🚨 Spy Attack on Ledger!
A Hidden Chip with an eSIM Was Revealed to Be Stealing Seed Phrases Directly from the Screen
The anatomy of the physical supply-chain attack
The cybersecurity team at #Ledger (Ledger Donjon) has revealed the technical details of how the massive funds drain was carried out, confirming that it was not a software bug or a vulnerability in its operating system, but a sophisticated physical intervention in the distribution chain.
1. How did the spy implant work?
Direct visual decoding: The malicious chip was hidden inside the device’s physical casing.
Real-time screen capture: When the user set up the device for the first time, the implant’s microcontroller read and decoded the 24 words of the recovery phrase (master key) directly from the screen.
Cellular transmission via LTE: The implant used an integrated eSIM to instantly send the 24 words to the attacker over the mobile network.
Secure Element untouched: The attack did not alter the Secure Element (the chip that protects private keys), the operating system, or transaction signatures. It was limited to “spying” on the seed phrase while it was displayed on screen.
2. Scope, Global Suspicions, and Financial Impact
CryptoBilis epicenter: Ledger reiterates that all confirmed losses to date came exclusively from devices sold by the CryptoBilis distributor in Southeast Asia, which has suspended all sales.
Additional cases under review:
Mark Karpeles (former CEO of Mt. Gox) reported finding a spy device in a Ledger Flex purchased at Singapore airport.
MediaMarkt Saturn (Germany) halted device sales following reports of a possible implant in the country.
Estimated losses: Although Ledger has not confirmed the official figure, on-chain analysts estimate the thefts at $93.2 million across more than 300 wallets.
$BTC
$ETH
$SOL
A Hidden Chip with an eSIM Was Revealed to Be Stealing Seed Phrases Directly from the Screen
The anatomy of the physical supply-chain attack
The cybersecurity team at #Ledger (Ledger Donjon) has revealed the technical details of how the massive funds drain was carried out, confirming that it was not a software bug or a vulnerability in its operating system, but a sophisticated physical intervention in the distribution chain.
1. How did the spy implant work?
Direct visual decoding: The malicious chip was hidden inside the device’s physical casing.
Real-time screen capture: When the user set up the device for the first time, the implant’s microcontroller read and decoded the 24 words of the recovery phrase (master key) directly from the screen.
Cellular transmission via LTE: The implant used an integrated eSIM to instantly send the 24 words to the attacker over the mobile network.
Secure Element untouched: The attack did not alter the Secure Element (the chip that protects private keys), the operating system, or transaction signatures. It was limited to “spying” on the seed phrase while it was displayed on screen.
2. Scope, Global Suspicions, and Financial Impact
CryptoBilis epicenter: Ledger reiterates that all confirmed losses to date came exclusively from devices sold by the CryptoBilis distributor in Southeast Asia, which has suspended all sales.
Additional cases under review:
Mark Karpeles (former CEO of Mt. Gox) reported finding a spy device in a Ledger Flex purchased at Singapore airport.
MediaMarkt Saturn (Germany) halted device sales following reports of a possible implant in the country.
Estimated losses: Although Ledger has not confirmed the official figure, on-chain analysts estimate the thefts at $93.2 million across more than 300 wallets.
$BTC
$ETH
$SOL