Ledger Wallet Security Breach: Implants Expose Recovery Phrases
Vexoda Newsroom
Hardware wallet manufacturer Ledger has detailed sophisticated LTE-enabled implants found in devices sold by reseller CryptoBilis, which could expose user recovery phrases. Competitors Trezor and OneK
Hardware wallet producer Ledger has disclosed the discovery of sophisticated security implants embedded in some of its devices. These implants, reportedly found in Ledger wallets sold by the reseller CryptoBilis, were designed to capture users' crucial recovery phrases directly from the device's screen. The compromised information could then be transmitted wirelessly, posing a significant threat to the security of users' digital assets.
The technical details revealed by Ledger's security research team, Ledger Donjon, indicate that a specialized microcontroller was employed within these implants. This component was capable of deciphering the 24-word recovery phrases as they were displayed during the wallet's setup process. For data transmission, the implants utilized integrated SIM (eSIM) technology, leveraging LTE cellular networks to send the sensitive recovery information away from the device, bypassing the wallet's primary security features.
This alarming security vulnerability came to light following reports of cryptocurrency losses linked to Ledger devices acquired through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia, and the Philippines. Ledger confirmed the presence of an unauthorized implant in at least one affected device. Initial estimates from blockchain investigators suggest that the total financial losses could potentially exceed $86 million, though Ledger has not yet confirmed an official figure for the extent of the damage.
The revelation has prompted swift action from other major hardware wallet providers. Competitor Trezor, while stating no reports of tampering with its own devices sold via CryptoBilis were found, has nonetheless removed the reseller from its authorized network. Similarly, OneKey, despite reporting no user losses, has terminated CryptoBilis's reseller status and is offering free replacements to affected customers who purchased devices within a specific timeframe, demonstrating a commitment to user protection.
This incident highlights the critical importance of supply chain security in the hardware wallet industry. While Ledger emphasized that the implants did not compromise the device's secure element or affect transaction integrity, the exposure of recovery phrases represents a critical failure point. The situation underscores the risks associated with purchasing hardware wallets from unofficial or unauthorized resellers, even if they are presented as legitimate channels.
Looking ahead, Ledger has advised users who suspect their devices may have been tampered with to contact their support team and file a police report. The company is also investigating potential implant issues beyond those linked to CryptoBilis, prompted by separate user reports of suspicious findings in devices purchased from a European electronics chain. Users are encouraged to exercise extreme caution and verify the legitimacy of their hardware wallet sources.
Source: Cointelegraph. Summarized and rewritten by the Vexoda Newsroom. This is market news, not financial advice.