Ledger reveals how hidden chips stole wallet recovery keys

Ledger has confirmed that an unauthorized hardware implant found inside a cryptocurrency signer sold by Southeast Asian reseller CryptoBilis can capture users' 24-word recovery phrases and transmit them through a cellular network. Ledger confirmed a hardware implant inside one affected signer sold through Southeast Asian reseller CryptoBilis. The implant reads recovery phrases during setup and transmits captured words through an LTE connection. Ledger says the implant operates separately without modifying its Secure Element, operating system, or signatures. CryptoBilis has suspended Ledger signer sales while investigators examine affected devices and reported customer losses.