Ledger Investigates Tampering of Devices Sold by CryptoBilis, Reseller Halts Sales
Ledger has reported an investigation into 'spy' chip implants in devices sold by reseller CryptoBilis, which allegedly transmitted wallet keys over mobile networks. The reseller has ceased sales, and other hardware wallet manufacturers have
What happened
Ledger has publicly stated it is investigating incidents involving certain Ledger devices. These devices, sold by a reseller named CryptoBilis, were found to contain what Ledger described as 'spy' chips. These implants were reportedly LTE-enabled and capable of transmitting wallet keys, or wallet recovery phrases, over mobile networks. The issue surfaced after a customer in Germany discovered a corrupted signer within a device, leading MediaMarket Saturn to halt sales of Ledger products.
Following these reports, CryptoBilis has stopped selling Ledger devices. Ledger itself is actively investigating the situation to determine who tampered with the devices. Separately, reports indicate that other hardware wallet manufacturers, specifically Trezor and OneKey, have severed their relationships with CryptoBilis.
Why it matters
The reported incident directly affects the security and trustworthiness of hardware wallets, which are designed to be a secure method for storing cryptocurrency. The alleged presence of 'spy' chips capable of exfiltrating sensitive data like wallet keys or recovery phrases undermines the fundamental security premise of such devices. For users, the compromise of a hardware wallet could lead to unauthorized access and potential loss of digital assets. The involvement of a reseller highlights potential supply chain vulnerabilities that could expose consumers to modified or malicious devices.
Safety notes
When acquiring hardware wallets, it is generally recommended to purchase directly from the official manufacturer's website or from authorized, reputable distributors. This practice helps to mitigate risks associated with potential tampering or counterfeit products from unverified third-party sellers. Users who may have purchased Ledger devices from CryptoBilis should exercise caution and consider transferring assets to new, securely acquired wallets. It is also advisable for all hardware wallet users to regularly review security best practices, such as verifying the authenticity of their devices and software, and never entering recovery phrases into any digital interface unless explicitly instructed by the manufacturer during a legitimate recovery process.