Ledger says 'spy' chip inside Crypto
Reported by CoinDesk · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
Ledger revealed that some hardware wallets sold by Southeast Asian reseller CryptoBilis contained a covert implant that captured users’ 24-word recovery phrases from the device screens and transmitted them to attackers over an LTE mobile network. This implant was embedded inside the device enclosure and operated as a physical supply-chain attack, not by compromising Ledger’s software, internal systems, or secure element. Onchain researchers estimated that over 300 wallets were affected, resulting in losses up to $93.2 million.
Why it matters
This development highlights a novel method of theft involving hardware wallet supply chain tampering rather than software vulnerabilities. The recovery phrase is the master key to accessing crypto wallets, so its compromise allows attackers to drain funds without needing the actual device or altering transaction data. The incident underscores security risks specific to hardware wallet distribution and reseller channels.
Key context
Ledger clarified that the implant did not change the device’s secure element, operating system, or how transactions are signed. The attack relied on physical tampering before the device reached customers, detected during initial user setup when the recovery phrase is first displayed. CryptoBilis has ceased selling Ledger devices, and affected customers are advised to avoid initializing devices purchased from that reseller or to transfer assets if already used.
Key numbers and entities
Ledger, CryptoBilis reseller, and onchain researchers involved; estimated losses amounted to $93.2 million spanning over 300 wallets. Tether froze $10 million of USDT tied to the theft. The implant used LTE and an eSIM to transmit data.
What remains unclear
Ledger has not confirmed the total number of victims or the full value stolen from the affected wallets. It is unclear whether devices sold through other channels were also compromised, though investigations continue. Details on the exact technical characteristics of the implant and how widely this method has been employed remain unspecified.