ZetaPeakThe hardware-wallet maker gave its first public account of how a covert component in devices sold by CryptoBilis could steal users’ master keys without changing Ledger’s software.
Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network
The hardware-wallet maker gave its first public account of how a covert component in devices sold by CryptoBilis could steal users’ master keys without changing Ledger’s software.
Ledger said a covert implant in some hardware wallets sold by CryptoBilis captured users’ recovery phrases from device screens and transmitted them to attackers over an LTE mobile network. Ledger described the thefts as a physical supply-chain attack that did not compromise its software, internal systems, secure element or transaction-signing process. Onchain researchers estimated that more than 300 wallets lost up to $93.2 million.
Covert hardware implanted in some Ledger crypto wallet devices sold by Southeast Asian reseller CryptoBilis read users’ 24-word recovery phrases from the gadget screen and sent them to an attacker over a mobile phone network, Ledger said Tuesday in an investigation update on X.
Ledger said the spy chip sat inside the device enclosure. When a user set up the signer and the screen displayed the recovery phrase, the implant’s microcontroller recognized and decoded the words, then transmitted them over LTE, a data transmission technology used by cellphones, utilizing an eSIM.
The recovery phrase is the master key to a crypto wallet. Anyone who has it can recreate the wallet elsewhere and move the funds without needing the physical Ledger device or changing any transactions on it.
The account is the first public explanation of the mechanism behind the CryptoBilis-linked thefts. Ledger said the implant did not modify the device’s secure Element, the chip designed to protect private keys, or its operating system. It also did not alter transactions or signatures. The incident was a physical supply chain attack rather than a breach of Ledger’s software or internal systems.
Ledger said it had confirmed one affected signer contained an unauthorized implant and that every confirmed loss in the Oct. 9 incident involved a device sold by CryptBilis. It said it had not verified a theft involving a signer purchased elsewhere and was examining reports of implants in other devices and locations.
The French company has not confirmed the total number of victims or the value stolen. Onchain researchers, however, estimated the losses were up to $93.2 million across more than 300 wallets, with Tether freezing $10 million of its dollar-pegged stablecoin USDT tied to the theft.
CryptoBilis has stopped selling Ledger signers, according to Ledger. The company told customers who bought one from the reseller not to initialize it. Customers who have already used one should move assets to a new device with a newly generated recovery phrase, it said.
1UK court ruling boosts government’s chances of keeping $5 billion in seized bitcoin50 minutes ago 2Bitcoin whale that sat through the March 2020 crash moves $378 million4 hours ago 3Tokenized SanDisk bets saw more liquidations than XRP as Asia’s chip rout wipes out $800 million4 hours ago 4Once-largest Ethereum NFT marketplace Blur is shutting down after volumes collapse 99%5 hours ago 5Bitcoin rebounds above $83,000 as it decouples from tumbling Korean stocks and Nasdaq futures5 hours ago 6Palantir's Europe head warns the region is 'missing the boat' on AI just as it did with the internet17 hours ago 7Tom Lee sees $2 trillion wealth transfer fueling crypto demand as Bitmine buys more ether18 hours ago 8Tokenized catastrophe bonds target the disaster-insurance gap19 hours ago 9Standard Chartered offers RLUSD custody in Dubai and plans LMAX collateral link22 hours ago 10Ledger claims CryptoBilis cases are limited as up to $93 million is traced, $10 million frozen22 hours ago
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Why it matters:
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Once-largest Ethereum NFT marketplace Blur is shutting down after volumes collapse 99%
Ledger claims CryptoBilis cases are limited as up to $93 million is traced, $10 million frozen
Why a bug that could have threatened XRP's 100 billion supply cap stayed hidden for years