Hidden Cellular Implants in Ledger Devices Sold by a Malaysian Reseller Are Tied to Up to $93 Million in Thefts

Ledger, the French hardware-wallet maker, confirmed that at least one device sold by CryptoBilis, a reseller based in Kuala Lumpur, contained an unauthorized hardware implant. Buyers in Southeast Asia had reported drained wallets the week before. Ledger told CryptoBilis customers not to set up their devices, and it says the reseller has stopped selling them. Users had already raised concerns about the reseller in a Bitcointalk technical thread.

The attack did not break Ledger's secure chip or its cryptography. According to BleepingComputer, the implant captured the device's display output and button presses during setup. It identified the recovery phrase while the screen showed it and sent the phrase as text over a cellular connection using the technology behind most 4G networks (LTE) and an eSIM. Mark Karpelès, the former chief executive of the collapsed Mt. Gox exchange, examined devices from the reseller. He described the module as LTE components, an antenna, an eSIM and a microcontroller hidden in the buffer pad behind the screen. The implant only listened passively, so the device firmware had no way to detect it. The root cause was a supply-chain compromise: someone physically tampered with retail stock before buyers received it.

On-chain researchers estimate that $86 million to $93 million was taken from more than 300 wallets. Analysts cited by Crypto Briefing counted 315 wallets across Tron, Bitcoin, Ethereum, BNB Chain, Polygon and Solana, with Tron accounting for about $70.5 million. CoinDesk reports that about $10 million has been frozen. Tether froze USDT held at attacker addresses. The attackers then began converting USDT into USDD, a Tron-based stablecoin that Tether cannot freeze, and sent 430.2 ETH into the Tornado Cash mixer, Gizmodo reported. No group has been publicly identified as responsible.

Ledger and its critics describe the incident differently. Ledger says every confirmed case involves devices sold by this one reseller, that its own systems were not compromised, and that buyers should avoid unauthorized sellers. Critics quoted by CoinDesk say CryptoBilis operated as an authorized sales channel, which would make the failure Ledger's responsibility. Ledger gains if the incident is treated as one rogue vendor. Competitors and advocates of open hardware gain if it is treated as a flaw in how the industry distributes devices.

This is the third Ledger incident in which the weak point was outside the secure chip. In 2020 a leak of Ledger's customer database exposed buyers' home addresses. In December 2023, attackers inserted malicious code into Ledger's Connect Kit software library and drained users through decentralized applications.