Ledger Reveals How Hidden Chips Stole Wallet Recovery Keys
Ledger said the implant uses a separate microcontroller and LTE connection, and Bitquery estimated about $102 million in suspected thefts across 324 wallets.
- On Tuesday, Ledger confirmed that an unauthorized hardware implant in devices sold by Southeast Asian reseller CryptoBilis captures users' 24-word recovery phrases and transmits them over LTE networks using an embedded SIM.
- The incident surfaced Friday after cryptocurrency losses were reported involving Ledger devices purchased through CryptoBilis, which operated as an authorized reseller in Indonesia, Malaysia, and the Philippines.
- Inside the device casing, the implant monitors information displayed on the screen during setup, though Ledger stated it does not modify the Secure Element, the chip responsible for protecting private keys.
- CryptoBilis suspended all sales following the findings, while OneKey and Trezor terminated their reseller authorization agreements; blockchain analytics firms estimate potential cryptocurrency thefts range from $86 million to $103 million.
- Customers who purchased signers through CryptoBilis were advised to contact Ledger Support and avoid initializing devices, as the company continues examining hardware and has not verified reports of tampered devices from other channels.
18 Articles
18 Articles
Ledger Says Unauthorized Component in CryptoBilis Wallets Leaked Recovery Phrases Over Cellular
Ledger said the add-on part, found in devices from a Southeast Asian reseller, left its Secure Element and operating system untouched, and that every confirmed drain so far involves a CryptoBilis-sold signer.
crypto.news
Cryptocurrency News | Cryptocurrency Prices | Market CapLedger reveals how hidden chips stole wallet recovery keys
Ledger says a hidden chip in a wallet sold by CryptoBilis can steal recovery phrases and send them over LTE as investigators examine reported thefts.
Ledger confirmed that an unauthorized chip in wallets sold by CryptoBilis read and sent 24-word recovery phrases via LTE. The extent of the losses is not yet clear.
In the breach of Ledger wallet hardware there is no altered software: there is a hidden component that reads the recovery sentence directly from the screen. Ledger's security team Donjon found a system that sends words on mobile network, leaving intact operating system and transactions. The devices had been sold by CryptoBilis. Points [...]
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
