Ledger Confirms Implant in CryptoBilis-Sold Wallet

Ledger said its Donjon security team confirmed an unauthorized hardware implant in one cryptocurrency signer sold by Southeast Asian reseller CryptoBilis. The device captured the recovery phrase displayed during setup and transmitted it over LTE, according to the company’s October 13 update. Ledger has not verified how many users were affected or the total value of losses. The implant was confirmed on October 10 in a device belonging to one affected customer, Ledger said. Its investigators found a separate component inside the signer’s casing that detects the recovery-phrase screen, reads the words and sends them using a provisioned eSIM. Ledger said the implant does not modify the device’s Secure Element, operating system, transactions or digital signatures. Ledger said every fund drain it has verified in the incident involved a device purchased through CryptoBilis, and it has not verified a drain linked to a signer bought elsewhere. The company is reviewing reports involving other devices and locations, but has not confirmed tampering beyond the reseller’s products.