Ledger Finds Hidden Cellular Chip That Sent Recovery Phrases From Reseller-Sold Wallets

Ledger's internal security team, Ledger Donjon, is investigating signers sold by CryptoBilis, a reseller that operates in Indonesia, Malaysia and the Philippines. The company confirmed on October 10 that one affected user's device contained an unauthorized hardware implant. That confirmation came a day after a coordinated draining of wallets. According to Cybersecurity News, every confirmed case tied to the October 9 incident involved a device bought through CryptoBilis. Users on the Bitcointalk developer board had already flagged a possible problem with Ledger devices from the reseller.

The attack did not break the device's cryptography. According to Ledger's description, reported by CoinDesk, the implant sits inside the enclosure and reads what the screen displays. During setup, the device shows the owner a 24-word recovery phrase. The implant's microcontroller detects those screens, decodes the words, and transmits them over a mobile data network using a pre-provisioned embedded SIM card (eSIM). The implant leaves the secure element and the operating system unchanged, and it does not alter transactions or signatures. Tech Times reports that the implanted units passed Ledger's Genuine Check. That check confirms the secure chip is authentic, but it does not detect a separate component hidden inside the case.

Estimated losses range from $86 million to $93 million, taken from more than 300 wallets on the Bitcoin, Ethereum and Tron blockchains, according to BleepingComputer and other trackers. No recovery, freeze or attribution has been announced. Ledger told anyone who bought from the reseller in the past 90 days not to set up the device, and told those who already have to move their funds to a new signer with a new recovery phrase. CryptoBilis has stopped selling all hardware wallets while the investigation continues. Its inventory also includes Trezor, OneKey, Tangem and SafePal devices.

The root cause is a supply-chain compromise inside an authorized retail channel. Ledger's position is that its secure element held, which is accurate and also convenient for the company, since it places the failure with the reseller. Critics can respond that a key a user can read off the screen can also be read by a component nobody checks. Separately, Blockstream this week restored multisig accounts in its app, offering 2-of-2 and 2-of-3 setups that include a backup key only the user holds. In a multisig wallet, a seed captured from one compromised device cannot move funds on its own.