Spy chip in crypto wallets: Ledger confirms supply-chain attack
Devices sold by a Malaysian reseller contained a hidden chip that sent secret recovery phrases over the mobile network. Researchers put losses at up to $93 million.
Symbolic image · Photo: Gareth Halfacree from Bradford, UK / Wikimedia Commons, CC BY-SA 2.0 (cropped and resized)
French hardware maker Ledger has confirmed that tampered hardware wallets contained a foreign chip. According to the company, the affected devices were sold through Southeast Asian reseller CryptoBilis. The chip sat inside the casing and read the 24-word recovery phrase from the screen during setup. It then sent the words to the attackers over LTE using an eSIM. Anyone who has the phrase can recreate the wallet elsewhere and drain the funds.
Ledger said the secure element and the software were not modified, calling the incident a physical supply-chain attack. Blockchain analysts estimate losses of up to $93.2 million from more than 300 wallets; Ledger has not given a figure. According to Ledger, MediaMarkt Saturn has also stopped selling its devices after a customer in Germany reported a suspected spy chip.
Ledger advises buyers of CryptoBilis devices not to set them up. Anyone already using one should move funds to a new device with a newly generated recovery phrase. The built-in authenticity check cannot detect such added chips, BleepingComputer reported. Chief technology officer Charles Guillemet said Ledger is reviewing its reseller controls and anti-tamper protections.