Ledger discloses that wallets sold by CryptoBilis had LTE spy chips implanted, which could expose recovery phrases, with estimated on-chain losses reaching $93.2 million.

Hardware wallet manufacturer Ledger updated its investigation on X on Tuesday, stating that some Ledger crypto wallet devices sold by Southeast Asian distributor CryptoBilis were implanted with covert hardware capable of reading users' 24-word seed phrases (recovery phrases) from the device screen and sending them to attackers via mobile networks. Ledger said the spy chip was located inside the device casing and used LTE technology and an eSIM to transmit data. A recovery phrase is the master key to a crypto wallet, and possessing it allows for the transfer of funds. On-chain researchers estimate that the incident resulted in losses of up to $93.2 million, affecting over 300 wallets, with Tether having frozen $10 million in USDT related to the theft. Ledger confirmed that one affected signer contained an unauthorized implant and stated that all confirmed losses in the October 9 incident involved devices purchased from CryptoBilis. Ledger advises users who purchased devices from this distributor not to initialize them, and users who have already used them should transfer assets to a new device and generate a new recovery phrase.