Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network
Ledger has confirmed that a supply chain attack involving unauthorized spy chips in devices sold by a third-party reseller, CryptoBilis, led to the theft of millions in cryptocurrency. The implants intercepted recovery phrases via cellular networks, allowing attackers to drain wallets without compromising Ledger's internal systems.
Why it matters
This incident highlights the critical security risks associated with purchasing hardware wallets from unauthorized third-party resellers rather than directly from manufacturers.
Ledger said the spy chip sat inside the device enclosure. When a user set up the signer and the screen displayed the recovery phrase, the implant’s microcontroller recognized and decoded the words, then transmitted them over LTE, a data transmission technology used by cellphones, utilizing an eSIM.
The recovery phrase is the master key to a crypto wallet. Anyone who has it can recreate the wallet elsewhere and move the funds without needing the physical Ledger device or changing any transactions on it.
The account is the first public explanation of the mechanism behind the CryptoBilis-linked thefts. Ledger said the implant did not modify the device’s secure Element, the chip designed to protect private keys, or its operating system. It also did not alter transactions or signatures. The incident was a physical supply chain attack rather than a breach of Ledger’s software or internal systems.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in