Ledger Signer Compromised by LTE Hardware Implant in Supply Chain
Tampered devices sold via CryptoBilis contain implants that steal seed phrases, leading to significant cryptocurrency losses across Southeast Asia.
Key points
- Unauthorized circuit boards with LTE chips were found in Ledger Signers sold by reseller CryptoBilis.
- The implants capture 24-word recovery phrases displayed during setup and transmit them to attackers.
- Confirmed losses exceed $86 million, with Ledger stating its direct sales channels remain uncompromised.
Ledger Signer hardware devices distributed through the Southeast Asia reseller CryptoBilis contain an unauthorised hardware implant designed to intercept sensitive user data. This supply-chain compromise allows attackers to exfiltrate cryptographic seed phrases without altering the device’s operating system or transaction signatures, as confirmed by Ledger in technical updates.
Root cause
The vulnerability stems from physical tampering during the distribution process rather than a software flaw. According to Ledger, individuals along the supply chain manually soldered a small circuit board inside the device enclosure. This board sits beneath the screen, occupying space where display padding would normally reside, effectively bypassing standard visual inspections.
Attack path
The implanted circuit board includes a microcontroller, an antenna, an LTE chip, and an e-SIM card. When users initialise their devices, the signer displays a 24-word recovery phrase. The implant’s microcontroller decodes these words from the screen and transmits them over LTE to the attackers. With the phrase, adversaries can recreate the wallet on separate hardware and drain funds remotely.
Affected versions
- Ledger Signer devices purchased from the reseller CryptoBilis in Southeast Asia.
- Devices bought within the last 90 days from this specific distributor are considered at risk.
- Ledger states that its own systems, direct sales channels, and other official resellers were not compromised.
Mitigation
Ledger has instructed CryptoBilis to cease selling its devices immediately. The company advises customers who bought from this reseller in the previous 90 days not to initialise the device if it remains unsetup. For those who have already set up their wallet, Ledger recommends moving assets to a new Ledger Signer with a fresh seed phrase.
What to do and how to stay safe: Ledger
- Verify the purchase origin of your hardware wallet; if bought from CryptoBilis, assume compromise.
- Do not initialise unopened devices from affected batches until a thorough physical inspection is possible.
- Monitor blockchain activity for unauthorised transactions if you suspect your seed phrase was exposed.
- Once the vendor provides an update or replacement protocol, follow official support channels for remediation.
Step-by-step guide: Password Policies Examples That Reduce Password Fatigue
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this affect Ledger devices bought directly from the company?
No, Ledger confirmed that its direct sales channels and internal systems were not compromised in this incident.
How can users detect if their device has been tampered with?
The implant is hidden under the screen and passes standard security checks; opening the device is the only reliable detection method.
What is the estimated financial impact of this theft?
On-chain researchers estimate losses at more than $86 million, though Ledger has not confirmed the total number of impacted users.
