Ledger says implant sent wallet recovery phrases over LTE

Ledger says an unauthorized implant in some wallets sold by Southeast Asian reseller CryptoBilis read users’ recovery phrases from device screens during setup and sent them over a cellular connection, giving attackers a route to take the funds. The company described the incident as a physical attack on device distribution. Its security team’s account, reported by CoinDesk, says the implant used a microcontroller and an embedded SIM to transmit the data over LTE.

How did the implant capture the phrase?

During initial setup, a Ledger device displays a 24-word recovery phrase that can be used to restore the wallet. According to Ledger, the hidden component inside the enclosure detected the phrase on the display, recognized and decoded the words, then sent them over LTE using an eSIM. The process took advantage of what the device showed during setup, rather than altering a transaction signed by the wallet.

The recovery phrase functions like a master key: someone who obtains it can recreate the wallet elsewhere and move its funds without the original device. Ledger said the implant did not alter the Secure Element, the chip designed to protect private keys, or the device’s operating system. It also said transactions and signatures were not changed.

Which devices and losses has Ledger confirmed?

Ledger has confirmed an implant in one affected user’s device and said all confirmed thefts in the Oct. 9 draining incident involve devices sold through CryptoBilis. The company has not confirmed the total losses or identified the affected device models, according to The Record from Recorded Future News. It is also reviewing reports involving other devices and locations.

The scope remains uncertain. Ledger characterized the number of affected devices as limited, but a device’s Secure Element could remain intact and still pass the company’s authenticity checks. That means a software authenticity check alone may not reveal this kind of physical modification.

What has Ledger changed, and what comes next?

In an Oct. 15 update, Ledger said it had asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. It also instructed its reseller network that returned devices must never be resold, even if they look unopened. New steps require stores to keep products off shelves and displays and hand them over at purchase; resellers must promptly report customer concerns.

Ledger says it is working with law enforcement and security researchers and will share further technical details when it can. For CryptoBilis customers, the company’s guidance is not to set up an unused device and to contact Ledger Support; those who have already set one up should move assets to a new device with a newly generated recovery phrase. The investigation now turns on how the devices were modified and whether reports beyond CryptoBilis can be confirmed.

References

• CoinDesk — coindesk.com
• The Record from Recorded Future News — therecord.media