tampered Ledger wallets, according to estimates from crypto analytics firm Santiment. Ledger has not provided an official total for the losses, stating that figures circulating online come from third parties and have not been fully verified. The company emphasized that its infrastructure, systems, and services have not been compromised.
Key Players
Ledger, CryptoBilis, Tibane Labs, and Specter are involved in the incident. Tibane Labs identified three versions of the implant, with the latest purchased from a Japanese online marketplace and shipped from Malaysia. Ledger urged users who bought from CryptoBilis to avoid setting up unused devices and to transfer assets to new wallets with newly generated recovery phrases. CryptoBilis halted sales of all hardware wallets until the investigation concludes. Ledger is reviewing reseller controls and anti-tamper protections in response to the incident.
The Supply Chain Attack’s Scope and Unverified Claims
While Ledger has confirmed that all verified cases of tampered devices trace back to CryptoBilis, the incident has sparked broader concerns about the supply chain’s vulnerability. The company’s CTO, Charles Guillemet, emphasized on X that the investigation remains ongoing to determine where in the distribution chain the tampering occurred, noting that CryptoBilis was the top-selling reseller for Ledger signers in the affected regions. Ledger’s CEO, Pascal Gauthier, added that the company is reviewing controls for both direct sales and resellers, though he did not specify whether the tampering originated with CryptoBilis itself or a third-party supplier.
Separate claims of similar implants have emerged outside the confirmed CryptoBilis-linked cases. Former Mt. Gox CEO Mark Karpeles reported finding a spy implant in a Ledger Flex purchased at Singapore Airport, though Ledger has not independently verified this instance. The company also noted that German retailer MediaMarkt Saturn halted sales after a customer discovered a corrupted signer, suggesting the attack may have broader geographic reach than initially reported. Ledger’s statement on X did not confirm whether these devices were tied to CryptoBilis or another unauthorized distributor.
Tibane Labs’ research further complicates the scope, identifying three distinct implant variants, with the latest purchased from a Japanese online marketplace and shipped from Malaysia. This indicates the attackers may have multiple sourcing channels, potentially allowing tampered devices to enter markets beyond Southeast Asia. Ledger’s advisory to resellers—sourcing only from authorized channels and avoiding restocked returns—hints at concerns about counterfeit or repackaged devices entering the supply chain. The company has not disclosed whether any other resellers beyond CryptoBilis are under investigation.
Unverified Claims and Broader Supply Chain Risks
While Ledger has confirmed that all verified cases of tampered devices trace back to CryptoBilis, the incident has raised concerns about the potential for similar attacks elsewhere. German retailer MediaMarkt Saturn halted sales of Ledger devices after a customer reported discovering a corrupted signer, according to Ledger’s statement on X. The company did not confirm whether this device was linked to CryptoBilis or another unauthorized distributor, leaving open the possibility of broader tampering. Similarly, former Mt. Gox CEO Mark Karpelès claimed to have found a spy implant in a Ledger Flex purchased at Singapore Airport, though Ledger has not independently verified this instance.
Tibane Labs’ research further complicates the scope, identifying three distinct implant variants, with the latest purchased from a Japanese online marketplace and shipped from Malaysia. This suggests the attackers may have multiple sourcing channels, potentially allowing tampered devices to enter markets beyond Southeast Asia. Ledger’s advisory to resellers—sourcing only from authorized channels and avoiding restocked returns—hints at concerns about counterfeit or repackaged devices entering the supply chain. The company has not disclosed whether any other resellers beyond CryptoBilis are under investigation, but the presence of multiple implant versions raises questions about the attack’s origin and potential replication.
Ledger’s CTO, Charles Guillemet, emphasized on X that the investigation remains ongoing to determine where in the distribution chain the tampering occurred, noting that CryptoBilis was the top-selling reseller for Ledger signers in the affected regions. The company’s CEO, Pascal Gauthier, added that Ledger is reviewing controls for both direct sales and resellers, though he did not specify whether the tampering originated with CryptoBilis itself or a third-party supplier. Without further transparency, the risk of undetected implants in other regions remains a critical concern for users and industry observers alike.
Sources
- Ledger finds covert cellular implant stole hardware wallet recovery phrases from screens
- Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
- About $90 Million Was Drained Through Tampered Ledger Wallets. How to Check If Yours Is Safe
Photo: Motokoka (CC BY-SA 4.0)
