Ledger says implanted chips stole recovery phrases from wallets

Ledger said on Oct. 13 that hidden hardware implants in some wallets sold by Southeast Asian reseller CryptoBilis read customers’ 24-word recovery phrases from device screens and transmitted them over LTE, turning products meant to keep keys offline into a route for remote theft. In its investigation update reported by CoinDesk, Ledger said the implant left the wallet’s Secure Element and operating system unchanged. The immediate exposure is limited to confirmed CryptoBilis-linked losses, but the mechanism shifts the security question from whether wallet software was breached to whether the device was trustworthy before it reached its owner.

How did the implant get around an offline wallet’s protections?

It captured the recovery phrase at the point where the user could see it. Ledger said the implant’s microcontroller recognized and decoded the words displayed during setup, then sent them through an embedded eSIM over a mobile network. A recovery phrase can recreate a wallet elsewhere, so an attacker who obtains it can move funds without the original device or any alteration to its transactions.

That is a different failure from a remote software intrusion. Ledger said the Secure Element, which protects private keys, was not modified, and the operating system was not changed. The compromise sat outside those controls, inside the device enclosure. The Record from Recorded Future News reported that Ledger had confirmed an implant in an affected device and said it had not identified which wallet models were affected. The company described the incident as a physical supply-chain attack, not a breach of its own software or internal systems.

How large is the loss, and what remains unconfirmed?

Customers began reporting missing funds on Oct. 9. Blockchain researchers estimated losses of up to $93.2 million across more than 300 wallets, CoinDesk reported, while Ledger said it had not confirmed the total number of victims or the amount stolen. Ledger said every confirmed loss in the incident involved a device sold by CryptoBilis; it had not verified a theft involving a Ledger bought elsewhere.

CryptoBilis paused sales and shipments of Ledger devices while the investigation continued, according to The Record. Ledger advised customers with an unused CryptoBilis device not to initialize it. Those who had already used one should move their assets to a new device with a newly generated recovery phrase. The company also said it was reviewing reports of implants in other devices and locations, so the confirmed scope may not yet be the full scope.

What does this change for hardware-wallet buyers?

Hardware wallets keep signing keys away from internet-connected computers, reducing exposure to some remote attacks. Software wallets or exchange custody avoid relying on a separate device’s physical chain of custody, but they introduce their own risks: software wallets depend on the security of the device they run on, while exchange customers entrust access to a third party. This incident does not show that those alternatives are safer overall. It shows that offline storage only helps if the hardware and the path from manufacturer to buyer can be trusted.

Ledger said it was reviewing reseller controls and anti-tamper protections, and its CTO invited researchers and other vendors to work on tamper detection and chain-of-custody practices. The next signals are whether investigators identify where the wallets were altered, whether Ledger can establish the affected models and sales channels, and whether any reported implants outside CryptoBilis are confirmed. Until then, the distinction between a secure chip and a secure device remains central: one can work as designed while the other has already given away the key.

Sources and documents

• investigation update reported by CoinDesk — coindesk.com