Ledger Hardware Implant Blamed for $86 Million Crypto Theft

Ledger, a prominent provider of hardware cryptocurrency wallets, has confirmed that a sophisticated supply chain attack involving hidden hardware implants in its signers has led to the theft of millions in cryptocurrency. The company stated that all confirmed fund losses linked to the incident involved devices sold through a specific Southeast Asian reseller, CryptoBilis.

On-chain investigator Specter estimates the total losses associated with the attack could exceed $86 million. However, Ledger has not yet confirmed the exact number of impacted users or the total sum stolen, reiterating that the $86 million figure is an estimate.

The illicit implants were small circuit boards manually soldered onto the devices’ circuit boards, positioned beneath the signers’ screens. These covert components were designed to intercept sensitive user data, specifically the 24-word recovery phrase displayed during device setup.

Once decoded, the recovery phrase was transmitted to the attackers using a provisioned eSIM embedded within the implant, leveraging LTE for data exfiltration. Ledger clarified that while the implant could read screen data, it did not modify the device’s operating system, blockchain transactions, or digital signatures.

Ledger initially disclosed the cryptocurrency theft on 9 October, immediately linking the compromise to devices procured from CryptoBilis. The company subsequently urged the reseller to cease sales and advised customers to stop using any devices purchased from them within the last 90 days.

For affected users who have not yet set up their device purchased from CryptoBilis, Ledger recommends against initiating the setup process. For those who have already configured their Ledger device, the company advises moving assets immediately to a new Ledger signer, ensuring a fresh seed phrase is generated.

This incident underscores the critical importance of supply chain security, particularly for hardware devices designed to protect high-value digital assets.