Ledger Finds LTE Chip in CryptoBilis Devices That Captured Wallet Recovery Phrases
Ledger says tampered devices sold through reseller CryptoBilis contained a hidden LTE implant that captured users’ 24-word recovery phrases during wallet setup. The company says the implant left the device’s Secure Element and software untouched, while investigations into who altered the hardware and Ledger’s reseller policies continue.
Key takeaways
- Ledger says a hidden LTE implant in some CryptoBilis devices captured recovery phrases during setup.
- The implant reportedly read the 24-word phrase from the screen and transmitted it over a mobile network.
- Ledger says the devices’ Secure Element and software were not altered.
- Ledger is reviewing reseller policies as investigations into who tampered with the devices continue.
- The incident is linked to a suspected $86 million theft.
Ledger says a hidden chip was installed in some devices sold through CryptoBilis, a reseller linked to a suspected $86 million theft. According to Ledger, the implant could read a wallet’s 24-word recovery phrase from the screen during setup and transmit it over a mobile network.
The recovery phrase is the master backup that can restore access to a crypto wallet. Anyone who obtains it may be able to take the funds, which is why Ledger has previously urged recent CryptoBilis customers not to set up their devices while the investigation is underway.
How did the CryptoBilis implant work?
Ledger says the implant captured the phrase as it appeared on the device screen. The company says the device’s Secure Element—the chip designed to protect sensitive operations—and its software were not altered. The reported compromise was instead a hidden hardware addition with its own mobile connection.
That distinction matters: the incident, as described by Ledger, does not mean the Secure Element itself was broken. It points to a supply-chain problem—someone tampered with devices before buyers received them.
What should CryptoBilis buyers do?
Anyone who bought a Ledger device through CryptoBilis should follow Ledger’s security guidance and avoid entering a recovery phrase on a device whose integrity is uncertain. If a phrase may have been exposed, funds should be moved to a wallet with a newly generated recovery phrase using a device obtained from a trusted source. Never share a recovery phrase with support staff or enter it on a website.
Ledger says it will review its reseller policies, while investigations continue to identify who modified the devices. That makes the next concrete questions whether investigators can trace the hardware tampering and whether Ledger changes how it vets or monitors resellers. Unlike a software vulnerability affecting a broad user base, this report centers on particular devices distributed through one reseller—so purchase history and device provenance are especially important for customers.
Frequently asked questions
What did Ledger find in CryptoBilis devices?
Ledger says some devices sold through CryptoBilis contained a hidden LTE chip that captured recovery phrases during wallet setup and sent them over a mobile network.
Was Ledger’s Secure Element hacked?
Ledger says the implant left the device’s Secure Element and software untouched. The reported attack involved a hidden hardware addition that read the recovery phrase from the screen.
What should I do if I bought a Ledger through CryptoBilis?
Follow Ledger’s latest security guidance and do not enter a recovery phrase on a device whose integrity is uncertain. If you think your phrase was exposed, move funds to a wallet created with a new phrase on a trusted device.