Hidden implants in Ledger wallets may have enabled crypto thefts, prompting retailers to halt sales and investigations into distribution channels in Europe and Asia.
Hidden components in Ledger wallets
Hidden electronic components were discovered in some Ledger cryptocurrency wallets, potentially allowing the theft of users' recovery phrases. These components could intercept the 24-word recovery phrase during the first setup of the wallet and transmit it via mobile networks.Suspension of sales and investigation
MediaMarktSaturn has suspended the sale of Ledger wallets after a German customer reported finding unexpected components in two devices. The investigation is examining multiple distribution channels in Europe and Asia, including the authorized reseller CryptoBilis in Southeast Asia.Mechanism of the implant
According to Ledger's security team, the hidden implant activates during the first setup of the wallet. It intercepts the recovery phrase as it is displayed and sends it to attackers through an LTE connection using an eSIM. This bypasses the wallet's security without altering its core components.No confirmed thefts yet
Despite the concerns, no confirmed thefts have been reported so far. The situation remains unclear, as the reports are based on customer observations and not independently verified. The manufacturer, Ledger, claims to have found no evidence of a breach to its infrastructure or services.Broader response from the industry
Trezor and OneKey have both removed CryptoBilis from their authorized reseller lists and are reassessing their distributor networks. These actions are precautionary, as no evidence of attacks on their own products has been found. The investigation continues to determine the scope of the issue and identify those responsible.
