Ledger wallets sold by CryptoBilis had hidden spy chips

Ledger says hidden chips in some wallets sold by Southeast Asian reseller CryptoBilis copied users’ recovery phrases and sent them over a mobile network, letting attackers take crypto from wallets designed to keep those keys offline. The company described the incident as physical tampering in the supply chain. CoinDesk’s report on Ledger’s investigation update says the chip read the screen during setup and sent the words over LTE, a mobile data network.

Customers began reporting missing funds on Oct. 9. Bloomberg reported on Oct. 18 that blockchain researchers estimated losses of more than $90 million. Ledger has not confirmed the total losses or the number of affected customers.

How did the hidden chip get users’ recovery phrases?

Ledger says the implant was inside the wallet and watched its screen during setup. When the device displayed a user’s 24-word recovery phrase, a microcontroller in the implant recognized and decoded the words, then sent them over LTE using an embedded eSIM.

A recovery phrase is the set of words that can restore access to a crypto wallet. Anyone who gets it can recreate the wallet elsewhere and move its funds without having the original device.

Ledger says the implant did not change the wallet’s operating system, secure element or transaction signatures. The secure element is the chip intended to protect private keys. The attack instead captured information shown on the screen.

How many wallets were affected?

Ledger said every confirmed theft in the Oct. 9 incident involved devices sold through CryptoBilis, but it has not verified thefts involving devices bought elsewhere. CoinDesk reported that on-chain researchers estimated up to $93.2 million was taken across more than 300 wallets. Those figures are estimates, not a total confirmed by Ledger.

The company said it was still investigating who altered the devices and where in the distribution chain it happened. Ledger also said it was reviewing its reseller controls and anti-tampering protections. The Record from Recorded Future News reported that CryptoBilis had paused sales and shipments of Ledger devices while the investigation continued.

What should CryptoBilis customers do?

Ledger told customers with unused devices bought from CryptoBilis not to set them up and to contact support. Those who had already used one should move their assets to a new device with a newly generated recovery phrase. Reusing the old phrase would leave the replacement wallet exposed too.

The case shows the limit of keeping a wallet offline: it can protect keys from remote attacks, but a device altered before it reaches its owner can expose them during setup.

Sources

• CoinDesk’s report on Ledger’s investigation update — coindesk.com