Ledger Says Hardware Implant Stole Seed Phrases Through LTE

Ledger said a hardware implant inside certain wallets sold by Southeast Asian distributor CryptoBilis captured users’ 24-word recovery phrases from device screens and transmitted them over LTE during setup.

Ledger Donjon, the company’s security unit, linked all losses from the Oct. 9 incident to products distributed by CryptoBilis. It has not identified similar cases involving other purchase channels.

The implant was located inside the wallet casing. It decoded the recovery phrase when the 24 words appeared on the screen and sent the information through an LTE connection, according to Ledger’s investigation.

The attack did not alter the wallet’s security element or operating system, Ledger said. The company has not confirmed how many users were affected or the total amount stolen.

The incident highlights the security risk posed by compromised hardware supply chains: A device can preserve its software defenses while exposing sensitive recovery information through an added physical component.