Ledger Finds LTE Implant in Signer Linked to Suspected $86M Drain

Ledger found an unauthorized hardware implant inside a signer sold through Southeast Asian reseller CryptoBilis that allegedly captured users’ 24-word recovery phrases and transmitted them over LTE, linking the tampering to more than $86 million in suspected crypto losses.

Ledger’s Donjon security team said the implant used a microcontroller to recognize and decode recovery phrases displayed during device setup. A provisioned eSIM then transmitted the information over an LTE connection.

The company said the implant operated separately from the signer’s Secure Element, operating system, transaction process and digital signatures. Ledger confirmed the implant in one affected user’s device on Oct. 10.

Ledger said every confirmed loss in the incident involved devices sold through CryptoBilis and that it has not verified a drain tied to a signer purchased elsewhere. The company has not confirmed the total number of affected users or the full value lost.

Customers who bought CryptoBilis devices but have not initialized them were advised not to do so. Those who already initialized a device were told to move assets to a new device using a newly generated recovery phrase. A recovery phrase can restore a wallet and control its assets.