Ledger says CryptoBilis devices sent recovery phrases over LTE

Ledger says an unauthorized implant in some devices sold by reseller CryptoBilis read users’ recovery phrases during setup and sent them over a mobile network, exposing wallets to anyone who obtained those phrases. In an investigation update reported by CoinDesk on October 13, the company described a physical supply-chain attack involving a module inside the device enclosure.

How did the implant capture and send the phrase?

During setup, a Ledger signer displays a 24-word recovery phrase on its screen. Ledger says the implant’s microcontroller recognized and decoded those words from the display, then transmitted them over LTE using an eSIM. LTE is the mobile data technology used by phones; the eSIM lets a device connect to a cellular network without a removable SIM card.

The recovery phrase is a master key: someone who has it can restore the wallet on another device and control its funds. That means the implant did not need to change a transaction or take over Ledger’s software to put a wallet at risk. The Ledger Donjon update, reported by The Block, said the implant did not modify the device’s Secure Element, operating system, transactions or signatures.

What has Ledger confirmed about the affected devices?

Ledger said it confirmed an unauthorized implant in one affected signer and that every confirmed loss in the October 9 incident involved a device sold by CryptoBilis. The company has not verified the total losses or number of affected users. It said it was still investigating where in the distribution chain the devices were tampered with.

Those limits matter: estimates circulating among onchain researchers are not a confirmed count from Ledger. The company said it had not verified a theft involving a signer bought elsewhere, and it was examining reports of implants in other devices and locations. It described the CryptoBilis incident as a physical supply-chain attack, with no indication that Ledger’s systems or services were breached.

What should CryptoBilis customers do now?

Ledger told customers with unused devices bought from CryptoBilis not to initialize them. Customers who already set one up should move their assets to a new device and generate a new recovery phrase. A replacement device alone does not invalidate the old phrase; the new phrase creates a different set of wallet credentials.

CryptoBilis has stopped selling Ledger signers, according to the company. Ledger says its investigation is continuing, including a review of reseller controls and anti-tamper protections. Until it confirms more, the scope of the compromised stock and the full value of losses remain unknown.

Sources

• CoinDesk — coindesk.com
• Ledger Donjon update, reported by The Block — theblock.co