Ledger says implant stole recovery phrases from CryptoBilis wallets

Ledger said a hardware implant in some cryptocurrency wallets sold through reseller CryptoBilis captured customers’ recovery phrases during setup and sent them over a mobile network, enabling attackers to access funds. The company said all thefts it has confirmed so far involved devices sold through CryptoBilis, while it investigates reports involving other devices and locations. Ledger’s security team said the implants used a microcontroller to read the 24-word phrase displayed on a device screen and transmit it over LTE through an embedded SIM. Recovery phrases can be used to restore access to a wallet, allowing someone who obtains them to move its assets without the physical device. Ledger said the implants did not compromise the devices’ Secure Element security chips or alter transactions. It has not identified the affected models and has not confirmed how much was stolen or how many users were affected. Outside estimates cited in reports range from more than $86 million to as much as $103 million, but Ledger has not endorsed a total and the estimates have differing stated scopes.