Ledger Details 'Spy' Chip in CryptoBilis Devices, Key Transmission

Ledger Addresses CryptoBilis Security Breach

Ledger, the hardware wallet manufacturer, has released its first detailed account of the security flaw discovered in devices distributed by CryptoBilis. The issue centers on a covert component embedded within these specific devices that could potentially steal users’ master private keys.

Crucially, Ledger stated the vulnerability does not originate from flaws within its own software. Instead, the compromised devices contained a separate, unauthorized chip capable of transmitting wallet keys via a mobile network. This means a user’s seed phrase – the foundation of their crypto security – could be intercepted without the core Ledger software being directly attacked.

The revelation follows investigations into reports of compromised devices and concerns raised by the crypto community. While Ledger has not specified the exact mechanism of the key transmission, the firm’s statement confirms the chip’s ability to operate independently of Ledger’s systems. This raises questions about the supply chain security of components used in hardware wallet manufacturing.

Ledger is advising users who purchased devices through CryptoBilis to take specific security precautions, including using a new seed phrase with a different device. The company is continuing to investigate the incident and working to understand the full scope of the breach. The incident underscores the importance of purchasing hardware wallets directly from authorized sources.

Source: CoinDesk