Ledger Alleges CryptoBilis Devices Used Hidden Chip to Transmit Wallet Keys

Ledger has announced that it will reassess its reseller policies and continue investigating to identify those responsible for tampering with the affected devices.

In an investigation update posted on X on Tuesday, Ledger said hidden hardware installed in some of its crypto wallet devices sold through Southeast Asian reseller CryptoBilis captured users’ 24-word recovery phrases from the device screen and transmitted them to an attacker through a mobile network.

According to Ledger, the concealed chip was placed inside the device casing. When users configured their signing device and the recovery phrase appeared on the screen, the implant’s microcontroller identified and decoded the words before sending them over LTE using an embedded SIM (eSIM).

A recovery phrase serves as the master key to a cryptocurrency wallet. Anyone who obtains it can restore the wallet on another device and transfer its funds without possessing the original Ledger hardware or modifying transactions on that device.

Ledger’s statement provides the first public explanation of how the thefts associated with CryptoBilis may have occurred. The company said the implant did not interfere with the device’s Secure Element, the component designed to protect private keys, or its operating system. It also left transaction data and digital signatures unchanged. Ledger characterized the incident as a physical supply-chain attack rather than a compromise of its software or internal systems.

Ledger also confirmed on X that its investigation would continue until the source of the tampering was identified. The company said it would introduce updated reseller policies and review its security measures.

“Ledger is reviewing its reseller controls and anti-tamper protections,” Chief Technology Officer Charles Guillemet said on X. He also invited security researchers and other manufacturers to collaborate on improving tamper detection and supply-chain tracking practices.

Ledger CEO Pascal Gauthier said the company was reassessing the controls governing both direct sales and third-party resellers. He added that the investigation was ongoing to establish who modified the devices and at what point in the distribution process the tampering occurred.

Mark Karpeles, the former CEO of bitcoin exchange Mt. Gox, also claimed that he discovered a surveillance implant in a Ledger Flex device purchased at Singapore Airport.

Ledger said it had confirmed that one affected signing device contained an unauthorized implant. According to the company, every confirmed loss associated with the October 9 incident involved a device sold through CryptoBilis. It had not verified any theft involving a Ledger signer purchased from another seller, although it was investigating reports of implants in additional devices and locations.

The French hardware wallet manufacturer has not disclosed the total number of victims or the overall amount stolen. On-chain researchers, however, estimated that losses could have reached $93.2 million across more than 300 wallets. Tether also froze $10 million in its dollar-pegged USDT stablecoin linked to the theft.

Ledger said CryptoBilis had stopped selling its signing devices. The company advised customers who purchased a device through the reseller not to initialize it. Those who had already used an affected device were urged to transfer their assets to a new device configured with a newly generated recovery phrase.

About The Author

ctleditor

See author's posts