UPDATE: Ledger details LTE spy implants in CryptoBilis units as sales halt
CIE News ·
Ledger confirmed LTE implants in CryptoBilis wallets intercepted seed phrases as sales were halted. Blockchain trackers estimate up to $94.5 million stolen.
Hardware wallets sold by reseller CryptoBilis contained unauthorized LTE-enabled implants designed to intercept recovery phrases, Ledger revealed, following earlier reports that users were targeted in an extensive crypto theft. According to Cointelegraph, Ledger Donjon found that microcontrollers read 24-word setup phrases and transmitted them over cellular networks without altering transactions or compromising internal secure chips. CryptoBilis has halted all hardware wallet sales, while manufacturers Trezor and OneKey have severed ties with the reseller.
The findings follow blockchain intelligence reports tracing tens of millions in missing assets. Bitquery reported tracing $93.2 million stolen across six blockchains from 315 wallets, consisting primarily of Tether (USDT) and TRON tokens, while security platform YFarmX estimated $94.5 million was taken from 521 addresses across seven networks. Tether has frozen $10 million in USDT associated with the exploit, according to CoinDesk.
Bitquery stated that around $81 million remained traceable onchain as of October 11, with portions transferred through Zcash and Tornado Cash. Ledger stated that investigations remain underway and advised CryptoBilis customers not to initialize unused devices, urging those who already used them to migrate funds to new devices with fresh recovery phrases.