Ledger Says LTE Spy Chip Stole Recovery Phrases From CryptoBilis Wallets: 11 outlets compared

Spy chip mechanism

Ledger said a covert component inside some Ledger devices sold by CryptoBilis transmitted wallet keys by capturing users’ recovery phrases from the device screen and sending them to attackers over an LTE mobile network.

Ledger said the implant sat inside the device enclosure and, when the screen displayed the recovery phrase during setup, its microcontroller recognized and decoded the words before transmitting them over LTE using an eSIM.

Ledger said the recovery phrase is the master key to a crypto wallet and that anyone with it can recreate the wallet elsewhere and move the funds without needing the physical Ledger device or changing any transactions on it.

Onchain researchers estimated losses of up to $93.2 million across more than 300 wallets, and Tether froze $10 million of USDT tied to the theft.

Ledger said it confirmed one affected signer contained an unauthorized implant and that every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis.

Resellers cut ties

CryptoBilis said it suspended sales and shipments of all hardware wallet brands in Malaysia, the Philippines and Indonesia, expanding an earlier halt limited to Ledger devices. Trezor said it had received no reports of manipulated Trezor devices sold through CryptoBilis and found no indication that its products were affected, but it removed CryptoBilis from its network of authorized resellers. OneKey reported no related user losses but terminated CryptoBilis’ reseller authorization, suspended onboarding of new resellers, and began reviewing its existing distribution network.