Ledger finds LTE spy chip in CryptoBilis wallets

Ledger says a hidden chip in some devices sold by CryptoBilis copied users’ 24-word wallet recovery phrases during setup and sent them over a mobile network. In its investigation update reported by CoinDesk on Oct. 13, Ledger described the incident as a physical attack on devices in the supply chain.

A recovery phrase is a set of words that can restore access to a crypto wallet. Anyone who gets it can recreate the wallet and move its funds, even without the original device.

How did the chip send recovery phrases?

Ledger said the unauthorized module sat inside the device casing. When a user set up a wallet and the phrase appeared on the screen, a microcontroller in the module read and decoded the words. It then sent them over LTE, a mobile data network, using an eSIM, or embedded SIM card.

The chip did not alter the Ledger device’s Secure Element, which is designed to protect private keys, or its operating system, Ledger said. It also did not change transactions or signatures. The company said the incident was a physical supply-chain attack, rather than a breach of its software or internal systems.

What has Ledger confirmed about losses?

Ledger said every confirmed loss tied to the Oct. 9 incident involved a device sold by CryptoBilis, but it had not verified the total number of victims or the amount stolen. The company was still examining reports of implants in other devices and locations, according to The Block’s report on Ledger’s findings.

Ledger said CryptoBilis had stopped selling its devices. It advised customers who bought an unused Ledger from the reseller not to set it up. Those who had already used one should move their assets to a new device and create a new recovery phrase, the company said.

Ledger’s investigation into who tampered with the devices and where in the distribution chain it happened was ongoing. The company also said it was reviewing its reseller controls and protections against physical tampering.

Sources and documents

• investigation update reported by CoinDesk — coindesk.com
• The Block’s report on Ledger’s findings — theblock.co