Ledger said an unauthorized hardware implant discovered in connection with recent cryptocurrency thefts operates by reading users’ 24-word recovery phrases and transmitting them externally.
According to Ledger’s security research team Donjon, the device is inserted inside a hardware wallet and detects the recovery phrase displayed on the screen during the initial setup process. A microcontroller then reads the 24 words and sends them externally via an LTE connection using a configured eSIM.
Ledger explained that the device does not alter the secure chip or operating system, nor does it manipulate transactions or signatures.
All funds theft cases identified so far are linked to products sold through Southeast Asian reseller CryptoBilis, and no losses involving products purchased from other sellers have been confirmed. However, Ledger is reviewing reports that similar devices have been found in other devices and regions.
The total number of victims and the scale of the losses have not yet been determined. Ledger said it has also not verified the loss figures being cited online. CryptoBilis suspended sales of Ledger products during the investigation.