Ledger Confirms Hardware Implant in CryptoBilis-Supplied Wallets After Crypto Thefts

Researchers have shown the implant in the Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware. In a report over the weekend, Tibane Labs described how the threat actor made room for the malicious circuitry by replacing the original battery with a smaller one, which powers both the implant and the Ledger X.

Inside one of the devices, the researchers found an ST STM32G431KBU6, an Arm CortexM4 microcontroller with 128 KB flash in a UFQFPN32 package. For connectivity, the actor used a tiny eSIM in an 8-pad package just 2 by 2 mm next to the MCU, along with a shielded LTE module that sends the words out, according to Tibane Labs.

Ledger is advising users to avoid purchasing from unauthorized resellers because they run an increased risk of getting counterfeit or modified devices. The company also reminded authorized resellers and distributors to get products only through authorized channels and to avoid restocking returned products.

Ledger provides a 'Genuine Check' mechanism to determine the authenticity of a device. The company explicitly warns that the mechanism cannot detect added implants when the device's original Secure Element remains intact.

Editor's Summary Ledger confirmed that devices sold through CryptoBilis contained an implant that drained cryptocurrency wallets. Researchers found a microcontroller, eSIM, and LTE module hidden inside a modified Ledger X, and Ledger is urging users to buy only from authorized resellers. Ledger's Genuine Check can verify authenticity but cannot detect added implants if the original Secure Element is intact.