Ledger says tampered hardware wallets sold via CryptoBilis contained hidden LTE implant
Security & Exploits ·
The company's findings describe an unauthorized component capable of capturing and transmitting recovery phrases, raising fresh concerns about compromised devices entering retail channels.
Ledger has detailed how an unauthorized implant found in signers sold through CryptoBilis allegedly captured users' recovery phrases and transmitted them over an LTE connection, according to a statement from Ledger. A recovery phrase is the master key to a hardware wallet's funds, so a device capable of silently exfiltrating that phrase would give an attacker everything needed to drain the associated holdings without the owner's knowledge.
The disclosure fits a pattern of compromised devices turning up outside Ledger's official distribution. Separate reports in the same cluster describe a Ledger hardware wallet allegedly bought from a Singapore Airport retailer that was found to contain a spy implant, and a Ledger Flex purchased at a Singapore Airport Metapod store that was similarly found to carry spyware. Other accounts describe compromised Ledger hardware wallets circulating more broadly across retail channels in Asia and Europe, suggesting the CryptoBilis case is not an isolated incident but part of a wider supply-chain problem affecting devices sold outside Ledger's own storefronts.
The mechanism described, an embedded component that reads and transmits a recovery phrase via a cellular connection, bypasses the core premise of a hardware wallet: that the private key material never leaves the device unexposed. If a seed phrase can be captured at the point of first setup and sent off-device over LTE, the wallet's offline, air-gapped design offers no protection, regardless of how the owner subsequently uses it.
Ledger's background materials also catalog other recent incidents involving tampered or counterfeit products, including a counterfeit Nano S Plus sold on a Chinese marketplace with embedded WiFi that stole seed phrases through a fake Ledger Live interface, and a fake Ledger application on Apple's Mac Store that drained a user's Bitcoin holdings. Together these cases point to a recurring risk: hardware and software claiming the Ledger name but obtained through unofficial or third-party sellers.
Not yet established is the scale of the CryptoBilis-linked distribution, how many units were affected, or whether funds have been confirmed stolen as a result of the implant. It also remains unclear what relationship, if any, exists between CryptoBilis, the Singapore Airport retail cases, and the wider pattern of compromised devices across Asia and Europe, or whether Ledger plans further action against unauthorized resellers, detailed at Ledger's atlas page.