Hidden Implant in Ledger Wallets Linked to $93 Million Theft

Ledger, a prominent manufacturer of hardware cryptocurrency wallets, has confirmed that a subset of its devices sold through a specific Southeast Asian reseller, CryptoBilis, were compromised by an unauthorized hardware implant. This implant is believed to be responsible for a wave of drained wallets reported by customers in Southeast Asia, with on-chain researchers estimating the total losses to exceed $93 million. Ledger has emphasized that its own systems and direct sales channels remain unaffected, and the confirmed incidents are limited to devices purchased via CryptoBilis.

The alleged mechanism of the attack, as detailed by former Mt. Gox CEO Mark Karpelès, involves a small, hidden circuit board concealed beneath the device's screen. This board reportedly contains a microcontroller, an antenna, an LTE chip, and an e-SIM. The implant's function is to monitor the screen for the user's recovery phrase when it is displayed, capture it, and then transmit it to the attacker. This allows threat actors to obtain the recovery phrase without ever physically interacting with the compromised hardware wallet, enabling them to drain funds at their convenience.

Adding to the sophistication of the attack, the implant is designed to be difficult to detect. Karpelès reported that his tampered device arrived in intact shrink wrap and passed Ledger's standard 'Genuine Check' because the internal security chip was legitimate. The presence of the additional circuit board was only discoverable upon physically disassembling the device, making it a stealthy and effective compromise.

Ledger has stated that it is actively investigating the incident in collaboration with relevant authorities and is reaching out to affected users. The company is advising customers who purchased devices from CryptoBilis not to initialize them if they have not already done so. For those who have already set up a compromised device, Ledger recommends moving all assets to a new, trusted device (preferably purchased directly from Ledger) and generating a new seed phrase.

While Ledger's immediate advice covers devices purchased within the last 90 days from CryptoBilis, blockchain analytics firm Bitquery noted that over 80% of the drained wallets traced received funds in June or later. This suggests that devices purchased from CryptoBilis since June may also be at risk, potentially expanding the window of affected devices.

In response to the incident, CryptoBilis has confirmed that it has ceased all sales of hardware wallets. Ledger has also reiterated its policy for authorized resellers and distributors, urging them to source products only through legitimate channels and to avoid restocking returned products. The company strongly advises users against purchasing from unauthorized resellers, though this incident highlights that even authorized resellers can be a vector for compromise.

Ledger also issued a warning about potential scams capitalizing on the incident. Threat actors may attempt to impersonate Ledger support to trick users into revealing their recovery phrases. The company stressed that it will never contact users directly via phone, direct message, or request their 24-word recovery phrase, urging users to rely solely on official Ledger channels for communication and support.

This incident underscores the evolving threat landscape for hardware security devices, demonstrating that even specialized hardware designed for security can be targeted through sophisticated supply chain attacks. The use of hidden hardware implants represents a significant escalation in attack vectors, moving beyond software vulnerabilities to physical tampering.