Ledger details CryptoBilis wallet implant’s LTE seed theft

Ledger says a hardware implant in devices sold by reseller CryptoBilis captured users’ recovery phrases during setup and sent them over a mobile network, exposing wallets even though the devices’ Secure Element was not modified. In an investigation update reported by CoinDesk, Ledger described an unauthorized microcontroller inside the device enclosure that read the 24-word phrase from the screen and transmitted it using LTE and an eSIM.

The phrase is the wallet’s recovery credential: someone who obtains it can restore the wallet on another device and control its funds. Ledger says the implant did not change the signer’s operating system, Secure Element, transactions or signatures. The theft therefore relied on capturing the phrase when the user saw it during setup, rather than extracting keys from the Secure Element or altering a transaction the user approved.

How did the implant capture the recovery phrase?

Ledger’s account, as reported by CoinDesk, says the implant’s microcontroller recognized and decoded the words displayed on the signer’s screen. It then sent them over LTE using an eSIM. That sequence matters: the recovery phrase appears on the device screen during initial setup so the user can record it. The implant could capture it at that point without changing the signer’s normal signing path.

Ledger says the attack did not exploit a software flaw in its operating system or a vulnerability in its Secure Element. Nor did it need to intercept a transaction or compromise Ledger’s servers. The displayed phrase itself provided the information needed to recreate a wallet elsewhere. Once an attacker has that phrase, the original signer does not need to be present for funds to be moved.

What has Ledger confirmed about the affected devices?

Ledger’s October 15 investigation statement says attackers bought genuine devices, opened them, fitted custom-built components designed to capture recovery phrases during setup, then returned the devices to distribution through resellers in Southeast Asia. The company describes the event as a localized distribution attack after devices left its control. Ledger says its chip, operating system and servers were not compromised.

Ledger has not confirmed the total number of victims or the value stolen. CoinDesk reported that onchain researchers estimated losses of up to $93.2 million across more than 300 wallets, and that Tether froze $10 million in USDT tied to the theft. Those figures are third-party estimates, not a total verified by Ledger. Ledger said every confirmed loss in the October 9 incident involved a device sold by CryptoBilis; it had not verified a theft involving a signer bought elsewhere.

What should CryptoBilis customers do?

Ledger told customers with unused devices bought from CryptoBilis not to initialize them. Customers who already used one should move their assets to a new device with a newly generated recovery phrase. Reusing the old phrase would leave the replacement wallet accessible to anyone who captured it.

Ledger says it is working with law enforcement and the security community, and has asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. It also says returned devices must never be resold, even if they appear unopened. New instructions require authorized sellers to keep devices off shelves and displays, store them out of public view, and hand them over at purchase. Ledger says the investigation is continuing to determine who tampered with the devices and where in the distribution chain it happened.

References

• investigation update reported by CoinDesk — coindesk.com
• October 15 investigation statement — ledger.com