CryptoBilis Wallet Scandal: Ledger Claims Hidden Chip Transmitted Private Keys

Ledger is reviewing its distribution and hardware security practices after discovering that some cryptocurrency wallets sold by Southeast Asian reseller CryptoBilis had been secretly modified to capture users’ recovery phrases and send them to attackers.

The company detailed the attack in a Tuesday update on X, explaining that a concealed electronic component had been placed inside the wallet enclosure. During device setup, the implant’s microcontroller could detect and decode the 24-word recovery phrase displayed on the screen, then transmit it to an attacker through an LTE connection powered by an embedded SIM.

These recovery phrases provide full access to cryptocurrency wallets. Anyone who obtains them can recreate a wallet on another device and transfer its funds without needing the original signer or tampering with its transactions.

The findings provide Ledger’s first public technical explanation of the thefts connected to CryptoBilis. Ledger said the malicious component did not compromise the Secure Element responsible for protecting private keys. It also left the device’s operating system, transactions and digital signatures unchanged. The company described the incident as a physical supply-chain attack rather than a breach of its software or internal infrastructure.

Ledger Chief Technology Officer Charles Guillemet said the company was reassessing reseller oversight and its defenses against hardware tampering. He also invited researchers and other hardware providers to collaborate on stronger device inspection, tamper detection and supply-chain verification practices.

Chief Executive Pascal Gauthier said the review would cover both direct purchases and reseller distribution. The investigation remains ongoing as Ledger attempts to identify those responsible and establish where the devices were modified before reaching customers.

Meanwhile, Mark Karpeles, the former CEO of Mt. Gox, claimed he found a surveillance implant in a Ledger Flex device purchased at Singapore Airport.

Ledger confirmed that one affected signing device contained an unauthorized implant. The company said every confirmed loss linked to the October 9 incident involved a device sold by CryptoBilis. It has not confirmed any theft involving a signer bought through another seller, but is examining reports of suspected implants in devices from other locations.

The company has not announced the number of victims or the confirmed value of the stolen assets. Blockchain researchers estimate that the incident may have affected more than 300 wallets, with losses potentially reaching $93.2 million. Tether has frozen $10 million in USDT associated with the thefts.

CryptoBilis has halted sales of Ledger devices. Ledger urged customers who bought signers through the reseller not to initialize them. Those who have already used an affected device should transfer their cryptocurrency to a new device and secure it with a newly generated recovery phrase.