A Sophisticated Hardware Implant to Steal Users’ Funds

Ledger has confirmed the presence of an unauthorized hardware implant in some of its wallets distributed through CryptoBilis, a Southeast Asian reseller. According to BleepingComputer, this implant, found in at least one Ledger device, uses an STM32G431KBU6 microcontroller and a shielded LTE module to transmit captured data. Mark Karpelès, a cybersecurity expert, shared a photo showing the implant hidden behind the Ledger X screen, equipped with an eSIM for network connectivity.

The implant captures the display and button presses to identify users’ recovery phrases (seed phrases). Two versions of this implant have been confirmed by Tibane Labs, with differences in their integration and power supply. Ledger specifies that compromised devices were purchased on platforms like Amazon Japan and Yahoo! Auctions Japan, then shipped from Malaysia.

Ledger confirms that an unauthorized hardware implant was discovered in a wallet sold by CryptoBilis, using an LTE connection to steal user data and drain their crypto funds.

Estimated Losses of $86 Million and an Ongoing Investigation

Reports of fund thefts linked to these implants involve estimated losses of $86 million in cryptocurrencies, according to The Coin Republic. Funds were drained from Bitcoin, Ethereum, and TRON wallets, with suspicious transfers to platforms like Tornado Cash. Ledger has asked CryptoBilis to immediately suspend sales and shipments of its devices, while advising customers to avoid initializing new wallets or transferring assets to a secure new device.

Ledger emphasizes that its direct sales channels are unaffected by this flaw, and that the incident does not call into question the security of hardware wallets in general. However, the investigation is focusing exclusively on devices sold by CryptoBilis over the past 90 days.

How to Identify a Compromised Wallet and What Actions to Take

Ledger advises users who purchased a device through CryptoBilis not to initialize it if they haven’t already done so. For those who have already set up their wallet, the company recommends immediately transferring their assets to a new Ledger device with a new recovery phrase, according to The Hacker News. A legitimate wallet should never arrive with a predefined, printed, or sealed recovery phrase.

Ledger has also reminded all its resellers not to restock returned products, to avoid reintroducing compromised devices. Changpeng Zhao, former CEO of Binance, suggested a hypothesis that attackers may have acquired CryptoBilis using a non-disclosure agreement (NDA) to conceal their operation, although this information has not been confirmed by Ledger or CryptoBilis.

What this changes here: risks for African businesses and administrations

While this incident does not directly concern Benin or West Africa, it underscores the importance for local businesses and administrations to verify the authenticity of the IT and cryptocurrency equipment they acquire, especially through third-party resellers. Organizations using hardware wallets to manage digital assets may, in the future, strengthen their purchasing protocols by prioritizing official manufacturer channels and conducting physical audits of received devices.

Béninese and West African administrations managing public funds or digital assets could also consider partnerships with cybersecurity experts to assess the risks associated with third-party equipment. Additionally, training IT teams on best practices for securing hardware wallets and detecting signs of compromise (such as a pre-filled recovery phrase) would be a way to limit the risk of financial losses.

Finally, this episode highlights the need to diversify purchasing channels and avoid relying exclusively on a single reseller, especially in a context where attacks specifically target intermediaries. Local businesses could thus integrate verification clauses into their contracts with technology suppliers.