Spy Chip Implanted in Ledger Wallets to Steal Cryptocurrency

The cryptocurrency wallet maker Ledge has confirmed that some devices sold through the reseller CryptoBilis were implanted with a spy chip that would steal users' seed phrase and drain their wallets.

Ledger's analysis of the attack confirmed that only devices from CryptoBilis were affected.

The attack consisted of a chip that sits inside the enclosure. It reads the data shown on the screen and determines the seed phrase. The seed phrase is shown onscreen during the setup process, which the implant can detect.

Once it decodes the seed phrase, it then sends it over LTE using a built-in eSIM.

The implant chip is an entirely separate component and does not modify the operating system on the Ledger.

If you purchased a Ledger from CryptoBilis, Ledger recommends you don't set it up and instead transfer your funds to a new signer with a new recovery phrase, and contact Ledger support if you lost funds from a tampered signer.

Ledger has a guide to check the inside of your wallet.

Ledger says they have asked resellers and distributors in Southeast Asia and Hong Kong to stop selling their wallets and take currently available ones off the shelves. They also say there is no indication their official infrastructure, services, or direct sales channels were compromised.

Resellers have been asked to only buy stock from official channels and not to restock returned wallets.

We believe in jointly working with researchers, other vendors and partners on improving industry chain-of-custody practices and anti-tamper techniques. Raising the bar on physical supply-chain integrity benefits the entire ecosystem.

It's recommended that you don't buy Ledger wallets from unauthorized resellers because they can potentially be tampered with, or just buy directly from Ledger themselves.

Ledge hasn't announced who is responsible for the attack, the investigation is still ongoing for now. They also don't know the total amount lost or the total number of affected users as reports are still coming in.

Ledger wallets are often praised for their security, but in attacks like this one, the security of the device itself wasn't compromised. Instead, it was bypassed through a side channel instead of attacking the secure element or the operating system directly.