Ledger Finds Hidden LTE Implant That Stole Recovery Phrases From Wallets Sold by CryptoBilis

Ledger confirms hidden implant captured recovery phrases from CryptoBilis devices

Ledger announced on Tuesday that its security research team, called Donjon, found an unauthorized hardware implant inside wallets sold by a Southeast Asian reseller named CryptoBilis. The implant was able to read a wallet's 24-word recovery phrase during setup and send those words over mobile cellular data. Ledger confirmed the implant in one affected user's device on October 10 and disclosed the finding publicly on October 11.

A recovery phrase is a set of words that acts as the master key to a crypto wallet (a digital tool that holds cryptocurrency). Anyone who has that phrase can access the wallet and control the funds stored in it. The implant worked by capturing what appeared on the device's screen when the recovery phrase was displayed.

How the implant worked

• The implant sat inside the device's outer casing as a separate component.
• It read the screen during setup to capture the 24-word recovery phrase.
• A small computer chip inside the implant decoded the words and sent them out over LTE (cellular mobile data) using a pre-activated eSIM card.
• According to Ledger, the implant did not modify the device's secure chip, change the Ledger operating system, or alter any transactions or signatures. It only intercepted the recovery phrase.

What Ledger says about the scope of the incident

Ledger stated that every confirmed case of fund loss is tied to devices sold through CryptoBilis. The company said it has not verified any fund drain linked to a device purchased elsewhere. CryptoBilis confirmed that it stopped selling Ledger devices while the investigation continues.

Ledger has not confirmed how many users are affected or the total value lost. The company noted that figures circulating online come from third parties and have not been fully verified. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron, and Bitcoin, according to a report by Decrypt on Friday. Ledger has not independently confirmed that total.

Ledger is also looking at reports outside CryptoBilis

The company said it is reviewing reports of implants found in other devices and in other locations. One user on the social platform X claimed to have found two tampered Ledger devices purchased from retail stores in Europe, but that claim has not been independently verified.

Ledger also said that buyers who did not purchase from CryptoBilis can inspect the inside of their device using a guide published by the company. Ledger warned that opening a device can cause damage and urged users to back up their recovery phrase first.

Steps Ledger recommends for affected buyers

• If you bought from CryptoBilis and have not set up your device, do not set it up. Contact Ledger Support.
• If you already set it up, move your assets to a new device with a new recovery phrase as soon as possible.
• Do not enter or restore any recovery phrase on a device purchased from CryptoBilis.
• If you lost funds or hold a tampered device, file a report with local law enforcement. Do not open the device or send it to anyone before speaking with Ledger Support or police.

Ledger also reminded users that the company will never call, message, or ask for a recovery phrase. The Donjon team said it will analyze the devices it receives and share updates as the investigation continues.

Source

• Decrypt