Ledger says CryptoBilis implants captured recovery words during setup

What the investigation found

Ledger said on 13 October that an added component inside CryptoBilis-sold devices captured recovery words displayed during setup and transmitted them over LTE, a cellular connection. Its Donjon security team says the implant left the security chip, operating system and signatures unchanged. The finding explains how wallet credentials could escape without a software modification.

Ledger links all confirmed losses to the Southeast Asian reseller, which has stopped sales. It has not verified a drain involving another seller or established total losses. Buyers with unused devices should leave them uninitialized and contact Ledger Support. Existing users are advised to transfer assets to a new device with a new recovery phrase. Never restore a phrase onto CryptoBilis hardware. Contact support and local law enforcement before sending away a suspect device; loss victims should coordinate with police before opening it.

Why the displayed words matter

A recovery phrase is the ordered list of words used to recreate a wallet’s private keys, the secrets that control its accounts. Ledger’s recovery documentation explains that the words can restore multiple accounts on a compatible replacement device. The assets themselves remain on their blockchains. This makes the backup useful after hardware failure, but also makes disclosure consequential: another person who knows the words can reproduce access without possessing the original device.

The setup process described in that documentation begins with a PIN, followed by generation of a random number. A standard called BIP-39 turns that number into a phrase that the device displays for the owner to record. That deliberate display step is part of creating the backup, rather than evidence that a transaction is being approved.

Keeping the words offline protects that backup from additional exposure. Ledger advises against entering them into a computer or smartphone and against sharing them, including with Ledger itself. Those instructions also apply when someone offers help recovering a wallet.

Signing and setup protect different moments

The Secure Element is the chip that holds private keys and performs signing. Ledger says it directly controls the screen, while its operating system keeps individual applications isolated. These are descriptions of the intended design; they do not certify the physical condition of an individual unit.

For an ordinary payment, the process starts in wallet software on a phone or computer. The user checks the intended destination on the hardware display and approves the action there. The chip then creates a digital signature, which authorizes the transaction, and returns the signed transaction to the connected software for broadcast to the blockchain. The phone receives the signed result rather than needing the secret key for that operation.

This sequence explains what transaction confirmation is designed to protect: the payment being authorized at that moment. It is a different stage from initially recording a wallet backup. A description of the signing process alone cannot establish that an earlier setup was safe.

Reinstalling an app does not replace the keys

Ledger’s application guide explains another distinction relevant to a potentially exposed wallet: an app and its underlying credentials are separate. Each cryptocurrency app requests keys using a derivation path, the parameter that identifies which keys to generate from the recovery phrase. In the documented design, the app does not read the phrase itself. This operation takes place inside the Secure Element.

The resulting public key is used to form a receiving address. An address can be shared so someone can send funds; it is not the secret needed to recreate the wallet. Separating addresses, applications and recovery words helps explain why changing what appears in a wallet interface is not necessarily a change of credentials.

In particular, Ledger says uninstalling and reinstalling an app restores access to the same addresses when the recovery phrase is unchanged. Reinstallation therefore does not generate an unrelated wallet or remove another person’s knowledge of an exposed phrase. Treat an app reinstall as software management, not as evidence that the underlying wallet secrets have changed.