Ledger says tampered hardware wallet device sent seed phrases over LTE

Ledger disclosed on X how an unauthorized implanted device found in wallets tied to a recent crypto theft incident worked. According to Ledger’s security research team Donjon, the device read the 24-word recovery phrase shown during a wallet’s initial setup, parsed it with a microcontroller, and transmitted it externally through eSIM-based LTE communication. Ledger said "This device does not modify the secure chip or operating system, and it does not manipulate transactions or signatures." Ledger added all confirmed theft cases so far involved products sold by Southeast Asian distributor CryptoBilis, with no confirmed cases linked to products from other sellers. Ledger also said it is reviewing reports that similar devices may have been inserted into other products and in other regions. Ledger said the total number of victims and the scale of losses have not yet been confirmed, and the figures circulating online have not been verified. Ledger had earlier confirmed an unauthorized implanted device in products sold by CryptoBilis, which suspended Ledger sales during the investigation.