Hacking News
Ledger Reveals CryptoBilis Wallet Implant Stole Recovery Phrases
Ledger has disclosed that an unauthorized hardware implant inside crypto wallets sold by Southeast Asian reseller CryptoBilis could capture users' 24-word recovery phrases and transmit them over cellular networks. The implant, detected in one customer's signer, monitors information displayed on the device's screen and transmits the recovery phrase through an LTE connection using a provisioned eSIM. Ledger confirmed that all fund losses linked to the incident involved signers purchased through CryptoBilis, with losses exceeding $86 million estimated by blockchain investigator Specter. Customers are advised to avoid setup and contact support for affected devices, and to move their cryptocurrency to a new signer using a newly generated recovery phrase.