$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant

The threat involves a supply chain attack on Ledger signer hardware wallets, where an unauthorized circuit board was manually soldered inside devices sold through the reseller CryptoBilis. This implant read data displayed on the device screen, specifically the 24-word recovery phrase during setup, and transmitted it over LTE using an embedded eSIM. The implant did not alter the device's OS or transaction signing but enabled attackers to capture critical credentials to steal cryptocurrency. Ledger confirmed all known losses are linked to devices from this reseller and has instructed users to cease use and migrate assets.

Attackers gained access to users' 24-word recovery phrases, enabling them to steal cryptocurrency funds totaling at least $86 million. The compromise affects only devices sold through the CryptoBilis reseller channel. The implant's interception of recovery phrases undermines the fundamental security of the hardware wallet, allowing attackers to fully control affected wallets remotely.

Ledger has instructed users who purchased devices from CryptoBilis in the last 90 days to avoid setting up those devices if not already done. Users who have set up affected devices should move their assets to new Ledger signers with new recovery seeds. Ledger has requested CryptoBilis to stop selling its devices. No software patch can remediate this hardware implant; affected devices must be replaced.