SECURITY ALERT

The chip did not break the wallet.

It read it.

Ledger’s in-house security team, the Donjon, says the implant found in a signer sold by the Southeast Asian reseller CryptoBilis sits inside the case and watches the screen. When the device shows its 24-word recovery phrase during setup, the implant’s microcontroller “decodes the words and transmits them over LTE using a provisioned eSIM,” Ledger said on Tuesday.

Six hours later, Ledger said a second retailer had stopped selling its devices. As of 13 Oct, MediaMarkt Saturn has paused Ledger sales in its stores and online, with Ledger’s agreement, “following the report of an implant from one customer in Germany,” Ledger said. “No loss of funds were reported,” it added.

This follows Ledger’s 72-hour update, which called the number of impacted devices “limited”.

The timeline, in UTC

  • 10 Oct. Ledger confirms that one affected user’s signer contained an unauthorised hardware implant (our first report).
  • 11 Oct, 17:13. Ledger says all confirmed cases trace to devices sold through CryptoBilis, and that CryptoBilis has stopped selling hardware wallets.
  • 13 Oct, 06:39. The Donjon describes how the implant works and says Ledger is “reviewing reports of implants in other signers and locations”.
  • 13 Oct, 12:29. Ledger says MediaMarkt Saturn has paused Ledger sales while the investigation continues.

What Ledger says the implant does, and does not do

According to the Donjon, the implant is a separate component. It “does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.”

In plain terms, the device keeps working normally. The attack only needs the 24 words, which anyone can use to rebuild the wallet on another device and move the funds. Why the recovery phrase is the master key.

Ledger says every confirmed fund loss tied to the incident it disclosed on 9 Oct involves a signer sold through CryptoBilis, and that it has “not verified a drain linked to a signer bought elsewhere.”

It has also not confirmed how many users were hit or how much was taken. On-chain researchers estimate up to $93.2 million across more than 300 wallets, CoinDesk reported. Ledger says such figures come from third parties and it “has not fully verified them.”

If the hardware passes every software check, what is left to check?

What the researchers found

Independent researchers had opened devices before Ledger’s update. Mark Karpelès posted photos of an implant hidden behind the screen of a Ledger Nano X, and the research studio Tibane Labs described two implant versions, both using a small microcontroller, an eSIM and a shielded LTE module, BleepingComputer reported. In both, the giveaway was an antenna wire.

Those devices were bought through online marketplaces from sellers shipping from Malaysia, according to the researchers. They have not been tied to CryptoBilis by Ledger, and we have not examined any device ourselves.

Ledger’s Genuine Check cannot detect an added implant when the original Secure Element is intact, BleepingComputer noted.

What we do not know

  • How the German device was bought, which model it is, or whether it contains the same implant. Ledger has given no detail beyond “one customer in Germany”.
  • Whether MediaMarkt Saturn found anything in its own stock. We found no statement from the retailer.
  • Who built or installed the implants, and when they entered any supply chain.

How far down the shelf does “limited” reach?

Protect yourself

  • If you bought a Ledger from CryptoBilis and have not set it up, don’t. Contact Ledger Support.
  • If you have set it up, Ledger says to move your assets promptly to a new signer with a new recovery phrase. Do not restore any phrase on a CryptoBilis device.
  • If you lost funds or hold a tampered device, Ledger says to contact Ledger Support and file a police report, and not to send or open the device before speaking to them.
  • Ledger has published a guide to inspecting a signer, but warns that opening one can damage it. Back up your phrase first.
  • Ledger will never call you, message you or ask for your 24 words. Expect scammers to use this story.

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.