Ledger confirms spy chip implant behind wallet crypto thefts

A supply-chain attack targeted Ledger Nano X hardware wallets distributed by CryptoBilis, a reseller operating in Southeast Asia. The attacker installed a sophisticated hardware implant inside the device, including an STM32 microcontroller and a shielded LTE module with an eSIM, concealed behind the screen and replacing the original battery or foam padding. This implant captured display output and button presses to extract the wallet's seed phrase and transmitted it wirelessly to the attacker. Researchers confirmed two variants of the implant, both professionally manufactured. Ledger confirmed hardware tampering on at least one device and is working with authorities. The company advises users who purchased devices from CryptoBilis to avoid setup or move funds to new wallets. Ledger's Genuine Check cannot detect such implants if the original secure element is intact. The compromised devices were sold at nearly half price, indicating counterfeit or modified products.

The hardware implant enabled attackers to steal private keys by capturing seed phrases entered on the device, resulting in unauthorized draining of cryptocurrency wallets. This compromises the fundamental security guarantee of hardware wallets, which is to keep private keys isolated from network exposure. The attack affects only devices purchased through the specific reseller CryptoBilis, with a limited number of reported cases. Users who set up compromised devices risk losing all stored cryptocurrency assets.

Ledger has halted sales and shipments of devices through the CryptoBilis reseller and is investigating the incident. Users who purchased Ledger devices from CryptoBilis are advised not to set up the device if they have not done so already. If the device has been set up, users should move their assets to a new Ledger wallet with a new seed phrase. Ledger recommends purchasing hardware wallets only from authorized resellers or directly from Ledger to avoid counterfeit or tampered devices. Ledger's Genuine Check mechanism can verify device authenticity but cannot detect hardware implants if the original secure element remains intact. Users should remain vigilant for unusual device behavior and report suspected tampering to Ledger.