Hacking News
Ledger Devices Affected by Spy Chip Attack
Hardware-wallet maker Ledger has disclosed that a covert component inside some of its CryptoBilis Ledger devices transmitted users' 24-word recovery phrases over a mobile phone network. The spy chip, which sits inside the device enclosure, recognized and decoded the recovery phrases displayed on the device's screen and transmitted them to an attacker. The recovery phrase is the master key to a crypto wallet, allowing an attacker to recreate the wallet and move funds. This incident is a physical supply chain attack, not a breach of Ledger's software or internal systems. Ledger confirmed one affected signer contained an unauthorized implant and that all confirmed losses in the Oct. 9 incident involved devices sold by CryptoBilis. The company has stopped selling Ledger signers and advised customers who bought from the reseller not to initialize their devices. Customers who have already used a device should move their assets to a new device with a newly generated recovery phrase.