Hidden Chip Found in Ledger Wallets: Critical Warning for Customers of This Seller

Ledger said hidden chips installed in some hardware wallets sold by a vendor called CryptoBilis sent recovery phrases to an attacker, and urged affected customers not to set up their devices or to move their assets to a new wallet.

According to Ledger’s October 13 investigation update, as reported by CoinDesk, the method behind thefts linked to devices purchased through CryptoBilis, a vendor in Southeast Asia, has been uncovered. The company confirmed that an unauthorized chip was found in a device it examined.

Wallet recovery phrase sent over a mobile network

According to Ledger, a chip concealed inside the device’s casing read and decoded the 24-word recovery phrase displayed on the screen during initial setup. It then sent the information to the attacker over an LTE mobile network using an eSIM.

A recovery phrase acts as a key that allows access to a wallet from another device. Anyone who obtains these words can move the assets to another address without needing the physical Ledger device.

The company said the implant did not alter the device’s security chip or operating system, nor did it interfere with transactions or signatures. Ledger described the incident as a physical supply chain attack, rather than a breach of its software or internal systems.

Estimated losses exceed $93 million

On-chain investigators estimated that total losses across more than 300 wallets could reach $93.2 million. Ledger has not yet confirmed the total number of victims or the value of the stolen assets. Tether froze 10 million USDT linked to the theft.

Ledger reported that all losses it confirmed in the October 9 incident were linked to devices purchased from CryptoBilis. The company said it had not identified any confirmed thefts involving devices purchased from other vendors, and is also investigating reports of implants in other devices and locations.

What should people who bought devices from CryptoBilis do?

CryptoBilis has stopped selling Ledger devices. Ledger’s warnings for customers who bought devices from the vendor are as follows:

• Those who have not set up their devices yet: Do not turn on or set up the device.
• Those who have used their devices before: Move your assets to a wallet set up on a new device with a newly generated recovery phrase.

The company recommends using a wallet created with a new recovery phrase, rather than transferring the existing recovery phrase to a new device.