Ledger says 'spy' chip inside Crypto
Ledger announced that a covert implant found inside some hardware wallets sold by Southeast Asian reseller CryptoBilis captured users' recovery phrases and transmitted them over LTE networks, constituting a physical supply-chain attack. The implant was located within the device enclosure and recognized recovery phrases displayed on the device screen, sending this data to attackers without affecting the device's secure element or operational software, according to Ledger. Onchain researchers estimated that over 300 wallets were compromised, with losses potentially reaching up to $93.2 million, including $10 million in USDT frozen by Tether. Ledger confirmed one affected device contained an unauthorized implant and advised affected customers not to initialize their devices, recommending they move assets to new wallets. The company has stopped selling Ledger signers through CryptoBilis and is investigating whether other devices and locations are affected.
