Ledger says hardware implant in cryptocurrency wallets stole recovery phrases

Cryptocurrency wallet maker Ledger said Tuesday that devices sold through Southeast Asian reseller CryptoBilis contained hidden hardware implants that captured users’ recovery phrases, allowing attackers to steal their funds.

In a series of social media posts, the Paris-based company said its security research team found the affected devices contained implants that read data displayed on the screens.

During setup, the implants detect users’ 24-word recovery phrase and transmit it over an LTE connection using an embedded eSIM. Unknown attackers subsequently used the phrase to access users’ funds.

Those funds were drained last week, on Oct. 9. Ledger said it has not confirmed the total losses and urged caution against speculation.

“If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase,” the company said.

“Do not enter or restore any recovery phrase on a signer bought from CryptoBilis,” its statement added.

Ledger said all confirmed thefts, which have largely been reported within Southeast Asia, involve devices sold through CryptoBilis — but it added it is “also reviewing reports of implants in other signers and locations.”