Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain

In brief

• Ledger said its Donjon security team found an unauthorized hardware implant in a wallet sold by Southeast Asian reseller CryptoBilis.
• The implant reads the 24-word recovery phrase from the device's screen during setup and transmits it over LTE using a provisioned eSIM.
• Ledger has not confirmed how many users were affected or how much was lost, and is reviewing reports of implants in other devices and locations.

Ledger said its security research team has found an unauthorized hardware implant that captured recovery phrases inside wallets sold by Southeast Asian reseller CryptoBilis, in a tweet on Tuesday.

The Paris-based hardware wallet manufacturer said it confirmed the implant on Saturday in one affected user's device. All confirmed losses from the incident, which Ledger disclosed on Friday, involve devices sold through CryptoBilis, and the company said it has not verified a drain linked to a device bought elsewhere.

A Ledger device, which the company calls a signer, shows a 24-word recovery phrase during setup. Anyone holding that phrase can restore the wallet and control its funds.

According to the analysis by Ledger Donjon, the company's security team, the implant sits inside the device's enclosure and reads what is shown on the screen. When it detects the recovery phrase screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM.