Ledger reveals hidden-chip wallet key theft

TLDR

Ledger has disclosed that some hardware wallets sold via reseller CryptoBilis contained hidden chips that copied recovery phrases and sent them over mobile networks, enabling large scale thefts.

1. Ledger says a covert microchip inside certain devices read 24-word recovery phrases during setup and transmitted them over LTE, in a physical supply chain attack that left its secure chip and software intact.
2. All confirmed drained wallets so far involve devices sold by CryptoBilis, with onchain researchers estimating roughly 90 to 100 million dollars stolen, though Ledger has not confirmed a total or exact device count.
3. The incident highlights that hardware wallet security depends on the distribution chain as much as the design, and users should closely follow Ledgers guidance on suspect devices and buying channels.

Deep Dive

1. How The Theft Worked

Ledgers security team (Ledger Donjon) found an unauthorized hardware implant hidden inside some signers sold by Southeast Asian reseller CryptoBilis.

According to Ledgers Oct. 13 update and independent coverage, the implant is a small board inside the casing that taps the display line, uses a microcontroller to recognize the 24-word recovery phrase screen during setup, decodes the words, and sends them over LTE via a built-in eSIM. This mechanism is described in detail in reports on the spy chip inside CryptoBilis devices and a Ledger wallet security investigation.

Ledger stresses that the implant did not modify the Secure Element (the chip that protects keys), the operating system, or transaction-signing. It exfiltrated the master key (recovery phrase) at display time, which then lets an attacker recreate the wallet elsewhere without touching the original hardware.

2. Scope And Impact

Ledger says every confirmed loss in the October 9 incident involves devices sold via CryptoBilis in Southeast Asia, and that its own infrastructure and direct sales channels show no compromise so far. CryptoBilis has halted Ledger sales while the investigation continues.

Onchain analytics firms estimate that 300 to 500 wallets may have lost around 90 to 100 million dollars worth of crypto, mostly stablecoins and major assets, but Ledger has not validated any aggregate loss figure. One analysis cited by news reports says Tether froze about 10 million dollars of USDT linked to suspect addresses.

Separate reports describe suspected implants in devices bought at European retailers and at Singapores Changi Airport, and MediaMarkt Saturn has paused Ledger sales while one German case is examined. However, Ledger says it has not yet verified any non-CryptoBilis drain linked to these devices.

3. What Users Should Do Next

Ledger advises that customers who bought devices from CryptoBilis and have not initialized them should not complete setup and should contact official support. Users who did initialize such a device are told to move funds to a new signer created with a brand new recovery phrase on trusted hardware.

More broadly, hardware wallets remain only as trustworthy as their supply chain. Buying directly from the manufacturer or a carefully vetted seller, avoiding restocked or unsealed devices, and never sharing a recovery phrase with any website or support agent are key safeguards highlighted in Ledgers statements and related reporting.

Conclusion

Ledgers disclosure shows a sophisticated physical supply chain attack that stole recovery phrases without breaking its secure chip or software. The confirmed blast radius is currently limited to CryptoBilis-distributed devices, but investigations into other channels continue. For crypto holders, the main lesson is that self custody risk now extends beyond device design to how and where the device is sourced and how carefully recovery phrases are protected.