Ledger 'spy chip' attack: tampered wallets sent recovery phrases over LTE; up to $93 million stolen

Ledger has confirmed that some of its hardware wallets were fitted with a hidden "spy" implant that read users' 24-word recovery phrases and sent them to an attacker over a mobile network, the company said on X on Tuesday, CoinDesk reported. On-chain researchers estimate losses of up to $93.2 million across more than 300 wallets, roughly Rs 25.8 billion at today's dollar rate. Ledger has not confirmed a figure.

How the attack worked

Ledger calls it a physical supply-chain attack, not a hack of its software or systems:

• an extra circuit was hidden inside the device's casing;
• when the owner set the wallet up and the recovery phrase appeared on screen, the implant read the words;
• it sent them out over LTE using an eSIM.

The implant did not touch the secure element, the operating system or any transaction. It did not need to: anyone with the 24 words can rebuild the wallet on another device and empty it.

Where the devices came from

Every confirmed loss in the incident that came to light on 9 October involved a signer sold by CryptoBilis, a Southeast Asian reseller, which has stopped selling Ledger devices. On Tuesday Ledger asked sellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to pause sales and pull stock, Cointelegraph reported. Ledger said "the only confirmed incidents remain contained to Southeast Asia" and that it has "no indication" its own systems or direct sales were compromised.

The worry is spreading: electronics chain MediaMarkt Saturn stopped selling Ledger devices after a customer in Germany reported finding an implant, and rival Trezor has cut back its resellers as a "preventative step". Tether has frozen $10 million in USDT linked to the theft.

If you hold crypto in Pakistan

If your wallet came from a marketplace seller, a reseller or someone who brought it from abroad, rather than from the maker's own store, it travelled through the same kind of chain this attack used.

1. Bought from CryptoBilis? Do not set it up. If you already have, move your funds to a new wallet with a newly generated recovery phrase, as Ledger advises.
2. Bought from anyone other than the maker? Treat the device with suspicion. The safest course is a new device bought from the maker's own store and a fresh recovery phrase.
3. Never use a phrase that came with the device, printed on a card or already filled in. A genuine wallet always creates a new one in front of you.
4. Opened box, broken seal or extra weight? Do not use it.

Ledger chief executive Pascal Gauthier said the investigation is still working out "who tampered with these signers or where in the distribution chain it happened".

For today's prices, see our bitcoin and ether pages.