Ledger Links $86 Million Crypto Heist to Hardware Implant
Ledger has linked confirmed cryptocurrency losses in a supply-chain attack to signers sold by Southeast Asian reseller CryptoBilis. The devices contained a hidden circuit board designed to capture recovery phrases.
Radwan AbdulhadiEditor and technology writer
Ledger ties confirmed losses to CryptoBilis devices
Ledger has confirmed that all fund losses it has linked to a recent supply-chain attack involved a signer sold through CryptoBilis, a reseller operating in Southeast Asia. The disclosure follows the identification of an unauthorized hardware implant inside some of the devices.
The cryptocurrency theft was disclosed on October 9 and was immediately associated with devices distributed by CryptoBilis. Ledger asked the reseller to stop selling its products and told customers who obtained devices through the company to stop using them while the incident was investigated.
Hidden board captured setup information
Ledger signers are offline hardware devices used to authorize blockchain transactions as part of the company’s cryptocurrency wallet system. In the affected units, investigators found a small circuit board hidden beneath the device’s screen and manually soldered to the signer’s main circuit board.
Ledger said the implant sits inside the enclosure and reads the information displayed on the screen. During setup, a signer displays the user’s 24-word recovery phrase. When the implant detects those screens, its microcontroller decodes the words and sends them to the attackers over LTE using a provisioned eSIM.
Implant targeted recovery phrases
The implant was designed to intercept information rather than alter the signer’s normal operation. According to Ledger’s description, it does not modify the device’s operating system, transactions, or signatures. Its purpose was to obtain sensitive setup data that could allow attackers to access assets associated with the compromised recovery phrase.
The reported method depended on a modification made somewhere in the distribution chain. The hardware was not described as part of Ledger’s standard design, and the source material does not identify who installed it or how the modified signers reached customers.
Estimated losses may exceed $86 million
On-chain investigator Specter estimated that the total losses associated with the supply-chain attack may top $86 million. The figure represents an estimate rather than a final amount confirmed by Ledger, and the number of affected users has not been established.
Ledger has not confirmed the total value of cryptocurrency stolen or the number of impacted customers. The company’s confirmation is narrower: all confirmed fund losses tied to the incident involved a signer sold through CryptoBilis.
Ledger advises customers to replace signers
Ledger recommended that users who purchased from CryptoBilis during the previous 90 days should not begin setup if they had not already done so. Customers who had set up their devices were advised to consider moving their assets to a new Ledger signer created with a new recovery seed.
The guidance reflects the implant’s focus on recovery phrases displayed during setup. Replacing a device alone would not address exposure of an existing phrase, which is why Ledger specifically referred to moving assets to a new signer with a new seed. The company has not provided a final public accounting of the incident in the supplied material.
Sources
- SecurityWeek$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
Continue chronologically
Related stories
Trezor Warns of Suspected Crypto-Theft Implant in Wallet
Hardware wallet maker Trezor has received credible reports regarding a suspected crypto-theft implant in a Trezor Safe 5 sold via CryptoBilis.
Ledger Announces Atom, an Android-Based Crypto Hardware Wallet
Ledger has revealed the Atom, a data-only Android device designed to work alongside your smartphone as a dedicated hardware wallet signer.
Ledger Wallet Tampering Suspected After Crypto Thefts
Ledger investigates potential wallet tampering following reports of significant cryptocurrency thefts linked to a reseller and a hardware spy implant.
FBI Seizes Domain of Russian Bulletproof Host Virtualine
The FBI has seized the domain of Virtualine, a Russian-speaking bulletproof hosting provider linked to ransomware, infostealers, and illicit services.
