Ledger says CryptoBilis wallets sent recovery phrases over LTE

24 words: Ledger says an implant in some devices sold by CryptoBilis read the recovery phrase on screen during setup and sent it over LTE, according to CoinDesk’s report on Ledger’s investigation update. That is the standard length of the phrase that can restore access to a wallet.

If someone gets your recovery phrase, they can recreate your wallet and move its funds without your device.

How did the implant capture the phrase?

Ledger said the unauthorized hardware was fitted inside the devices’ enclosures. During setup, a microcontroller recognized and decoded the words displayed on the screen, then transmitted them over LTE using an eSIM.

The implant did not alter the device’s Secure Element, which is designed to protect private keys, or Ledger’s operating system, according to the company. Ledger also said it did not change transactions or signatures. The attack relied on physical tampering somewhere in the supply chain, rather than a breach of Ledger’s software or internal systems.

How many devices and losses has Ledger confirmed?

Ledger said every confirmed loss in the incident disclosed on Oct. 9 involved a device sold by CryptoBilis, a Southeast Asian reseller. The company has confirmed that one affected signer contained an implant, but has not verified thefts involving devices bought elsewhere.

Onchain researchers estimated losses of up to $93.2 million across more than 300 wallets, CoinDesk reported; Ledger has not confirmed those totals. The gap matters: the estimate describes researchers’ tracing, not a figure verified by the wallet maker.

What should CryptoBilis customers do?

Ledger said customers who bought a device through CryptoBilis and have not set it up should not initialize it. If you already used one, Ledger advises moving your assets to a new device with a newly generated recovery phrase; a phrase displayed on a compromised device should no longer be trusted.

CryptoBilis has stopped selling hardware wallets, according to Ledger. The investigation is continuing to establish who tampered with the devices and where in distribution it happened. For now, Ledger says it has not verified a theft involving a signer purchased through another reseller.

References

• CoinDesk’s report on Ledger’s investigation update — coindesk.com