Ledger Says Spy Chip in CryptoBilis Ledger Devices Transmitted Wallet Keys Over Mobile Network

The hardware wallet manufacturer has issued its first public report on how a hidden component in devices sold by CryptoBilis could steal users' master keys without any change to Ledger software.

Ledger said in a research update on X on Tuesday that hidden hardware embedded in some digital ledger wallets sold by Southeast Asian vendor Cryptobilis reads users' 24-word recovery phrases from the gadget's screen and sends them to an attacker over a mobile network.

Ledger said the spy chip was inside the device's housing. When the user set the signer and the display showed the recovery phrase, the implant's microcontroller recognized and decoded the words, then sent them over LTE, a data transmission technology used by cell phones, using the eSIM.

The recovery phrase is the master key of the crypto wallet. Anyone who owns it can rebuild the wallet elsewhere and transfer funds without needing a physical Ledger device or changing any transactions on it.

This account is the first public explanation of the mechanism behind the thefts associated with CryptoBilis. Ledger said the implant did not alter the device's secure element, a chip designed to protect private keys, or its operating system. Nor did it change deals or signatures. The incident was a physical attack on the supply chain rather than a breach of ledger software or internal systems.

Ledger said it confirmed that one of the affected signers contained an unauthorized implant, and that any confirmed damage in the Oct. 9 incident involved a device sold by CryptBilis. The agency said it has not confirmed a theft involving a signer purchased elsewhere and is investigating reports of implants in other devices and locations.

The French company has not confirmed the total number of victims or the value stolen. However, Onchain researchers estimated losses in more than 300 wallets to be up to $93.2 million, while Tether froze $10 million of its USDT stablecoin linked to the theft.

According to the ledger, CryptoBilis has stopped selling ledger signers. The company has told customers who bought one from a dealer not to initialize it. Customers who have already used it should transfer the assets to a new device with the newly generated recovery phrase.

Diversified RWA stablecoins maintain a 5-7% return on real credit as crypto funding drops to 4%. GENIUS increases performance off-chain. TAM increases to $4 billion in 3 years.