Ledger finds hidden LTE implant that stole recovery phrases from reseller-sold wallets

Ledger says its security team has found an unauthorised hardware implant inside wallets sold by CryptoBilis, a reseller in Southeast Asia, that captured users' recovery phrases.

How the implant worked

According to Ledger Donjon, the company's security research team:

• The implant sits inside the device's casing and reads what is shown on the screen.
• When it detects the 24-word recovery phrase during setup, a small microcontroller decodes the words and transmits them over LTE using a provisioned eSIM.
• It is a separate component: it does not modify Ledger's Secure Element or operating system, and does not alter transactions or signatures.

Anyone holding a recovery phrase can restore the wallet elsewhere and take the funds.

How big is it?

Ledger confirmed the implant on 10 October in one affected user's device. It says all confirmed losses involve devices bought through CryptoBilis and that it has not confirmed the total number of victims or the value lost. On-chain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, Decrypt reported. CryptoBilis has stopped selling Ledger devices.

Ledger is also reviewing reports of tampered devices elsewhere, including an unverified claim about two units bought in Europe.

What to do if you bought from CryptoBilis

• Not set up yet? Don't. Contact Ledger Support.
• Already in use? Move your funds promptly to a new device with a new recovery phrase.
• Never enter or restore a recovery phrase on a CryptoBilis device.

See our guide on how to store crypto safely.

For a checklist of the most common warning signs, see how to spot crypto scams.