Ledger Says Unauthorized Component in CryptoBilis Wallets Leaked Recovery Phrases Over Cellular

Setting up a Ledger signer bought from Southeast Asian reseller CryptoBilis was enough to expose a buyer’s 24-word recovery phrase , according to Ledger’s Donjon researchers, who traced the leak to an unauthorized, separate component installed inside the device. In an Oct. 13 update , Ledger said the implant, which its Donjon team is analyzing, “sits inside the enclosure and reads the data shown on the screen.” Once the device shows the recovery phrase during setup, Ledger said, “its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM.” Ledger described the implant as an added part…