cyber.hendryadrian.com
Cyber Attack & Data Breach · securityweek.com

Ledger Signer Hardware Implant Linked to at Least $86 Million in Crypto Theft

· Original article ↗

Summary

Ledger says signers sold through Southeast Asian reseller CryptoBilis were modified with an implant that captured recovery phrases and sent them over LTE. Investigators estimate losses may exceed $86 million; Ledger has not confirmed the total.

Key points

  • Ledger signers sold through CryptoBilis were found to contain an unauthorized hardware implant, reportedly added by soldering it to circuit boards.
  • The implant read the 24-word recovery phrase displayed during device setup, decoded it, and transmitted it over LTE using a provisioned eSIM.
  • Ledger said the implant did not modify the device operating system, transactions, or signatures.
  • Ledger advised customers who bought a device from the reseller in the previous 90 days not to set it up, or to move assets to a new signer with a new recovery seed if already set up.
  • Ledger confirmed that all fund losses it had linked to the incident involved signers sold through CryptoBilis.
  • An on-chain investigator estimated losses may top $86 million; Ledger has not confirmed the number of affected users or total stolen.

Article Details

Victim Organization
Users of Ledger signers sold through CryptoBilis
Incident Type
Supply-chain hardware implant used to intercept cryptocurrency wallet recovery phrases and steal cryptocurrency
Data Types Exposed
  • 24-word cryptocurrency wallet recovery phrases
Affected Records
Unknown
Affected Data Size
At least $86 million in cryptocurrency in losses, according to on-chain investigator Specter; Ledger has not confirmed the total stolen.
Operational Impact
Ledger instructed customers who bought devices from CryptoBilis in the previous 90 days not to set them up, or to move assets to a new signer with a new seed if already set up. The implant reportedly read recovery phrases displayed during setup and transmitted them over LTE; it did not modify the device OS, transactions, or signatures.
Ransom Or Extortion
None reported
Claim Status
confirmed

Vendors

LedgerA hardware implant in Ledger signers is blamed for the theft of at least $86 million in cryptocurrency from multiple users.

Industries

CryptocurrencyA hardware implant in Ledger signers is blamed for the theft of at least $86 million in cryptocurrency from multiple users.

Related Articles