Setting up a Ledger signer bought from Southeast Asian reseller CryptoBilis was enough to expose a buyer’s 24-word recovery phrase, according to Ledger’s Donjon researchers, who traced the leak to an unauthorized, separate component installed inside the device.
In an Oct. 13 update, Ledger said the implant, which its Donjon team is analyzing, “sits inside the enclosure and reads the data shown on the screen.” Once the device shows the recovery phrase during setup, Ledger said, “its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM.”
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
A Separate Chip
Ledger described the implant as an added part rather than a change to its own hardware or software. “It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures,” the company wrote. The Secure Element is the chip that stores a wallet’s private keys.
Every confirmed fund loss tied to the incident Ledger disclosed on Oct. 9 involves a device sold through CryptoBilis, according to the company. It added: “We have not verified a drain linked to a signer bought elsewhere.” Ledger also said it is “reviewing reports of implants in other signers and locations.”
Still Counting Cases
Ledger said it has not confirmed the number of affected users or the total amount lost, and that “figures circulating online come from third parties and Ledger has not fully verified them.” Ledger asked users whose funds were drained to contact Ledger Support so their cases can be counted.
Ledger first asked CryptoBilis to pause sales on Oct. 9, later confirming that one affected user’s device contained “an unauthorized hardware implant.” CryptoBilis has since stopped selling Ledger devices, Ledger said.
CEO Pascal Gauthier wrote that “the investigation is ongoing to determine who tampered with these signers or where in the distribution chain it happened.” He said the company has “no indication that Ledger’s infrastructure, systems or services were compromised” and is reviewing the controls that cover both its direct sales and its resellers.
“Physical supply chain tampering is a risk for the whole industry,” Gauthier wrote.
Guidance for Buyers
Ledger told CryptoBilis buyers who have not yet set up a device to leave it untouched and contact support, and those who already have to move their assets to a new device with a fresh recovery phrase. Owners of a possibly tampered device should talk to Ledger Support or police before shipping it anywhere, the company said.
For people who bought elsewhere, Ledger published a guide to opening a device and inspecting its interior, noting that doing so can damage the hardware. The Donjon team will examine devices it receives and share more findings as the investigation continues, Ledger said.
Related Listen: Bits + Bips: Is Any Cold Wallet Safe? Inside the Coldcard Hack’s Wave Three
The post Ledger Says Unauthorized Component in CryptoBilis Wallets Leaked Recovery Phrases Over Cellular appeared first on Unchained.